Access to university CCTV footage

Yes. You have a right under data protection law to obtain footage that shows you, whether it is fixed CCTV or body-worn camera footage held by the university. The mechanism is a subject access request (SAR) under Article 15 of the UK GDPR and the Data Protection Act 2018. The key practical problem you have identified is real: most footage is overwritten on a short cycle (often around 30 days), so speed matters far more than anything else.

The legal basis for your request

Recorded images of an identifiable person are that person’s personal data. A university is a data controller for its CCTV and body-worn camera systems. You are entitled to request a copy of the footage in which you appear. The university must respond within one calendar month of receiving a valid request, and it must normally provide it free of charge. It can extend the deadline by up to two further months only if the request is genuinely complex, and it must tell you within the first month if it is doing so.

The urgency point: act to preserve the footage now

The one-month response deadline does not help you if the footage is deleted in the meantime under a routine retention schedule. The single most important step is to notify the university in writing immediately and expressly ask it to preserve and not overwrite the specific footage while your request is dealt with.

Once you have put the controller on notice that particular footage is the subject of a subject access request, it should not then destroy that footage in the ordinary course. Deliberately or recklessly destroying, or arranging the destruction of, information that a person has requested, in order to prevent disclosure, is a criminal offence under section 173 of the Data Protection Act 2018. Routine automatic overwriting before any request is made is not caught, but continuing to let footage be overwritten after you have specifically asked for it to be preserved is a serious matter and a strong point in your favour if there is later a dispute.

So your first email should do two things at once: make the SAR and demand preservation.

How to make the request effectively

1. Identify the right route. Universities usually have a data protection officer or information governance team and a published privacy notice with a SAR contact address. Send it there, and copy any relevant department (for example campus security for body-worn footage) so the operational team preserves the recording.

2. Make it clear and specific. State that you are exercising your right of access under Article 15 UK GDPR to CCTV and body-worn camera footage showing you. Vagueness is the main reason CCTV requests fail, because the controller has to be able to locate you in the footage.

3. Give locating details: the exact date, as narrow a time window as you can, the specific location or camera, who the body-worn camera was worn by if known (for example a named security officer or a shift), and a description of your appearance and clothing that day. A recent photograph of yourself can help them identify you.

4. Provide proof of identity if asked, such as a passport or driving licence. The controller can ask for this but should not use it as a delaying tactic.

5. Ask for the format. You can ask for a copy of the footage. In practice controllers sometimes provide stills or allow viewing rather than a raw video file, and they may need to redact or blur other identifiable people.

What the university can lawfully withhold or edit

The right of access is to your personal data, not to the whole recording. The university can and often must protect the privacy of other identifiable individuals appearing in the same footage, for example by blurring faces or editing out third parties. It cannot refuse outright simply because other people appear, unless it is impossible to comply without disclosing their data and they have not consented and it is not reasonable to disclose. It can also apply limited exemptions, for example where disclosure would prejudice an ongoing criminal investigation. It cannot refuse just because it finds the request inconvenient.

If the footage relates to a disciplinary, complaint or legal dispute

If you want the footage in connection with a university disciplinary process, a complaint against you, or a potential claim, tell them that too, because it strengthens the case for preservation and it may be relevant later to disclosure obligations if formal proceedings begin. Universities are bound by their own regulations and by expectations of fairness in their internal procedures, so footage that is material to a disciplinary allegation against you should not be destroyed while that process is live. If matters ever reach court proceedings, the ordinary duties of disclosure and rules on preserving evidence would also apply, and unexplained destruction of relevant footage can be held against the party responsible.

If the university refuses, delays or says it is deleted

If the university does not respond within a month, refuses without a proper exemption, or claims the footage is gone, you have escalation options.

1. Ask internally first. Request a review by the data protection officer and ask specifically when the footage was deleted, under what retention policy, and whether it had already been requested or flagged for preservation at that point.

2. Complain to the Information Commissioner’s Office. The ICO handles complaints about mishandled subject access requests and about improper deletion. If footage was destroyed after you had asked for it, raise that expressly, referring to the section 173 point.

3. Consider a court order. Under the Data Protection Act 2018 you can apply to court for an order requiring compliance with a SAR, and separately a court can order the preservation of evidence. This is a heavier step, usually only worthwhile where the footage is genuinely important and other routes have failed.

Practical next steps

1. Today, before anything else, send a short written request preserving and requesting the footage, with the date, time window, location, camera or officer, and a description of yourself.

2. Ask for written confirmation that the specific footage has been preserved and will not be overwritten pending your request.

3. Follow up with a fuller SAR including proof of identity if they ask for it.

4. Keep copies of everything you send and note the dates, so you can show exactly when you put them on notice.

5. Diarise the one-month deadline and chase promptly if you hear nothing.

Key facts that could change the answer

The strength of your position depends partly on whether you have already made the request before the normal deletion date, whether the university has an ongoing investigation that engages an exemption, and whether other people are so intertwined in the footage that redaction is impractical. If you can tell me the date and setting, whether it is fixed CCTV or body-worn footage, and whether it relates to a disciplinary or complaint, I can tailor the wording of the preservation request and the SAR for you.