CCTV Footage Request: How to Get Video of Yourself

The controller is whoever operates the camera, and that is the organisation you ask. There is no central CCTV body and no way to search for footage across operators, so identifying the right one is the first job.

• A shop, pub, gym, restaurant or petrol station. The business itself, normally through customer services or a named data protection contact in its privacy notice. A branch may not be able to act on it; the company behind it can.
• A bus, train, taxi or a car park. The operator, not the local authority, unless the authority runs the vehicle or the site itself.
• A street camera or a council building. The council. Councils publish a data protection contact and most have a request form.
• Your workplace. Your employer. Asking an employer for your records covers the rest of what an HR file holds.
• A block of flats or a rented property. The landlord, the managing agent, or the freeholder — often not the same organisation. Tenancy records explains how those three separate.
• A neighbour’s camera or doorbell. The neighbour, personally. This surprises people and it is covered below.

If an organisation has given a copy to somebody else — the police, an insurer — that recipient becomes a controller for the copy it holds. The ICO puts it plainly: “Once you have disclosed information to a third party they become the controller for the copy they hold”. So the original operator deleting its copy does not necessarily mean every copy is gone.

Footage is indexed by time and camera, not by name, so an operator cannot look you up. The ICO’s guidance tells operators to have procedures that locate a requester’s information “using the date, time and location where the footage was captured”, and says you should provide something “such as a photo, date or time, that allows you to identify them as the subject of the information”. Give them all of it:

• The date, and the time as tightly as you can. A ten-minute window is far more likely to be searched than “Tuesday afternoon”.
• The exact location. Which entrance, which aisle, which platform, which direction you were walking.
• A recent photograph of yourself, and what you were wearing. This is one of the rare occasions where sending a photo helps rather than oversharing — it is how they find you in the frame.
• That you want the footage itself, in a common video format, rather than a description of it.
• The preservation request, first and in plain words.

Identity. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

Our free letter builder produces a written request you can send yourself, and what a subject access request is covers the rest of the mechanics.

More than most people are offered, and the difference is worth knowing before you accept a refusal.

• The footage, not a summary of it. The ICO says that “providing an individual with a transcript of either the audio or visual information contained in the footage is not enough to comply in most circumstances”, because a transcript “or even a still photograph in some circumstances” does not carry the context that makes the footage your personal data.
• A copy, if you want one, rather than a viewing. An operator may offer to let you watch it on their premises instead of handing over a file, and that is a legitimate offer. But the ICO is explicit that if you “refuse an offer to view the footage or they insist on a copy of the footage, then you must do whatever is reasonable in the circumstances to provide them with a copy”. An operator saying “you can come and look at it” is not the end of the conversation.
• In a usable format. The ICO expects operators to be able to “provide footage to individual requesters or law enforcement in a commonly used video file format”.

Time limit. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies. On footage specifically, the ICO notes an operator “may however refuse to deal with the request or charge a reasonable fee if you feel the request for footage is manifestly unfounded or excessive”, and that it is for the operator to demonstrate that, not for you to disprove it.

Expect blurring, and do not expect the whole clip. Your right reaches your own personal data, so the ICO frames the operator’s duty as “to provide a copy of the information about the requester rather than a complete version of footage”, while making sure that doing so “does not adversely affect the rights and freedoms of others”.

Where other people appear, the ICO lists the techniques an operator is expected to reach for — “blurring, masking, or using a solid fill to completely obscure parts of the footage” — and says it may also consider seeking those people’s consent where that is reasonable. Each request is judged case by case.

This is not a way to obtain footage of someone else. An incident you were not in, a recording of a neighbour, a video of another person’s car: none of that is your personal data, and a subject access request is the wrong tool. If you need footage as evidence about somebody else, that is a matter for the police, for a court order, or for your insurer to pursue.

If the police hold the recording — body-worn video, a custody suite camera, ANPR, or a copy a shop handed over — your request is not made under Article 15 of the UK GDPR. Policing records fall under Part 3 of the Data Protection Act 2018, which is a separate access right with its own exemptions, and every force runs its own process.

Which police record do you need routes that, and each force page carries its own address, form and identity requirements.

One thing worth carrying across: anything containing an image of a person raises the identity bar, and forces routinely ask for more proof for footage than for a paper file.

People often send a freedom of information request to a council or other public body for footage of themselves. It will be refused, and correctly.

Section 40 of the Freedom of Information Act 2000 exempts your own personal data from freedom of information altogether, and the ICO tells public authorities that where the answer is yes, “you should treat this request as a data protection subject access request”. In Scotland the equivalent is section 38(1)(a) of the Freedom of Information (Scotland) Act 2002, in the same terms.

Freedom of information is still the right tool for a different question — how many cameras a council runs, where they are, what they cost, how long it keeps recordings. Just not for the recording of you. Subject access requests in Scotland covers the Scottish side of that split.

The most common answers are “it has been overwritten”, “we cannot give you it because of other people in it”, and silence. The first is usually true and unfixable. The second is a reason to redact, not a reason to refuse outright, and it is worth saying so.

There are real exemptions. Where disclosure would prejudice the prevention or detection of crime, an operator can withhold footage, and an operator holding footage of an incident it has reported to the police will often rely on that. It has to be a genuine assessment about your specific footage rather than a policy.

Complaining. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.

On this subject, though, read that alongside the 40-week queue and the ICO’s own statement that it will not retrieve footage for you. A complaint may well establish that an organisation handled you badly. It will not produce the recording. That is why the whole of this page pushes the work to day one.

Check what you got back helps if a response has arrived and looks thin.

• Dashcam and doorbell video held by a private person. Same analysis as a neighbour’s camera: if it records beyond the household, data protection applies.
• Call recordings. A recording of your voice is your personal data on the same footing as your image, and the same request works.
• Body-worn video used by non-police staff — security guards, enforcement officers, some retail and transport staff. That is an ordinary Article 15 request to their employer, not the police route.
• Automatic number plate recognition. A private car park operator’s ANPR record of your vehicle, tied to you, is your personal data. Police ANPR is the Part 3 route above.

What a search has to cover. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.