Need a GDPR-compliant video redaction solution?
You can deploy Identity Cloak in under 10 minutes and complete your first redaction project in 12 minutes or less.
CCTV monitoring needs vary for each organisation.
High-risk work environments often install CCTV for health and safety reasons. Remote locations may be monitored to generate alerts, and venues such as museums may require access monitoring. CCTV monitoring is also often used for theft and incident prevention in public or retail spaces.
The use case shapes the compliance obligation, covering the topics of lawful basis, retention periods, and what happens when someone submits a data subject access request. We discuss those concepts below.
#The basics of CCTV surveillance under GDPR
Under GDPR, CCTV footage constitutes personal data if the individuals are identifiable from them. Personal data includes any personally identifiable information — faces, car licence plates, location signage, tattoos, and even information visible on computer screens in the background of a shot.
This is broader than most organisations initially expect. For example, reception desk footage may capture a visitor's face, vehicle registration through a window, and a name badge on a passing employee.
#Lawful basis for processing CCTV footage
Organisations must have a lawful basis for processing personal data captured by CCTV. The two most common bases in a workplace context are:
Legitimate interests
Companies may have a legitimate interest in using CCTV to ensure the safety and security of their premises, protect assets, protect staff, and monitor for unlawful activity.Compliance with a legal obligation
In some cases, organisations are required by law to use CCTV for specific purposes, such as health and safety regulations or industry-specific standards.
Whichever basis applies, it must be documented and defensible.
#Complete DPIA before you install
Before setting up CCTV cameras, you must complete a DPIA (data protection impact assessment) to identify and minimise risks that result from data processing activities.
DPIAs are also required when organisations are considering significant changes to existing CCTV systems to catch and prevent compliance issues.
#Transparency and notice requirements
Organisations must inform employees and visitors that CCTV is in operation and provide clear signage indicating where cameras are active.
Covert surveillance is generally prohibited unless there is a specific, compelling legal justification — and even then, it requires careful documentation. Employees must also be informed about any changes in monitoring practices before those changes take effect.
#Data minimisation and retention periods
Businesses should only collect and retain CCTV footage for as long as necessary to achieve the purpose for which it was collected. Excessive retention breaches the data minimisation principle under GDPR. Exact retention periods will depend on the industry and the purpose of the footage.
If video footage is required for legal proceedings or an ongoing investigation, it should be retained until the matter is resolved — even if this exceeds the standard retention period.
The key is that your retention policy is documented, applied consistently, and reviewed regularly.
#Security measures for CCTV footage
Organisations must implement appropriate security measures to protect CCTV footage from unauthorised access, loss, or destruction. This includes encryption, permission-based access controls, and secure storage systems. Footage should only be accessible to personnel with a clear operational need.
#Data subject access requests (DSARs) and CCTV
Individuals have the right to request access to CCTV footage that features them. Employers must have procedures in place to respond to DSARs within the timelines specified by GDPR — usually 30 days.
This is where many organisations run into practical difficulty.
SARs involving video footage are not straightforward to fulfil. The footage almost always contains other individuals whose personal data must be protected. That means redaction is not optional — it is a legal requirement before any footage can be shared.
#What must be redacted when sharing CCTV footage
Whenever CCTV footage is shared in response to a DSAR or for any other purpose, all individuals other than the subject of interest must be redacted. This applies to:
Faces of bystanders, colleagues, or visitors
Vehicle registration plates
Tattoos or distinguishing marks
Signage or location indicators
Information visible on screens in the background
Failing to redact this information — even accidentally — constitutes a privacy breach under GDPR.
#The penalties for non-compliance
Non-compliance with GDPR in the context of workplace CCTV carries real financial and reputational consequences:
Fines of up to £20 million or 4% of global annual turnover, whichever is higher, for serious violations
ICO enforcement notices
Legal action from employees whose privacy rights have been breached
Compensation claims from individuals affected by unlawful surveillance or inadequate redaction
#Video redaction options for CCTV footage redaction
Not all organisations have a solution in place when they receive their first DSAR.
Given that they have to respond to the request in a timely manner, many go with free or low-cost video editing solutions that aren’t built for compliance-focused video redaction tasks or outsource video redaction to third parties.
Here’s a quick overview of different solutions types available for video anonymisations and their pros and cons.
Keep reading to see how our clients use Identity Cloak for GDPR-compliant processing of DSARs requesting CCTV footage.
| Solution type | Pros | Cons |
|---|---|---|
| Outsourcing | Organisation don't need to research software solutions or train staff to deploy them. | Can become expensive with a higher volume of DSARs, increases the risk of missing the 30-day deadline. |
| Creative video editing solutions | Free or low-cost solutions designed for creative video editing. | Not built for compliant video anonymisation. Users need to manually blur personal data in every frame. |
| Built-in CCTV video redaction tools | Some CCTV VMS tools have built-in, available to use video redaction tools that can be used for simple DSARs. | Most of these tools don't support flexible blur settings or automated tracking, creating additional tasks. |
| Specialised video redaction tools | Software like our product, Identity Cloak, designed to automate video anonymisation process and include all necessary tools, for example, audio redaction or flexible blur. | Depending on the volume of DSARs, some of these solutions may become expensive, especially if their pricing plans are minute-based. Some are cloud-based, making them less appropriate with industries like healthcare or education. |
Read this article for a full breakdown of different video redaction solutions and how to choose the right one for your organisation.
#GDPR-compliant CCTV redaction with Identity Cloak
Identity Cloak is Facit's AI-powered video redaction software, used to anonymise CCTV, bodycam, and dashcam footage in a compliant manner.
What Identity Cloak does in practice:
Automatically detects and blurs faces, licence plates, and objects across entire video files — no frame-by-frame editing required
Tracks individuals through crowded scenes, even for low-quality footage, using AI-powered -tracking
Processes footage entirely on-premise, so videos never leave your secure environment
Handles any file format, including legacy footage
Allows audio redaction to protect sensitive spoken information
Lets operators trim footage to release only the relevant section
Before Identity Cloak, redacting videos was a tedious and time-consuming process. It has a simple interface, is incredibly easy to use, is flexible and saves me a significant amount of time.
Read the Chignecto Central Regional Center for Education case study here.
Video redaction process inside Identity Cloak follows these four steps:
Import and trim footage
Run auto-tracking
Adjust and finalise your redaction
Review redacted footage and export
Facit saves us time. A 1-minute video takes 8 minutes to process. That’s start-to-finish – uploading the video, processing and exporting.
Read the Nottingham City Transport case study here.
Identity Cloak pricing is video-based, not minute-based, with no limits on video duration or video file size — from Starter (10 videos per year) through to Enterprise with unlimited videos and a fixed annual cost. A 7-day free trial is available on all plans.
