“CCTV Footage Is Easy to Obtain for Private Investigators” – Data Protection Reality

“CCTV Footage Is Easy to Obtain for Private Investigators” – Data Protection Reality

The bottom line: Private investigators cannot simply walk into a business, council office or police station and request CCTV footage. Footage is personal data under UK GDPR, and its release is governed by strict data protection rules. The only person with an automatic right to request CCTV footage of themselves is the data subject, the individual who appears in the footage. Everyone else, including private investigators, needs either the data controller’s voluntary cooperation, a court order, or a specific legal exemption.

Where This Myth Comes From

The UK has one of the highest densities of CCTV cameras in the world. Estimates vary, but there are believed to be between 4 and 6 million cameras operating across the country. High streets, car parks, transport networks, office buildings and residential areas are all covered. This saturation creates the impression that footage of almost any incident should be available and easy to obtain.

In practice, it is more complicated. The footage exists on systems owned and operated by thousands of different organisations and individuals, each with their own policies on data retention, access and disclosure. There is no central repository, no single point of access, and no legal shortcut for private investigators to obtain it.

The Legal Position

UK GDPR and the Data Protection Act 2018: CCTV footage that captures identifiable individuals is personal data. The organisation that operates the camera system is the data controller and has legal obligations regarding how the data is stored, used and disclosed. Releasing footage to a third party (including a private investigator) is a form of data processing that must be lawful under Article 6 of UK GDPR.

Data subject access requests (DSARs): Under Article 15 of UK GDPR, any individual has the right to request a copy of their own personal data, including CCTV footage in which they appear. The data controller must respond within one calendar month. However, this right belongs to the data subject, not to the investigator. A PI cannot submit a DSAR on behalf of another person without a written mandate from that person.

Exemptions for crime prevention and detection: Schedule 2 of the Data Protection Act 2018 includes exemptions that allow personal data to be processed for the purposes of preventing or detecting crime, apprehending or prosecuting offenders, and assessing or collecting tax. These exemptions are intended for law enforcement and public authorities, though a data controller may choose to release footage to a private party if they believe it falls within these purposes. This is discretionary, not mandatory.

ICO guidance on CCTV: The Information Commissioner’s Office has published detailed guidance on the use of CCTV. This guidance makes clear that operators must have a lawful basis for processing footage, must not retain it longer than necessary, and must respond to DSARs appropriately. The guidance does not grant private investigators any special access rights.

Practical Difficulties in Obtaining Footage

Even where footage theoretically exists, several practical problems arise:

Retention periods are short. Most CCTV systems overwrite footage automatically after a set period, typically between 7 and 31 days. Some systems retain footage for as little as 72 hours. If an investigator does not identify the relevant camera and request preservation quickly, the footage may be gone before any formal request can be made.

Camera coverage is inconsistent. Not every angle is covered. Cameras may be positioned to cover entrances but not car parks, or to monitor shop floors but not loading bays. The footage you need may not exist, or the camera may have been obscured, poorly maintained or out of service at the relevant time.

Organisations are cautious about disclosure. Data controllers face potential fines of up to 4 per cent of annual global turnover for data protection breaches. Many organisations, particularly large corporations, councils and transport operators, have standard policies that refuse disclosure to third parties unless compelled by a court order or police request. This is not obstruction; it is prudent compliance with data protection law.

Quality varies wildly. CCTV footage ranges from high-definition colour to low-resolution, time-lapsed, black-and-white recordings. Footage that appears to show an incident may be too poor in quality to identify individuals or establish what happened.

How Private Investigators Work with CCTV

Despite these limitations, CCTV evidence plays an important part in many investigations. Professional investigators approach it methodically:

Identifying cameras: Before requesting footage, an investigator must identify which cameras cover the relevant location. This involves physical reconnaissance of the area, noting the position, angle and likely operator of each camera. Cameras may be operated by the local council, Transport for London, Network Rail, private businesses, residential properties, or national agencies. Each requires a separate approach.

Acting quickly: Because retention periods are short, speed is critical. When UKPI is instructed on a case where CCTV evidence may be relevant, our evidence gathering team contacts the relevant operators immediately to request that footage be preserved, even before a formal disclosure request is made.

Using the correct legal mechanism: Depending on the circumstances, the investigator may advise the client to submit a DSAR (if they are the data subject), request voluntary disclosure from the data controller, or apply to the court for a disclosure order. Each route has different requirements and timescales.

Working with solicitors: In litigation, a solicitor can write to the data controller requesting preservation and disclosure of footage. If the data controller refuses, the solicitor can apply for a court order. This is the most reliable route for obtaining footage in contested cases. Our legal support services coordinate with solicitors on these applications.

Combining CCTV with other evidence: Experienced investigators do not rely on CCTV alone. They combine it with physical surveillance, witness statements, open-source research and other evidence sources to build a complete picture. If CCTV footage is unavailable, these other sources may provide equivalent or better evidence.

Your Own CCTV System

If you operate a CCTV system at your home or business, you should be aware of your own obligations. Domestic CCTV that covers only your own property is exempt from UK GDPR, but cameras that capture images of people beyond your property boundary (such as a neighbouring garden, public pavement or shared access) bring data protection obligations. You become a data controller and must comply with the UK GDPR principles, including responding to subject access requests.

The ICO has issued specific guidance for domestic CCTV users, and non-compliance can result in enforcement action. If you are installing cameras for security purposes, take professional advice on positioning and signage.

What to Do If You Need CCTV Evidence

If you believe CCTV footage exists that is relevant to your case, act quickly. Contact a professional investigator who can identify the cameras, advise on the correct disclosure route, and handle the process efficiently. The longer you wait, the greater the risk that the footage will be overwritten.

Time is the most critical factor. Every day that passes increases the chance that footage has been overwritten.

Call UKPI on 0800 043 1754 to discuss your situation. We will tell you honestly whether the footage is likely to exist, how to request it, and what alternatives are available if it has been lost or refused.