UK ICO Guidance on Video Surveillance including CCTV (2022)
Governance after deployment – UK ICO Guidance on Video Surveillance including CCTV (2022)
UK ICO Guidance on Video Surveillance including CCTV (2022) G.5: G.5 Redact third parties case by case (blur, mask, solid fill, metadata) with trained staff or a contracted processor
Providing the requester's data must not adversely affect others: the organisation may seek third parties' consent where reasonable or redact, deciding case by case on the harm from not redacting, using techniques such as blurring, masking or solid fill and removing metadata, with specialist software and trained staff to meet deadlines. Governance capability should be weighed at procurement and in the DPIA, favouring products built with data protection by design; an outside redaction service will be a processor needing a written contract with quality and security guarantees.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.