Facit’s Legal Compliance Guide for Video Footage

#Legal obligations every organisation that handles video footage needs to understand

Organisations capture millions of hours of video footage every day. CCTV in hospital corridors, body-worn cameras on police officers, surveillance systems in schools and transport hubs—all of it is subject to legal obligations that are more complex, and more consequential, than most organisations realise.

The challenge for every organisation is to comply with the sheer number of overlapping laws. Data protection legislation, surveillance codes, court admissibility rules, and sector-specific regulations all interact.

You will find that the precise combination that applies to your organisation depends on:

• Who you are

• What you record

• What you do with the footage afterwards

• Where you are located.

#The UK legal framework for video footage

In the UK, video footage compliance isn’t governed by a single piece of legislation. It spans four overlapping laws:

• Data Protection Act 2018

• Regulation of Investigatory Powers Act 2000

• Surveillance Camera Code of Practice (Protection of Freedoms Act 2012)

• Freedom of Information Act 2000.

Understanding how they interact is the starting point for achieving compliance.

#Data Protection Act 2018

The Data Protection Act (DPA) 2018 is the UK’s legal framework for implementing UK GDPR following Brexit. It governs the systematic recording and processing of all video footage. Under the DPA 2018, organisations have specific duties, including:

• Holding footage securely

• Retaining footage only for as long as necessary

• Responding to Subject Access Requests within one calendar month.

The Act also governs what happens when footage is shared with courts, insurers, or law enforcement. Any disclosure that reveals identifiable individuals who are not the subject of the request must be redacted.

For a full treatment of UK GDPR obligations, see our GDPR Compliance Guide.

#Regulation of Investigatory Powers Act (RIPA) 2000 and 2016

RIPA governs covert surveillance carried out by public authorities. The Act distinguishes between two types of surveillance:

• Directed surveillance: Covert, targeted monitoring that takes place in a public area

• Intrusive surveillance: Surveillance that takes place within private premises or vehicles, which demands a stricter level of authorisation.

Public authorities must obtain the appropriate authorisation before covert recording begins. The Investigatory Powers Commissioner provides oversight and investigates complaints about unlawful surveillance. Organisations that commission covert monitoring without the correct authorisation risk both criminal liability and having evidence that is inadmissible in court.

#Surveillance Camera Code of Practice

Issued under the Protection of Freedoms Act 2012 and updated in 2013, the Surveillance Camera Code sets out 12 guiding principles for using camera systems.

1. Legitimate Aim: there must be a legitimate aim and an identified pressing need

2. Proportionality: the impact on individuals and their privacy must not be excessive

3. Transparency: signage and a contact must be clear

4. Accountability: there must be clear responsibility for all surveillance activities, including data handling

5. Policies and Procedures: clear rules must be in place and communicated

6. Data Minimisation: no more data should be stored than necessary. It should be deleted when no longer required

7. Standards: operators should be trained and work to approved standards of competency

8. Security: appropriate measures must be taken to secure images, video and related information

9. Evidence: the system must be used effectively to support public safety and law enforcement

10. Accuracy: information used for matching, such as ANPR, must be accurate and up to date

11. Accountability: regular review and audit mechanisms must be in place

12. Reporting: regular reports should be published.

The act applies to what is termed “relevant authorities”, including police forces, local authorities, and specified public bodies. The Surveillance Camera Commissioner monitors compliance.

Although the Code applies directly to specific kinds of authorities, it is also widely used as general best-practice guidance. If your organisation operates CCTV and is not a “relevant authority”, following the Code is still the clearest demonstration of a proportionate approach to the ICO.

Read more about surveillance law and CCTV obligations.

#Freedom of Information Act 2000/Environmental Information Regulations 2004

The Freedom of Information Act 2000 establishes the public’s right to access information held by public authorities. It applies to all recorded information (including video footage) held by government departments, local authorities, NHS bodies, police forces, schools, and other public sector organisations. 

Where footage contains personal data relating to a third party—which CCTV footage almost always does—the footage cannot simply be handed over. It must first be assessed under data protection law, and any individuals other than the requester must be redacted before the footage can be released. It is a complex requirement that calls for the right redaction software.

It’s worth noting that an FOI request and a Subject Access Request (see below) are distinct legal processes—but both can relate to the same piece of footage, and both carry redaction obligations.

Devolved public bodies in Scotland should note that they operate under the Freedom of Information (Scotland) Act 2002 (FOISA).

#Key compliance obligations

Subhead alternatives:

1. Your core legal obligations for video footage

2. What the law requires: SARs, court evidence, and retention

3. The obligations that apply across all sectors

Whatever your sector, these four obligations apply to most organisations that capture and hold video footage. Each one has practical implications for how it is stored, handled, and redacted.

#Subject Access Requests (SARs)

Under UK GDPR Art. 15 and DPA 2018, individuals have the right to access video footage in which they appear. If your organisation receives a SAR, it has one calendar month to respond. What’s more, the critical obligation is not simply to provide the footage, but to ensure that all other identifiable individuals in the frame have been redacted before the footage is disclosed to the requester.

This is where many organisations run into difficulty. Manual redaction—blurring faces frame by frame—is time-consuming and prone to error. A single missed face in a disclosed video can lead directly to ICO enforcement action.

Find out more about responding to Subject Access Requests for CCTV footage with our Guide to Data Subject Access Requests.

Subhead (h3):

#Court evidence and chain of custody

When footage is used as evidence in criminal or civil cases, the question is not just whether it shows what happened. It is also whether the court can be satisfied that the footage is authentic and unaltered. In this context, courts apply the concept of “admissibility”, which means footage that cannot demonstrate a clean chain of custody may simply be excluded from proceedings, regardless of what it shows.

Under the Criminal Procedure and Investigations Act 1996 (CPIA), disclosure obligations extend to unused footage as well as footage being relied upon. In practice, this means retaining all relevant recordings—not just the clip in question—and being able to account for who handled them, when, and what was done to them. A redaction log is not just good practice, it is increasingly expected by courts to confirm that the original file remains intact and that only the disclosed copy was modified.

Read more about court evidence and chain of custody requirements.

#Data retention

There is no single legally mandated retention period for CCTV footage in the UK. The ICO advises retaining footage only for the shortest time necessary to achieve its original purpose—typically 30 days for general security, though this can vary by sector. For example, police forces follow the College of Policing retention schedules, NHS organisations work to the NHS records management codes, while local authority policies differ widely.

The risks run in both directions, though. Retaining footage longer than necessary creates legal exposure under the DPA 2018, as people can request to see it if it still exists. But deleting footage prematurely, before a legal hold is triggered by an incident, complaint, or court order, can destroy evidence and expose you to a different kind of liability. For most organisations, clear written retention policies, reviewed regularly and properly implemented, are the practical solution.

#Data minimisation

The DPA 2018 requires organisations to limit the collection of personal data to what is necessary. For video surveillance, this principle shapes everything from camera placement to recording schedules. Cameras should cover only the areas they are intended to monitor, and continuous recording should be avoided where periodic monitoring would serve the same purpose. Masking permanently private areas—changing rooms or private offices that fall incidentally within a camera’s field of view—is part of a proportionate approach that regulators expect to see

#US and international legal frameworks

Subhead alternatives:

1. US privacy laws for video footage

2. HIPAA, FERPA, and CCPA: US compliance requirements at a glance

3. Video footage compliance in the US: what organisations need to know

Organisations operating in the US—or handling footage that includes US residents—face their own set of privacy and compliance requirements. Unlike the UK, the US has no single federal privacy law governing video footage. Compliance is built from a combination of federal statutes and state-level laws, and the combination that applies depends on your sector and location.

#HIPAA

Healthcare providers, health plans, and healthcare clearinghouses (known as covered entities), as well as vendors and contractors who process information on their behalf (known as business associates), are subject to the Health Insurance Portability and Accountability Act (HIPAA). Under HIPAA, video footage that captures patients in clinical settings may constitute protected health information (PHI) if it links an identifiable person to their health status. The threshold is not high: a face visible in a hospital corridor is often sufficient. And when disclosing footage that contains PHI, only the information needed for the specific purpose of the disclosure should be made available. 

Any vendor that processes the footage is required to sign a Business Associate Agreement (BAA), under which they accept defined data protection responsibilities. The HIPAA Security Rule additionally mandates specific access controls for stored footage. 

#FERPA

Video footage of students is governed by the Family Educational Rights and Privacy Act (FERPA). Under the act, footage of students qualifies as an education record only if it directly relates to a student and is maintained by the educational institution. If an education institution receives a parental access request, it must respond within 45 days. However, before sharing footage, all identifiable students in the frame must be redacted—often a complex task in crowded hallways or classrooms.  

FERPA is a federal law that applies across all states. However, some states have enacted additional student privacy laws that impose stricter requirements. Schools operating CCTV should therefore check both federal and state obligations.

Read more about video redaction for FERPA compliance.

#CCPA, CPRA and state-level laws

Two California laws are particularly significant for organisations that process video footage. The California Consumer Privacy Act (CCPA) came into effect in January 2020, giving California residents the right to know what personal data is collected about them, to request deletion, and to opt out of the sale of their personal data. 

The California Privacy Rights Act (CPRA) took effect in January 2023 and expanded those rights by introducing a new category of “sensitive personal information,” which includes biometric data, such as facial geometry derived from video. Violations of the CPRA carry civil penalties of up to $7,500 per intentional breach.

While these laws apply to California, the CCPA is increasingly treated as a de facto national baseline for US privacy compliance across many jurisdictions

#State-level surveillance and wiretapping laws

Since the US has no single federal law governing video surveillance, you will find that state-level surveillance and wiretapping laws vary significantly and can catch you off guard. For example, in connection with recordings:

• All-party consent states—including California, Illinois, and Florida—require every party to a conversation to consent to audio recording

• One-party consent states require only one participant’s agreement.

Similarly, body-worn camera legislation also varies by state, frequently imposing mandatory disclosure and footage retention requirements.

#Other international frameworks

Organisations operating across borders may also need to consider other laws, such as the EU GDPR (which has diverged from the UK GDPR since Brexit and continues to evolve), the Australian Privacy Act 1988, the Canadian PIPEDA, and Singapore’s Personal Data Protection Act 2012 (PDPA). The compliance requirements for video footage vary in each jurisdiction and are subject to ongoing legislative change. Organisations with cross-border operations should seek specialist legal advice tailored to their specific footprint.

#What compliance looks like in your sector

The core data protection and surveillance law (DPA 2018) applies across all sectors in the UK. In turn, sector-specific regulations add requirements to it, not instead of it. The key questions for any organisation are: which sector-specific rules apply to us, and how do they interact with the core framework?

#Sector obligations in the UK

In the UK, five sectors face particularly significant additional requirements.

#Sector obligations in the US

In the US, sector-specific obligations layer on top of the federal and state privacy laws covered above. Healthcare providers are subject to HIPAA, and educational institutions to FERPA. Law enforcement agencies face state-specific body-worn camera laws as well as federal civil rights obligations around footage disclosure.

#The consequences of non-compliance

#In the UK

The Information Commissioner’s Office can issue warnings, enforcement notices, and fines of up to £17.5 million or 4% of global annual turnover—whichever is higher. For law enforcement bodies operating under the Part 3 regime, the cap is £8.7 million or 2% of global turnover, whichever is higher. The ICO’s tiered approach weighs the nature of the breach, the harm caused to individuals, and the steps taken to address it. Organisations that self-report quickly and demonstrate a genuine compliance programme are treated more favourably than those that do not.

ICO fines are not the only consequence. Non-compliance with video footage laws can pose additional risks.

• Inadmissible evidence. Footage that cannot demonstrate a clean chain of custody may be excluded from proceedings entirely. A criminal prosecution can collapse, or a civil claim can be struck out, because of how the footage was handled after it was captured.

• Failed SARs and FOI responses. Delays past the statutory deadline, failure to provide footage or releasing footage that contains unredacted third-party data can all result in prosecution. The ICO frequently investigates SAR handling. 

• Civil litigation. Individuals can bring compensation claims under DPA 2018 s.169 without needing to prove financial loss. Distress arising from a data breach or unlawful disclosure is sufficient to found a claim.

• Reputational damage. A single redaction failure can simultaneously trigger an ICO investigation, a court challenge to related evidence, and press coverage. The reputational damage frequently outlasts the regulatory consequences.

For more detail on ICO enforcement action and the wider operational consequences, see The Legal and Operational Consequences of Redaction Failure.

#In the US

US penalties vary by regulation and, in many cases, by state. Under HIPAA, the HHS Office for Civil Rights can impose fines ranging from $100 to $50,000 per violation, with an annual cap of $1.9 million per violation category. Wilful neglect that remains uncorrected can attract the maximum fine for each separate violation, making the aggregate exposure significant for organisations facing multiple incidents.

Under FERPA, the primary sanction is the loss of federal funding—a serious consequence for schools and universities that depend on federal grants and student aid. Under the CCPA and CPRA, the California Attorney General may seek civil penalties of $2,500 per unintentional violation and $7,500 per intentional violation, and affected individuals have a private right of action for certain data breaches. Several other states are introducing similar enforcement mechanisms.

The consequences of non-compliance with state wiretapping and surveillance laws are potentially more severe: in all-party consent states, recording a conversation without all parties’ consent can result in criminal charges, not just civil penalties.

#Meeting your legal obligations using automated redaction software

Subhead alternatives:

1. How video redaction software addresses your obligations

2. How Identity Cloak supports legal compliance

Manually blurring footage frame by frame is time-consuming, error-prone, and increasingly impractical, as footage volumes and disclosure requests grow. Automated video redaction software makes it operationally possible to meet these obligations consistently and at scale.

Here is how the core capabilities of Identity Cloak map to specific legal requirements.

#Go deeper: legal compliance by topic

Each topic below goes deeper into a specific area of the legal landscape, covering the obligations, practical guidance, and redaction requirements that apply.