The Retention Window: Rescuing CCTV Evidence Before It Is Overwritten

CCTV is only useful while it still exists. In the aftermath of a break-in, a road collision, a shoplifting incident or an employment dispute, attention tends to focus on reporting and insurance. The recording itself, however, may already be counting down to automatic deletion. As of November 2026, many UK systems continue to operate on short rolling retention schedules, and once a frame is overwritten it is usually beyond recovery.

This guide is for householders, small businesses and operators of public-facing premises. It explains who controls CCTV footage, how to ask for it lawfully and how to reduce the risk of crucial evidence vanishing. It is not legal advice, and urgent cases should be discussed with the police or a solicitor.

Why the clock starts before you do

A CCTV system does not usually keep everything indefinitely. The data controller, meaning the organisation or individual responsible for the system, sets a retention period based on purpose and storage capacity. Common periods in the UK include 14, 28, 30 or 90 days, but the variation is wide. Transport operators, local authorities, retailers and private car parks may all use different schedules. Domestic systems may retain footage for only a few days or weeks.

That means the evidential window can close long before an insurer, employer or police force asks for a copy. Data protection law gives individuals important rights, but it does not turn every camera operator into a permanent archive. The practical lesson is simple: act quickly, put requests in writing, and ask for preservation as well as disclosure.

Identify the controller and the camera

Before making a request, establish who is responsible for the footage. If the camera is your own, you are the controller and should export the relevant clips immediately. If it belongs to a neighbour, landlord, retailer, employer, council, transport body or private security operator, that organisation is likely to be the controller.

Record the camera location, the approximate time window and any distinctive details that will help staff find the correct footage. A request that says only that something happened last week is far less effective than one that identifies a specific entrance, aisle, junction or car park bay between particular times. Keep the name, email address and date of every contact.

Make a subject access request that works

Under the UK GDPR and the Data Protection Act 2018, individuals have a right of access to their personal data. For CCTV, this is usually exercised through a subject access request. The request can be made verbally, but a written request by email creates a clear record.

A useful request should include your name and contact details, the date and time range, the camera or location, a brief description of the incident, and any police, insurer or incident reference. Ask for a copy of the footage in an accessible format and, where available, associated metadata such as timestamps. Say clearly if the matter is urgent and ask the controller to preserve the footage while the request is considered.

Controllers should respond without undue delay and generally within one month. They may extend that period by up to two further months where the request is complex. Requests are usually free, although a reasonable fee may be charged in limited circumstances, such as manifestly unfounded or excessive requests. Footage showing other people may be blurred or withheld, and certain exemptions can apply. A subject access request is a powerful tool, but it is not a general disclosure order and it does not guarantee that every frame will be released.

Ask for preservation, not just disclosure

A subject access request asks for a copy. A preservation request asks the controller to stop the automatic deletion process. The two should be sent together.

In a police matter, obtain the crime or incident number and the officer's contact details. Ask the police to send a preservation request to the relevant controller and confirm that they have done so. For a civil dispute, ask a solicitor to write a preservation letter. In an employment dispute, raise the issue through the grievance procedure and ask for the relevant CCTV to be retained pending resolution.

A controller is not obliged to keep footage forever, but a clear preservation request puts them on notice. It should identify the incident, the relevant time window and the camera, and ask them to suspend overwriting, export a copy and record who has handled it.

A practical checklist for homes and small businesses

• Export the relevant footage as soon as possible, before any automatic overwrite.
• Keep an untouched master copy and use a separate working copy for viewing or sharing.
• Do not trim, enhance or edit the original file. If enhancement is needed, preserve the original and document what was changed.
• Record the date, time and method of export, and keep a simple chain-of-custody log.
• Check network video recorders, cloud backups, doorbell cameras, dashcams and any secondary cameras that may have captured the incident.
• Ask neighbours or nearby businesses whether their systems cover the same area.
• Provide copies to the police or insurer through an agreed method and keep confirmation of delivery.

Public-facing and commercial premises

Retailers, licensed premises, car park operators and transport bodies often have formal CCTV procedures. Ask for the duty manager or the organisation's data protection contact, and put the request in writing even if you have already spoken to staff. For a collision, consider the local authority, bus operator, highway authority and any private car park operator. For a workplace incident, the employer is likely to be the controller.

If a request is ignored or refused, a complaint can be made to the Information Commissioner's Office. The regulator can examine compliance with data protection law, but it will not preserve footage. Where evidence is critical and a controller will not cooperate, urgent legal advice should be sought about court orders or other compulsory processes.

The limits and the common mistakes

Data protection law does not create a universal right to CCTV evidence. Controllers may withhold third-party data, apply exemptions, or refuse manifestly unfounded or excessive requests. Police access is governed by separate legal powers, and a preservation request is not the same as a warrant or production order.

The most common mistakes are delay, vague requests, verbal-only contact and a failure to follow up. Others include assuming the police have automatically secured the footage, failing to preserve metadata, editing the only copy, and overlooking secondary cameras. Do not attempt to obtain footage by deception or by bypassing access controls. A lawful, documented request is more likely to succeed and will be far more useful if the matter later reaches court, an insurer or a tribunal.

The retention window is not a warning that can be ignored. It is a deadline. Treat the first 24 hours after an incident as the period in which to identify the controller, send a written request and secure any footage that remains.