CCTV Video Redaction

CCTV redaction works by exporting a copy of the source footage, identifying every person, vehicle or detail that needs to stay private, obscuring those areas frame by frame with tracking software or careful manual editing, then checking the result before handing over a redacted copy while the original recording is kept intact. The whole process is built around one rule: the original footage is never altered, only a new, disclosable copy is created from it.

For a Northern Ireland business handling a Subject Access Request, a police disclosure or an insurer’s request, understanding this process matters because it shapes how long the job realistically takes and what a provider should be doing at each stage. This guide walks through the redaction process from footage collection to secure delivery, compares manual editing against dedicated redaction software, and explains why the chain of custody around the original recording is often the part businesses overlook until it is challenged.

The CCTV Redaction Process, Step by Step

Every genuine redaction job follows broadly the same sequence, whether it is a single five-minute clip or several hours of multi-camera footage.

1. Footage export and chain of custody

The process starts with exporting the relevant footage directly from the recorder or NVR in its original format, not a screen recording or a compressed re-save, because redaction software needs the source quality to track faces and plates accurately. At this point a provider should log when the footage was exported, by whom, and from which system, creating the first entry in the chain of custody. The original export is set aside untouched. Everything from here on happens to a working copy.

2. Reviewing the footage and identifying who needs to be obscured

Before any redaction happens, the footage is reviewed to identify every person, vehicle or other identifiable detail that is not the intended subject of the disclosure. This includes bystanders, staff who happen to walk into frame, number plates on parked or passing vehicles, and anything else that counts as another person’s personal data. For a Subject Access Request, the requester’s own image is not redacted, since the whole point of the disclosure is to show them the footage they appear in, but everyone else in frame usually needs to be obscured.

3. Applying the redaction

This is the technical core of the job. Faces and number plates are marked and then obscured, either by an operator manually placing and adjusting a blur or mask frame by frame, or by redaction software that detects a face or plate once and then tracks it automatically as the person or vehicle moves through the shot. Fast-moving subjects, poor lighting and multiple camera angles covering the same incident all add time here, because tracking has to be checked and corrected wherever the software loses the subject or a manual pass misses a frame.

4. Quality assurance and a second pass

A redaction is only as good as its weakest frame. Before anything is signed off, the redacted footage is reviewed again, ideally by someone other than the person who did the original redaction, watching for any frame where a face or plate briefly reappears as the subject turns, moves out of the mask, or the tracking briefly loses them. This second pass is where most genuine errors get caught, and it is a step that is easy to skip under time pressure, which is exactly why it should not be optional.

5. Secure delivery and documentation

The finished, redacted copy is delivered through a secure method appropriate to who is receiving it, and the job is documented: what was exported, what was redacted, who reviewed it, and when it was handed over. This record is what an organisation can point to later if a requester, the police, an insurer or the ICO ever asks how the disclosure was handled. The original, unredacted footage stays in secure storage throughout, separate from the redacted copy that has gone out.

Manual Redaction vs Dedicated Redaction Software

Both approaches obscure the same details, but they differ in speed, consistency and how well they hold up under scrutiny.

Neither option removes the need for a human quality check. Software speeds up the tracking and masking, but a person still has to confirm the result is clean before it goes out, which is why step 4 above is not optional in either approach.

Professional Insight: Why Chain of Custody Is the Part Most Businesses Overlook

In our field experience, the redaction itself, the blurring of faces and plates, is rarely where things go wrong. The part that catches businesses out is not being able to show what happened to the original footage before and after redaction. If a disclosure is ever challenged, whether by the requester, an insurer, a solicitor or the ICO, the first question is usually not “was the redaction good enough” but “can you show us exactly what was done, by whom, and that the original recording was not altered”. A redaction job with no export log, no record of who reviewed it and no clear separation between the original and the redacted copy is much harder to defend, even if the actual blurring was done well. Treating the paperwork around the job as seriously as the redaction itself is, from a management perspective, the single biggest difference between a defensible process and a risky one.

When CCTV Redaction Needs to Move Fast

Redaction speed is not just a service-quality question, it is sometimes a legal one. Where footage is being disclosed in response to a Subject Access Request, UK GDPR Article 12A requires a response within one calendar month of the relevant time, extendable by a further two months for complex or numerous requests provided the requester is told about the extension within the original month. A multi-camera job with many people to track through several hours of footage is a common reason a request counts as complex, but the clock still needs managing carefully, which is one reason to start the redaction process as soon as a request lands rather than waiting until the deadline is close.

Get CCTV Redaction Done Properly

If you need CCTV footage redacted for a Subject Access Request, a police or insurer disclosure, or any other reason third parties need to be protected before footage is shared, Advanced Overwatch handles the full process, from secure export and chain of custody through to redaction, quality assurance and documented delivery. Based in Coleraine with regional contact numbers across Northern Ireland, our engineers work with businesses across the region on redaction, footage disclosure and the wider CCTV systems behind it.

Call us on 028 7087 8077 or visit advancedoverwatch.com to discuss a redaction request.

SSAIB Certified Company: NIRE127. ISO 9001, 14001, 27001 and 45001 Certified.

Related Questions

Can CCTV redaction be reversed once it is done?

No, a properly redacted copy cannot be reversed to reveal the obscured faces or plates again, and that is the point: the redacted version is a new, separate file created for disclosure, while the original, unredacted recording is kept securely and separately as the source record. Providers should never redact the only copy of the original footage. Advanced Overwatch always works from a copy, keeping the source recording intact and secure in case it is needed again, for example if a court or the ICO asks to see the original.

Who is allowed to carry out CCTV redaction?

There is no licence specific to CCTV redaction itself in the way there is for some other security roles, but the organisation disclosing the footage remains responsible under UK GDPR for how it is handled, so most businesses use a provider that can demonstrate a documented, auditable process rather than relying on an untracked in-house job. Advanced Overwatch is SSAIB certified, registration NIRE127, and treats redaction as part of its wider CCTV and data handling work rather than a standalone unregulated task.

How long does it take to redact an hour of CCTV footage?

There is no fixed rule, because it depends on how many people or vehicles appear and how much they move. A quiet camera with one or two static subjects can be redacted in a fraction of the source footage’s running time, while an hour of busy footage with dozens of moving people can take several times longer than the footage itself to review, track and check. This is why turnaround time is quoted after a provider has actually looked at the footage, not from a generic per-hour rate.

Standards Explained

CCTV redaction is the process of obscuring or blurring identifiable people, vehicles or other personal information in CCTV footage before it is disclosed, so that only the intended subject, or no one if none is required, remains identifiable.

Chain of custody is a documented, unbroken record of who has handled a piece of footage, when, and what was done to it, from the moment it is exported from the recorder to the moment the redacted version is handed over. It matters because it lets an organisation show, if challenged, exactly what happened to the original recording and that it was not altered beyond the redaction itself.

UK GDPR Article 12A is the provision, inserted by the Data (Use and Access) Act 2025, that sets the statutory deadline for responding to a Subject Access Request: one calendar month from the relevant time, being the latest of request receipt, identity verification or fee payment, extendable by a further two months for complex or numerous requests, with a stop-the-clock provision while a request for clarification is outstanding. It replaced the previous Article 12(3) from 5 February 2026.

ICO (Information Commissioner’s Office) is the UK’s independent supervisory authority for data protection. It upholds UK GDPR and the Data Protection Act 2018 across the whole of the UK, including Northern Ireland, and is the body a mishandled request could ultimately be escalated to.

Data Protection Act 2018 is the UK legislation that sits alongside UK GDPR and applies its standards domestically. Together they set the rules for how an organisation must handle and disclose personal data, including CCTV footage that identifies people.

A CCTV redaction service removes or obscures the faces, licence plates, and other identifying details of third-party individuals from video footage before that footage is shared with a requester. In most cases this is legally required when responding to a subject access request (SAR) under UK GDPR. Businesses that skip redaction risk ICO complaints and data breach liability.

When Does a Business Need CCTV Footage Redacted?

There are four situations where businesses in Northern Ireland regularly need CCTV footage redacted before it leaves their control.

Subject Access Requests (SARs). Under UK GDPR Article 15, any individual has the right to request a copy of personal data an organisation holds about them, including CCTV footage in which they appear. You can provide footage showing the requester, but you are legally required to blur or mask any other identifiable individuals in the same clip. If a member of the public or an employee was involved in an incident captured on your cameras and makes a formal SAR, you need to act within one calendar month (UK GDPR Article 12(3)).

Police and criminal investigations. When police request footage as part of a criminal investigation, they typically view it under their own legal gateway and redaction may not be required for the submission itself. However, if the same footage is later used in court proceedings or disclosed to a defendant, redaction requirements apply. Legal advice specific to your situation should be sought here.

Insurance claims. Many insurers require CCTV footage when processing liability or property claims. If the footage contains identifiable third parties who are not party to the claim, those individuals’ data must be protected before submission to the insurer.

Employment disputes. If CCTV footage is used in a disciplinary or grievance process and the employee requests a copy, the footage must be redacted to remove colleagues or members of the public before it is handed over.

What CCTV Redaction Actually Involves

Redaction is not a single click on a video file. Done correctly, it is a systematic, frame-by-frame process.

Step 1: Request received and scoped. The specific time window, camera, and the identity of the data subject requesting footage are confirmed in writing. This creates the audit trail.

Step 2: Footage located and secured. The relevant recording is copied and the original preserved in its unaltered state. Chain of custody is documented from this point.

Step 3: Third-party identification. A trained operator reviews the footage to identify every frame containing an individual who is not the requesting data subject. This includes partial views, reflections in windows or mirrors, and incidental appearances at the edge of frame.

Step 4: Redaction applied. Professional redaction software applies blurring, pixelation, or masking to each identified individual in every affected frame. The process is applied consistently throughout the clip, not just to obvious moments.

Step 5: Quality review. A second review confirms no unredacted identifiers remain. Licence plates, signage containing personal information, and other incidental data are also checked.

Step 6: Delivery and documentation. The redacted file is delivered to the requester in the agreed format. A record of the request, the footage provided, the redaction undertaken, and the date of delivery is retained for compliance purposes.

This process takes significantly longer than most businesses expect, particularly for footage spanning several hours, multiple camera angles, or busy public-facing locations. The ICO does not accept “we ran out of time” as a reason for missing the one-month SAR deadline.

Your Legal Obligations Under UK GDPR

CCTV footage is personal data. When you operate a CCTV system, you are a data controller. That status carries obligations.

Lawful basis. You need a lawful basis to process CCTV footage. For most businesses this is legitimate interests (UK GDPR Article 6(1)(f)), documented in a legitimate interests assessment and referenced in your privacy notice. This should already be in place if your CCTV system is properly compliant.

Responding to SARs. When you receive a SAR relating to CCTV footage, you have one calendar month to respond. You must either provide the requested footage (redacted) or explain in writing why you cannot (for example, if the footage no longer exists or the request is manifestly unfounded). You cannot charge a fee for a standard SAR.

Third-party data protection. UK GDPR Article 5(1)(f) requires that personal data be processed with appropriate security, including protection against unauthorised disclosure. Providing unredacted footage that reveals identifiable third parties to the requester is a disclosure of those third parties’ personal data without a lawful basis. That is a data breach and must be reported to the ICO within 72 hours if it is likely to result in a risk to individuals’ rights and freedoms.

Data processor agreements. If you engage an external CCTV redaction service, they are a data processor handling personal data on your behalf. Under UK GDPR Article 28, you must have a written data processing agreement (DPA) with them before they handle the footage. Any reputable professional redaction service will have a standard DPA ready to execute.

What to Look for in a CCTV Redaction Service Provider

Not every company offering video editing or post-production services has the data protection competence to handle SAR-related footage correctly. When selecting a provider, verify the following.

Data processing agreement. If a provider cannot produce a UK GDPR-compliant DPA within minutes of being asked, walk away. This is a basic requirement, not an optional extra.

Documented chain of custody. You need evidence of what footage was received, when, by whom, and what was done with it. This protects you if the SAR or any related legal matter is later disputed.

Secure data transfer. Footage should be transferred over an encrypted connection, not emailed as a plain attachment or posted on an unprotected file-sharing link.

Audit trail and record of redaction. The provider should supply you with a record of what was redacted and why, alongside the redacted output. This is your evidence that you fulfilled the SAR correctly.

Turnaround time. With a one-month SAR deadline, you typically need a 5-to-10-business-day turnaround for standard requests. Confirm this before the deadline clock is already running.

Professional indemnity insurance. If a mistake is made and an unredacted frame is delivered, professional indemnity insurance provides a financial backstop. Confirm the provider carries it.

Professional Insight: What We See in the Field

The most common mistake we encounter when businesses come to us after a SAR has gone wrong is a belief that basic blurring applied to a highlight clip is sufficient. In most incidents captured on CCTV, the footage that matters spans several minutes of context either side of the key moment. A data subject making a SAR is entitled to all footage in which they appear, not just the ten seconds their solicitor is focused on.

Businesses also underestimate the data volume involved. A single camera recording at 15 frames per second over four hours generates over 200,000 frames. Reviewing that manually without systematic software support is not realistic. Missed frames are not acceptable to the ICO. Professional redaction software processes footage systematically and flags frames requiring human review, rather than relying on an operator to spot every occurrence manually.

The second area where businesses get caught out is the audit trail. When a data subject or their solicitor challenges the completeness of a SAR response, you need to be able to demonstrate exactly what footage existed, what was redacted, and what was provided. Without a documented process, that defence is very difficult to mount.

Advanced Overwatch provides CCTV redaction as part of its broader security management offering for businesses across Northern Ireland. Our team works under a formal data processing agreement, documents every step of the chain of custody, and delivers redacted footage with a full written record of the process. SSAIB certified (NIRE127) and ISO 27001 accredited, we handle footage under the same information security standards we apply to all client data.

Related Questions

Is CCTV footage classed as personal data under UK GDPR?

Yes. CCTV footage that captures identifiable individuals is personal data under UK GDPR. The fact that a person can be identified from the footage, whether by their face, gait, clothing, or vehicle, is sufficient. This means any organisation that operates a CCTV system is a data controller under UK GDPR and must comply with all associated obligations, including responding to subject access requests and protecting the data against unauthorised disclosure. The Information Commissioner’s Office has issued detailed guidance on CCTV and UK GDPR, which is publicly available on the ICO website.

What happens if I miss the one-month deadline for a CCTV subject access request?

If you fail to respond to a SAR within one calendar month without a valid reason, the requester can complain to the ICO. The ICO can investigate, issue a reprimand, or in more serious cases, issue an enforcement notice requiring you to comply. Persistent or deliberate failures can result in financial penalties. In practice, the ICO is more likely to pursue enforcement where an organisation failed to respond at all or where there is evidence of deliberate delay. If you are struggling with a complex request, you can invoke the two-month extension by notifying the requester within the first month, before the deadline passes.

Does a police evidence disclosure request require the same redaction as a SAR?

Not necessarily. When police request footage under their own legal powers (such as a production order or a Data Protection Act 2018 Schedule 2 paragraph 2 exemption), the normal SAR process does not apply and you are generally required to provide what is requested without redaction. However, if that footage is subsequently used in legal proceedings and a copy is provided to a defendant or their legal team, the data protection obligations on the recipient apply, and redaction may be required at that stage. This is a complex area and legal advice appropriate to your specific circumstances is recommended before disclosing footage in a criminal or civil matter.

Standards Explained

UK GDPR (United Kingdom General Data Protection Regulation)
The retained version of EU Regulation 2016/679, applicable in UK law since 1 January 2021. UK GDPR sets out the principles for processing personal data (Article 5), lawful bases for processing (Article 6), individual rights including the right of access (Article 15), and obligations on data controllers to protect third-party data (Article 5(1)(f)). CCTV footage is personal data within the scope of UK GDPR. The one-month SAR response deadline is set in Article 12(3).

Data Protection Act 2018
UK primary legislation that works alongside UK GDPR to form the complete data protection framework. The DPA 2018 provides specific exemptions relevant to CCTV, including the law enforcement processing provisions (Part 3) and the intelligence services processing provisions (Part 4). For most businesses, the relevant parts are the main UK GDPR regime supplemented by DPA 2018 Schedule 2, which includes exemptions for national security, crime prevention, and certain professional legal obligations. Organisations unsure whether an exemption applies to a specific SAR should seek ICO guidance or legal advice before relying on it.

ICO CCTV Guidance
The Information Commissioner’s Office publishes detailed guidance on CCTV, surveillance cameras, and related data protection obligations. This includes guidance on when to respond to SARs for CCTV footage, how to handle redaction, and what constitutes a lawful basis for surveillance camera operation. While ICO guidance is not legally binding in the same way as legislation, the ICO uses its own guidance as the benchmark when investigating complaints and enforcement cases. Following ICO guidance therefore provides the strongest available defence in any regulatory investigation.

Advanced Overwatch provides professional CCTV installation, maintenance, and data compliance services for businesses and homes across Northern Ireland. SSAIB certified (NIRE127). ISO 9001, 14001, 27001, and 45001 accredited. Call 028 7087 8077 or visit advancedoverwatch.com for a free consultation.

1st Floor, Beresford House, 2 Beresford Road, Coleraine, BT52 1GE