A Simple Workflow for Handling Security Footage Requests Step by Step

A request to view CCTV footage can arrive after a fall in a lobby, a parcel going missing, a vehicle being damaged in a garage or a disagreement in a shared area. The footage may help clarify what happened, but it can also show residents, visitors, staff, children, vehicle details and activity unrelated to the incident.

A reliable process protects both the people in the footage and the building’s ability to respond fairly. It should make clear who can decide, what footage is genuinely needed, how it is reviewed, where any exported copy goes and when it is deleted. This guide sets out a practical step-by-step workflow for property managers, building teams and owners’ associations. Adapt it to your organisation’s policies and applicable data protection requirements.

Start with governance, not the playback button

Before a request arrives, agree who owns the decision-making process. A camera may be installed in a shared building, but that does not mean every resident, committee member or staff member can view its recordings. The building owner, management company, owners’ association or another designated controller may have responsibilities for deciding why footage is used and who is authorised to handle it.

Write down the roles. Name the person or team that receives requests, the authorised reviewer, the person who approves disclosure and the person responsible for recording exports and deletion. In a small building, one person may hold several roles, but the steps should still be documented. If a request involves a complaint, injury, possible crime, employment matter or legal dispute, involve the appropriate senior manager or adviser before releasing footage.

Ask the purpose question

For each camera, ask: “What security question does this camera answer?” If there is no clear answer, the camera’s purpose and continued use deserve review. Cameras should not be installed “just in case”, and recorded footage should not become a way to casually monitor residents, staff or visitors.

Governance should cover the camera’s purpose, placement, field of view, access permissions, Check out this site retention period and request-handling process. Keep a current camera map and record any changes, including who approved them and why.

The step-by-step request workflow

1. Receive a written request

   Use a consistent written request intake form or email process. Ask the requester to identify themselves, explain what happened, give the date and an approximate time range, and describe the relevant location or camera if known. Ask what outcome they are seeking, such as an internal incident review or information about the next steps.

   Do not ask for more personal information than the situation requires. If the requester is acting for another person, check what authority or permission is appropriate before proceeding. A request made in person can be acknowledged, then recorded in writing by the team member who receives it.

2. Acknowledge and log the request

   Confirm receipt and explain that the footage will be checked, but that access or a copy is not automatic. A request log should record the date received, requester, incident description, relevant location and time, assigned reviewer, decision, action taken and any follow-up date.

   Keep the log in an access-controlled system, separate from informal notes or general building correspondence. Do not forward raw footage, passwords or links to a broad mailing list.

3. Check whether footage exists

   Confirm which camera may cover the location and whether the system recorded during the stated period. Check the system clock: it may not match the actual time exactly. If the footage is approaching routine deletion, promptly consider whether a limited preservation step is appropriate under your policy. Record who authorised it and why; do not preserve everything indefinitely simply because a request has been made.

4. Define the narrowest useful search

   Agree a proportionate time window and camera scope. Start with the shortest period likely to answer the incident question, then expand only if needed. Review the camera’s field of view: a lobby camera may also capture a doorway, reception desk or people passing through who have nothing to do with the event.

   Data minimisation starts before playback. Do not search every camera or date range because it is convenient. If one view and a short interval are enough, there is no reason to inspect or export more.

5. Authorise and review the relevant clip

   Limit review to trained, authorised people. Record who viewed the material, when, which camera and time range they reviewed, and the purpose. Review it in a controlled setting, not on a personal device or in a public area where others can see the screen.

   Take factual notes rather than speculative conclusions. Record what is visible, any relevant time offset, and whether the clip appears complete. If the footage does not resolve the question, say so. CCTV should not be treated as a definitive account of events when the angle, lighting or coverage is limited.

6. Decide what can be shared

   Consider the requester’s purpose and the rights and safety of everyone else shown. Depending on the circumstances, the appropriate response may be a summary, an opportunity to view a limited segment, a redacted copy, or no footage. Do not assume that a person appearing in a clip is automatically entitled to receive the unedited recording.

   When a request relates to a formal data access right, a police enquiry, a legal claim or an urgent safety issue, follow the applicable legal and organisational process. Seek advice where the basis for disclosure or the correct response is uncertain. Record the reasons for the decision, including why footage was withheld or limited.

7. Review and redact the clip

   If a copy is appropriate, review and redact clip before release. Redaction may involve blurring or masking other people, vehicle registration plates, screens, door-entry details, or information that reveals sensitive routines or security arrangements. Check audio as well as images: a clip may capture conversations that are not relevant to the request.

   Redaction is not complete until it has been tested. Make sure masks remain in place throughout the clip, including when people or vehicles move. Check that the original unredacted material is not recoverable from the exported file, hidden layers or attached metadata. Keep the original securely where there is a valid reason to retain it, but do not distribute it as a working copy.

8. Export the final version only

   Use a controlled process to export final version only. Keep the source recording separate from the redacted disclosure copy, label the export with a reference and date, and make a note of what was included. Have a second authorised person check the export where practical, particularly if the clip is sensitive or includes extensive redaction.

   Before sending anything, ask: Where will the exported clip end up, and who can open it? Choose an approved secure transfer method. Avoid raw clips sent as ordinary email attachments, open links or shared-folder dumps. Restrict access to named recipients, use suitable access controls, and communicate any passcode separately if your procedure requires one.

9. Close the request and set a deletion date

   Tell the requester what action was taken, what was provided or why it could not be provided, and how to raise a concern or follow-up. Keep a record of the disclosure, including the recipient, transfer method, clip version and date. Do not keep an exported copy in a downloads folder or shared drive without an owner and deletion date.

   

   Set a specific review or deletion date for any preserved original, redacted export and working file. Delete temporary copies when they are no longer needed, using the organisation’s approved process. If a legal hold or investigation requires longer retention, document the reason, scope, authorisation and next review date.

Make camera placement and field of view part of the process

Request handling cannot compensate for poor camera design. Aim cameras at the area needed for the stated security purpose and avoid capturing more of a home, neighbouring property or unrelated shared space than necessary. Review the field of view after installation and whenever the camera is moved, replaced or adjusted.

Use privacy masking or repositioning where it can reduce unnecessary capture without defeating the security purpose. Keep a record of the approved view and check periodically that the angle has not drifted. A camera that covers a particular entrance to deter unauthorised access should not become a general-purpose tool for tracking who visits a resident or how long staff take a break.

Set retention periods and delete routinely

Choose a retention period that is justified by the camera’s purpose and operational needs. There is no universal number of days that suits every building. Consider how quickly incidents are normally reported, how often footage is needed for a legitimate review, the system’s capacity and the risks created by keeping unnecessary personal information.

Document the period for each system or camera group, configure automatic deletion where possible and check that it works. Routine deletion is part of the control—not an optional tidy-up. If relevant footage needs to be preserved, retain only the segment required, document the reason and review the hold regularly. When the reason ends, delete it in line with policy.

Use a clear, proportionate fee policy

A common mistake in published guidance is to mention requests without saying whether any fee may apply. Do not copy an article’s silence as your building’s policy, and do not invent a price. State plainly whether your organisation charges for a particular service, under what circumstances, and who can confirm the amount. Any charge must be checked against applicable law and your approved policy before it is quoted.

If there is no charge, say so. If a fee may apply—for example, for a separately requested service rather than a standard access request—explain the basis and seek approval before work starts. Keep the explanation simple and give the requester a contact for questions. Transparent wording prevents surprise and avoids staff improvising different answers.

Quick operational checklist

• Is the request in writing, with a clear incident, location and time range?
• Who is authorised to assess, review and approve the response?
• Which camera and shortest useful time window apply?
• Does the camera’s field of view capture unrelated people or sensitive details?
• Has the decision and each viewing or disclosure been logged?
• Have faces, plates, screens, audio and other identifying details been considered for redaction?
• Is the export the final redacted version, and has it been checked?
• Where will the file go, who can open it, and how will access be secured?
• What is the deletion date for each retained copy?

Make the workflow routine

A good footage-request process is repeatable, restrained and accountable. It begins with a written request intake, limits the search to what is needed, gives decisions to authorised people, and records the reasons. It ends with a secure, appropriately redacted disclosure—or a clear explanation of why one is not being made—and a planned deletion date for any retained copy.

Review the process with the board or relevant governance group, train onsite staff not to browse footage out of curiosity, and test the workflow with a realistic scenario. The aim is not to make access difficult. It is to answer a legitimate security question while collecting, viewing, sharing and keeping as little footage as the task allows.

Share this guide

Facebook share | X (Twitter) share