CCTV redaction works by exporting a copy of the source footage, identifying every person, vehicle or detail that needs to stay private, obscuring those areas frame by frame with tracking software or careful manual editing, then checking the result before handing over a redacted copy while the original recording is kept intact. The whole process is built around one rule: the original footage is never altered, only a new, disclosable copy is created from it.
For a Northern Ireland business handling a Subject Access Request, a police disclosure or an insurer’s request, understanding this process matters because it shapes how long the job realistically takes and what a provider should be doing at each stage. This guide walks through the redaction process from footage collection to secure delivery, compares manual editing against dedicated redaction software, and explains why the chain of custody around the original recording is often the part businesses overlook until it is challenged.
The CCTV Redaction Process, Step by Step
Every genuine redaction job follows broadly the same sequence, whether it is a single five-minute clip or several hours of multi-camera footage.
1. Footage export and chain of custody
The process starts with exporting the relevant footage directly from the recorder or NVR in its original format, not a screen recording or a compressed re-save, because redaction software needs the source quality to track faces and plates accurately. At this point a provider should log when the footage was exported, by whom, and from which system, creating the first entry in the chain of custody. The original export is set aside untouched. Everything from here on happens to a working copy.
2. Reviewing the footage and identifying who needs to be obscured
Before any redaction happens, the footage is reviewed to identify every person, vehicle or other identifiable detail that is not the intended subject of the disclosure. This includes bystanders, staff who happen to walk into frame, number plates on parked or passing vehicles, and anything else that counts as another person’s personal data. For a Subject Access Request, the requester’s own image is not redacted, since the whole point of the disclosure is to show them the footage they appear in, but everyone else in frame usually needs to be obscured.
3. Applying the redaction
This is the technical core of the job. Faces and number plates are marked and then obscured, either by an operator manually placing and adjusting a blur or mask frame by frame, or by redaction software that detects a face or plate once and then tracks it automatically as the person or vehicle moves through the shot. Fast-moving subjects, poor lighting and multiple camera angles covering the same incident all add time here, because tracking has to be checked and corrected wherever the software loses the subject or a manual pass misses a frame.
4. Quality assurance and a second pass
A redaction is only as good as its weakest frame. Before anything is signed off, the redacted footage is reviewed again, ideally by someone other than the person who did the original redaction, watching for any frame where a face or plate briefly reappears as the subject turns, moves out of the mask, or the tracking briefly loses them. This second pass is where most genuine errors get caught, and it is a step that is easy to skip under time pressure, which is exactly why it should not be optional.
5. Secure delivery and documentation
The finished, redacted copy is delivered through a secure method appropriate to who is receiving it, and the job is documented: what was exported, what was redacted, who reviewed it, and when it was handed over. This record is what an organisation can point to later if a requester, the police, an insurer or the ICO ever asks how the disclosure was handled. The original, unredacted footage stays in secure storage throughout, separate from the redacted copy that has gone out.
Manual Redaction vs Dedicated Redaction Software
Both approaches obscure the same details, but they differ in speed, consistency and how well they hold up under scrutiny.
| Manual editing | Dedicated redaction software | |
|---|---|---|
| Best suited to | Very short clips, one or two static subjects | Longer footage, multiple moving subjects, multiple cameras |
| Speed | Slow, scales badly with footage length | Faster once set up, especially on longer footage |
| Consistency | Depends on the operator’s attention on every frame | Tracks automatically, but still needs human checking |
| Common failure point | A missed frame where the subject moves unexpectedly | Software losing tracking in poor light or fast movement |
| Audit trail | Often informal unless deliberately logged | Usually generates a processing log alongside the QA record |
Neither option removes the need for a human quality check. Software speeds up the tracking and masking, but a person still has to confirm the result is clean before it goes out, which is why step 4 above is not optional in either approach.
Professional Insight: Why Chain of Custody Is the Part Most Businesses Overlook
In our field experience, the redaction itself, the blurring of faces and plates, is rarely where things go wrong. The part that catches businesses out is not being able to show what happened to the original footage before and after redaction. If a disclosure is ever challenged, whether by the requester, an insurer, a solicitor or the ICO, the first question is usually not “was the redaction good enough” but “can you show us exactly what was done, by whom, and that the original recording was not altered”. A redaction job with no export log, no record of who reviewed it and no clear separation between the original and the redacted copy is much harder to defend, even if the actual blurring was done well. Treating the paperwork around the job as seriously as the redaction itself is, from a management perspective, the single biggest difference between a defensible process and a risky one.
When CCTV Redaction Needs to Move Fast
Redaction speed is not just a service-quality question, it is sometimes a legal one. Where footage is being disclosed in response to a Subject Access Request, UK GDPR Article 12A requires a response within one calendar month of the relevant time, extendable by a further two months for complex or numerous requests provided the requester is told about the extension within the original month. A multi-camera job with many people to track through several hours of footage is a common reason a request counts as complex, but the clock still needs managing carefully, which is one reason to start the redaction process as soon as a request lands rather than waiting until the deadline is close.
Get CCTV Redaction Done Properly
If you need CCTV footage redacted for a Subject Access Request, a police or insurer disclosure, or any other reason third parties need to be protected before footage is shared, Advanced Overwatch handles the full process, from secure export and chain of custody through to redaction, quality assurance and documented delivery. Based in Coleraine with regional contact numbers across Northern Ireland, our engineers work with businesses across the region on redaction, footage disclosure and the wider CCTV systems behind it.
Call us on 028 7087 8077 or visit advancedoverwatch.com to discuss a redaction request.
SSAIB Certified Company: NIRE127. ISO 9001, 14001, 27001 and 45001 Certified.
Related Questions
Can CCTV redaction be reversed once it is done?
No, a properly redacted copy cannot be reversed to reveal the obscured faces or plates again, and that is the point: the redacted version is a new, separate file created for disclosure, while the original, unredacted recording is kept securely and separately as the source record. Providers should never redact the only copy of the original footage. Advanced Overwatch always works from a copy, keeping the source recording intact and secure in case it is needed again, for example if a court or the ICO asks to see the original.
Who is allowed to carry out CCTV redaction?
There is no licence specific to CCTV redaction itself in the way there is for some other security roles, but the organisation disclosing the footage remains responsible under UK GDPR for how it is handled, so most businesses use a provider that can demonstrate a documented, auditable process rather than relying on an untracked in-house job. Advanced Overwatch is SSAIB certified, registration NIRE127, and treats redaction as part of its wider CCTV and data handling work rather than a standalone unregulated task.
How long does it take to redact an hour of CCTV footage?
There is no fixed rule, because it depends on how many people or vehicles appear and how much they move. A quiet camera with one or two static subjects can be redacted in a fraction of the source footage’s running time, while an hour of busy footage with dozens of moving people can take several times longer than the footage itself to review, track and check. This is why turnaround time is quoted after a provider has actually looked at the footage, not from a generic per-hour rate.
Standards Explained
CCTV redaction is the process of obscuring or blurring identifiable people, vehicles or other personal information in CCTV footage before it is disclosed, so that only the intended subject, or no one if none is required, remains identifiable.
Chain of custody is a documented, unbroken record of who has handled a piece of footage, when, and what was done to it, from the moment it is exported from the recorder to the moment the redacted version is handed over. It matters because it lets an organisation show, if challenged, exactly what happened to the original recording and that it was not altered beyond the redaction itself.
UK GDPR Article 12A is the provision, inserted by the Data (Use and Access) Act 2025, that sets the statutory deadline for responding to a Subject Access Request: one calendar month from the relevant time, being the latest of request receipt, identity verification or fee payment, extendable by a further two months for complex or numerous requests, with a stop-the-clock provision while a request for clarification is outstanding. It replaced the previous Article 12(3) from 5 February 2026.
ICO (Information Commissioner’s Office) is the UK’s independent supervisory authority for data protection. It upholds UK GDPR and the Data Protection Act 2018 across the whole of the UK, including Northern Ireland, and is the body a mishandled request could ultimately be escalated to.
Data Protection Act 2018 is the UK legislation that sits alongside UK GDPR and applies its standards domestically. Together they set the rules for how an organisation must handle and disclose personal data, including CCTV footage that identifies people.
