When someone asks for the footage
Sooner or later a staff member, a customer, the police or an insurer asks for a copy of your CCTV. Most systems can export a clip. Far fewer businesses know who is allowed to ask, what they are entitled to, or how long they have to answer.
A camera system is usually bought to deter and to record. The request that tests it comes later, from someone who wants a copy of what it recorded, and it tends to arrive when the footage is about to roll off the end of the retention window.
There are four common askers, and they are not entitled to the same thing.
The person in the footage
Under the Privacy Act 2020, footage in which someone can be identified is personal information about them, and they have a right to ask for it. That includes staff and customers.
You have twenty working days to respond. Not to finish investigating, to respond. You can extend in some circumstances, but you have to say so within that time.
Other people in the frame are the complication. If the clip also shows other identifiable people, releasing it can disclose their information. The usual answers are blurring the others, cropping, providing stills, or letting the requester view the footage without taking a copy. Refusing outright because other people appear is rarely the right answer.
Preserve it the moment you are asked. A request for footage that your system then overwrites is a much worse position than a request you took a week to answer.
The police
Police can request footage to help an investigation, and most businesses want to help. The Act allows disclosure where it is necessary to avoid prejudice to the maintenance of the law, but it is a judgement rather than an automatic yes.
Ask for the request in writing, identifying the officer, the incident and the time window. Provide what was asked for rather than the whole day. Keep a record of what went, when and to whom. None of that is obstruction. It is what lets you answer the question later if anyone asks why footage of them was handed over.
Insurers and lawyers
Usually part of a claim or a dispute, and usually with a legitimate purpose. The same discipline applies: the specific clip, a record of the disclosure, and a check that the purpose matches why the cameras were installed in the first place.
Your own managers
The request that causes the most trouble is internal. A manager wants to review footage of a staff member for a performance or conduct matter.
Whether that is acceptable depends heavily on what staff were told the cameras were for. Cameras explained as site security, then quietly used to build a disciplinary case, is the pattern that ends in a complaint. If employment matters are a purpose, say so in the policy and in the signage before you need to rely on it.
What makes all of this manageable
A written footage policy. One page. Why the cameras are there, how long footage is kept, who can view it, who can export it, and how requests are handled.
A named person. Requests go to them, not to whoever happens to have the login.
A request log. Date, requester, what was asked for, what was provided, and why. It takes a minute per entry and it is the thing you will be glad of.
Export that actually works. Test it. Plenty of systems produce a clip in a proprietary format that the recipient cannot play, or cannot export at all without the installer on site.
Retention set on purpose. Long enough to cover the delay between an incident and someone noticing it, short enough that you are not holding months of video about people for no reason. Thirty days is a common starting point. Pick yours and write down why.
The test
Pick an incident from last month and try to produce a clean, playable copy of the relevant ten minutes, with other people blurred, in under an hour. If that is not possible, you have found the work to do before the first real request arrives rather than after.