An attorney sent a letter asking for CCTV footage: what do I do first?

When a solicitor’s or attorney’s letter asks for CCTV footage, the first priority is to stop the relevant recording being routinely deleted while you work out what the request means. That does not mean sending the footage straight back, preserving every camera feed indefinitely, or forwarding a raw clip around the building.

Start by recording the request, identifying the specific incident and footage, and checking who has authority to decide what happens next. Then preserve only the relevant segment, restrict access, and follow internal policy. If the request is unclear, the footage includes other people, or litigation is threatened, ask your organisation’s privacy lead or solicitor for advice before disclosure.

First: log the letter and check the deadline

Save the letter in the approved records system and note when and how it arrived. Record who received it, who it is addressed to, the incident it refers to, any response deadline, and what action you take. Do not rely on an email inbox as the only record of the request.

Read the request carefully. A letter might seek footage for a personal injury claim, an alleged assault, a vehicle collision, a dispute about access, or another legal matter. It might ask for a copy, ask you to preserve evidence, or simply ask whether footage exists. Those are different requests and should not be treated as interchangeable.

Capture the written request details

Before searching or exporting, make a short checklist of the written request details:

The claimant or person represented, and the solicitor’s or attorney’s contact details.
The date, approximate time, location and nature of the incident.
The cameras or areas likely to have captured it, if identified.
Whether the letter asks for preservation, inspection, a copy, or confirmation that footage exists.
Any stated legal basis, authority to act, case reference or deadline.
Whether the request covers a specific clip or appears to seek a wider period or multiple locations.

If key information is missing, ask for clarification promptly. For example, “the incident on Tuesday” may not be precise enough if the building has several entrances and cameras. A focused request makes it easier to locate the right material and avoid unnecessary access to unrelated footage.

Preserve the relevant segment, not every camera recording

Many CCTV systems automatically overwrite recordings after a set retention period. If the requested footage may be relevant, act promptly so the particular recording is not lost while the request is being assessed. Use the system’s approved export or evidence-preservation process, and document what you do.

The practical goal is to preserve the relevant segment in a controlled way—not to put the entire site’s footage on hold “just in case”. Identify the likely camera, date and time window. Allow for clock differences between the CCTV system and real time, and include a reasonable buffer on-premise video redaction around the event so the lead-up and aftermath are not accidentally cut off.

If you are unsure which camera captured the incident, ask the onsite team to help identify the location and camera coverage. Search only what is reasonably needed to locate the relevant material. If the incident may involve several viewpoints, record why each one is included.

Action Good practice Avoid Preservation Secure a specific, relevant time window and record the reason. Putting all cameras or all recordings on indefinite hold. Access Limit viewing to named, authorised people with a work-related need. Watching footage out of curiosity or showing it to residents or staff informally. Export Use the approved system and keep an access and handling log. Emailing raw clips or copying them to an unapproved shared folder. Deletion Set a review date and delete the preserved copy when no longer needed. Keeping a clip with no owner, purpose or deletion date.

Check who owns the decision

In a mixed-use building, responsibility for CCTV may be split between a management company, an owners’ association or HOA, a landlord, a facilities contractor and a security provider. The organisation that determines why and how the system is used will generally have the key governance responsibilities. A contractor operating the cameras may be acting on that organisation’s instructions, but should not make a disclosure decision independently unless its role and authority allow it.

Do not assume that the person who can log into the CCTV system is authorised to release footage. Check your written policy, contracts and escalation route. The decision may need input from the building manager, privacy or data protection lead, board representative, insurer or external solicitor. Keep operational tasks—such as locating and preserving a clip—separate from the decision about whether to disclose it.

Ask: What security question does this camera answer? Apply the same discipline to the request. What specific issue is the footage needed to address, and who is entitled to decide whether it is shared? A letter from a legal representative deserves careful handling, but it does not by itself settle every question about access, scope or disclosure.

Assess the request before releasing anything

A request from a solicitor or attorney is not automatically the same as a formal court order, nor does it necessarily give the requester an unrestricted right to every recording. The correct response depends on the circumstances, the law that applies, the organisation’s role, and what the letter actually asks for. In the UK, personal data and CCTV disclosure should be considered under applicable data protection requirements and the organisation’s documented procedures. Where there is a dispute or uncertainty, get advice from your privacy lead or solicitor.

Check whether the footage identifies the requester or another person, whether it contains information about bystanders, employees, residents, visitors or vehicle users, and whether it captures sensitive or private areas. Consider whether the request is proportionate to the stated purpose. A narrowly defined incident may not justify releasing a long recording showing unrelated people going about their day.

Redaction is more than blurring faces

If disclosure is approved, consider what needs protecting in the actual image and any accompanying information. Your checklist should go beyond faces and number plates:

People who are not relevant to the incident, including children or vulnerable individuals.
Door-entry keypads, access cards, security procedures or other details that could create a building-security risk.
Apartment, office or unit interiors visible through doors or windows.
Computer screens, documents, notices or other personal information in view.
Audio, if the system records it, as well as timestamps, camera labels or embedded metadata that may reveal unnecessary information.

Redaction must not misrepresent the event or remove context needed to understand it. Keep an unaltered master in the restricted evidence location, and make a separate redacted disclosure copy if that is the approved approach. Record what was redacted, why, who approved it and how the final copy was checked.

Know where exported clips end up

Before anyone exports footage, ask the operational questions that are easy to overlook: Where will the exported clip be stored, and who can open it? If the answer is “someone’s desktop”, “a shared folder” or “we will email it around”, stop and use the organisation’s approved secure method instead.

Use named accounts and restricted permissions wherever possible. Keep an export log stating the camera, time range, operator, reason for export, file name, storage location, access granted and any copy supplied. Use a secure transfer method approved by the organisation; do not send raw footage as a general email attachment. If a legal representative requires a particular delivery method, have the authorised decision-maker approve it first.

Tell recipients what the footage is being supplied for and any restrictions on onward use where appropriate. Do not promise that a recipient will keep it confidential unless the organisation has authority to impose that condition. Record the date and method of transfer, and retain evidence of what was actually sent.

Follow the retention policy and set a deletion date

Routine CCTV retention should be defined in policy and based on the system’s purpose and the organisation’s needs—not on a vague preference to keep recordings for as long as possible. The request may justify retaining a specific clip beyond routine deletion while the matter is considered or a relevant claim is ongoing. It does not automatically justify keeping unrelated footage for the same period.

When you preserve a clip, write down the reason, who authorised the hold, where the copy is stored, who can access it and when the decision will be reviewed. Set a calendar reminder or case-management task. When the need to retain it ends, securely delete the preserved copy and record the deletion, subject to any other applicable legal or organisational requirement.

If the footage is not found, record the search you carried out, the cameras and time period checked, and whether routine overwriting may already have occurred. Reply accurately; do not imply that footage exists if you have not confirmed it, or that it was deleted for a particular reason unless you know that to be true.

A practical first-response sequence

Log the letter. Preserve the original request and note the date received and any deadline.
Clarify the scope. Capture the written request details and ask for missing dates, times, locations or purpose.
Prevent routine loss where justified. Preserve the relevant segment before it is overwritten, using the approved process.
Restrict access. Tell only the people who need to locate, preserve or assess the footage.
Escalate the decision. Follow internal policy and involve the authorised privacy, management or legal contact.
Assess before disclosure. Consider scope, authority, other people’s information, security risks and redaction.
Document the outcome. Log approvals, exports, transfers, review dates and eventual deletion.

Common mistakes to avoid

Sending footage immediately because the request is on a law firm’s letterhead.
Waiting too long to preserve a relevant segment while the system continues overwriting it.
Keeping all cameras’ recordings indefinitely instead of limiting the hold to what is relevant.
Allowing casual viewing by staff, residents, board members or contractors who have no operational need.
Sharing raw clips through personal email, messaging apps or broadly accessible folders.
Failing to set a review and deletion date for an exported copy.
Making up a fee or quoting a price without checking the organisation’s policy and the nature of the request.

About fees and “no prices listed”

Some online articles are criticised because they provide no prices. In this situation, that is not a reason to invent a charge or treat the request like a standard product purchase. Whether any fee can be charged depends on the type of request, applicable rules and the organisation’s policy. Do not quote a price just because a scraped article has no prices listed. If a fee question arises, have the authorised privacy or legal contact confirm the applicable position before responding.

Keep camera decisions tied to a clear purpose

A well-managed response starts with purpose and minimisation: use the camera coverage that can answer the relevant security question, preserve only the segment that may matter, and disclose no more than has been properly approved. Good governance also starts before a letter arrives. The building’s policy should say who owns CCTV decisions, who may view or export recordings, how requests are logged, how redactions are handled and when preserved footage is deleted.

Camera placement matters too. Cameras should be positioned and configured for a defined building purpose, with their field of view controlled to avoid capturing neighbouring homes, private spaces or areas unrelated to that purpose. A request for footage should not become an excuse to expand surveillance or review more of people’s movements than necessary.

If an attorney’s letter has arrived today, do not panic and do not casually forward a clip. Log the request, identify and preserve the relevant segment where appropriate, limit access, and follow internal policy. If the request, authority or disclosure decision is unclear, get qualified advice before releasing the footage.

Share this guide

Share on Facebook | Share on X (Twitter)