Footage must be sufficient for, rationally linked to and no more than the purpose needs, so the organisation should identify the minimum data it needs (defined recording periods, restricted locations). Images should be good enough for the purpose, protected from corruption, with date and time stamps checked (for example at clock changes); matching systems such as ANPR and FRT need accuracy procedures, algorithms and AI should be documented, and features such as audio, live streaming and cloud storage assessed in the DPIA. System choice should weigh governance capabilities (upload, storage, audit, retrieval for requests, redaction) as much as image quality, and buyers can specify these to suppliers.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.