When Do You Have to Redact Video Footage in the UK?

Most organisations that hold CCTV, dashcam or body-worn footage do not have a clear answer to a simple question: before this footage leaves us, what do we have to redact? The default tends to be either too cautious (redact everything, miss the deadline) or too liberal (release the master, find out what was wrong from a regulator). Both fail.

This guide is a working test for when UK law actually requires redaction, who is on the hook, and the narrow exemptions that look broader than they are. It applies whether you are a police force, a train operator, an insurer, a retailer, an NHS trust, a university or a private landlord — the obligation is the same; only the volume changes.

The Test: When Is Footage "Personal Data"?

Under UK GDPR Article 4 and the Data Protection Act 2018, video is personal data whenever an individual is identifiable from it — alone or in combination with other information. In practice that catches:

• Faces, including in profile, partially obscured, or at distance where features are still distinguishable.
• Vehicle registration plates that link to an identifiable driver or owner.
• Name badges, ID lanyards and uniforms with identifying detail.
• Screens, paperwork and whiteboards visible in shot that show personal data.
• Audio containing names, voices or other identifying speech.
• Context — a person's clothing combined with a known location and time can be re-identifying even when the face is not visible.

If any of those are present and the footage is going to leave your control, the redaction question is live.

The Five Trigger Events

Five disclosure events cover the overwhelming majority of redaction work in UK organisations. Each carries its own deadline and its own redaction profile.

1. Subject Access Requests

Any individual whose data you hold can request it. Footage is included. The deadline is one calendar month from receipt, extendable by two further months for complex requests. The clock includes the time to locate, review and redact. Every other identifiable person in the footage must be redacted before release. The ICO has fined organisations that miss the deadline systematically — Cabinet Office, Department for Education, multiple NHS trusts.

2. Civil Litigation Disclosure

Personal injury claims, employment tribunal proceedings, commercial disputes and family proceedings all generate footage requests under the Civil Procedure Rules. The disclosure has to be usable as evidence but cannot expose third parties whose rights are not being adjudicated. Redaction profiles often differ between the claimant version, the defence version and the court version of the same master clip.

3. Police and Prosecution Handoffs

Disclosures to police investigating an active case are usually exempt under Schedule 2 of the Data Protection Act 2018 where redaction would prejudice the investigation. The exemption is narrow: it applies to the initial police disclosure, not to onward sharing with the Crown Prosecution Service, defence counsel, the court or co-accused parties. Organisations that release un-redacted master files at the first request usually find themselves redacting the same footage three or four times under tighter deadlines later.

4. Insurance and Loss-Adjuster Disclosures

Property, motor and liability claims generate footage requests from insurers, loss adjusters, brokers and opposing solicitors. The law-enforcement exemption does not apply. Redaction is required before each hand-off, including hand-offs between insurers under fraud-investigation protocols.

5. Internal HR and Disciplinary Use

Employee disciplinary proceedings, grievance hearings and internal investigations regularly use CCTV and body-worn footage. Sharing within the organisation can be lawful without redaction in some circumstances, but sharing with a union representative, external HR consultant, occupational health provider or tribunal generally requires redaction of any third parties captured incidentally.

The Narrow Exemptions

Three exemptions get cited often and held more narrowly than people expect.

• Schedule 2, Part 1, paragraph 2 — crime and taxation. Covers disclosure for the prevention or detection of crime where redaction would prejudice the purpose. Applies to the police-facing disclosure, not to downstream re-sharing.
• Schedule 2, Part 1, paragraph 5 — legal proceedings. Covers disclosures necessary for legal proceedings or obtaining legal advice. Frequently cited; less frequently a complete answer. Disclosures still have to be proportionate, and third-party rights still have to be considered.
• Vital interests (Article 6(1)(d) UK GDPR). Covers disclosures necessary to protect someone's life. Genuinely useful in emergency contexts. Almost never the right basis for routine redaction decisions.

If a disclosure does not fit cleanly inside one of these, redaction is the default safe position.

Who Is Responsible?

The data controller — the organisation that decides why the footage is held and how it is used — is legally responsible for the redaction decision. A processor can perform the work, but the controller carries the obligation, the audit trail and the liability. Most enforcement action follows the controller, not the bureau or platform vendor.

What Good Looks Like Operationally

An organisation handling redaction at any scale needs:

• A consistent test applied at every disclosure (the personal-data test above) rather than ad-hoc decisions.
• A platform that pre-detects faces, plates and identifying detail so reviewers confirm masks rather than draw them.
• Audience-specific redaction profiles from a single master, so the same incident clip can produce a SAR version, a defence version and a court version without duplication.
• An audit log recording who redacted what, when and why — defensible to the ICO, a court or a regulator.
• A controlled-access master separate from the redacted derivatives, with retention policies that match the underlying record's status.

Aetopia AI Redact is a digital evidence management platform built around exactly this workflow. It is used by Northumbria Police across more than 850,000 digital assets and is deployed in regulated environments across law enforcement, transport, insurance and retail.

Sector-Specific Guides

• CCTV Redaction for Train Operators — UK rail, BTP handoffs, passenger SARs.
• Video Redaction for UK Insurers — claims footage, dashcam, loss-adjuster body-worn.
• CCTV Redaction for Retail — SARs, loss prevention, HR disciplinaries.
• Redaction Capabilities in DAM — how integrated redaction works inside a digital asset management platform.

Next Step

If your organisation is hitting the redaction deadline more often than it is meeting it, talk to us. We will walk you through the workflow on real footage, in your formats, against your retention rules.