Can You Request CCTV Footage? Who Has the Right Under PDPA?

Can you simply ask a shop, condominium, office, or homeowner for CCTV footage after an incident? The answer is not necessarily. CCTV recordings may contain personal data, especially when people can be identified in the footage, so access should be handled carefully under Thailand's Personal Data Protection Act (PDPA).

Under the PDPA, a data subject may have a right to access their personal data. However, this does not mean that anyone can automatically request or obtain an entire CCTV recording simply because they appear in it. The organization responsible for the footage may need to verify the requester, consider the rights of other people appearing in the recording, and determine whether the footage can legally be disclosed.

Is CCTV Footage Considered Personal Data?

CCTV footage can contain personal data when a person can be identified directly or indirectly from the recording.

For example, a video showing a person's face, clothing, movements, vehicle, or other identifiable characteristics may allow that person to be identified. In such cases, the recording may fall within the scope of personal data protection requirements.

This is why organizations should not treat CCTV footage like an ordinary video file that can simply be copied and handed to anyone who asks for it.

Who Can Request CCTV Footage?

The most important distinction is between the data subject and another person requesting someone else's information.

1. The person appearing in the footage

If you appear in a CCTV recording, you may have rights as a data subject to request access to your personal data, subject to the conditions and limitations under the PDPA.

For example, you may contact the organization responsible for the CCTV system and explain the date, approximate time, and location where you believe you appeared in the recording.

The organization may ask for information needed to verify your identity and locate the relevant footage.

2. A person requesting footage of someone else

This is different. Simply being interested in a CCTV recording does not automatically give you the right to receive footage containing another person's personal data.

For example, if a person asks a store for a video showing another customer, the store should not assume that it can simply provide the entire recording. It may need to consider the privacy rights of the people appearing in the footage and the legal basis for disclosure.

3. Police or other authorized authorities

CCTV footage may also be requested by law enforcement or other authorities when there is a lawful basis for obtaining the information. In an incident involving a crime or other legal investigation, the appropriate process may be different from an ordinary personal data access request.

Organizations should therefore distinguish between a data subject access request and a request made by an authorized authority.

Can You Ask a Shop for CCTV Footage After an Incident?

Yes, you can make a request, but making a request does not automatically mean the shop must give you the original CCTV file immediately.

For example, suppose you believe that an incident occurred inside a store at 3:00 PM. You can provide details such as:

• Date of the incident
• Approximate time
• Location inside the store
• Description of where you were
• Reason for requesting the footage
• Information needed to verify your identity

This information can help the organization locate the relevant recording and evaluate the request.

Does the Shop Have to Give You the Entire CCTV Video?

Not necessarily.

A CCTV recording may contain multiple people. Giving you the complete video could therefore disclose personal data belonging to other individuals.

The organization may need to consider whether other people can be identified and whether their personal data can be disclosed. Depending on the circumstances, the organization may need to take measures to protect information relating to other individuals before providing access.

This is one reason why a request for the whole CCTV recording can be more complicated than a request for access to personal data relating specifically to the requester.

Can a CCTV Owner Refuse a Request?

There can be circumstances where access is restricted or refused under the applicable legal conditions.

The right of access under the PDPA is not an unlimited right to obtain every recording that contains a person's image. The organization responsible for processing the data must consider the applicable legal requirements, the rights of other individuals, and any relevant exceptions or restrictions.

The Office of the Personal Data Protection Committee (PDPC) provides a framework for data subject rights and a Data Subject Access Request (DSAR) process for handling such requests.

What Information Should You Provide When Requesting CCTV Footage?

If you need to request CCTV footage, providing precise information can make the process easier.

The more specific the information, the easier it may be for the organization to identify the relevant recording without unnecessarily searching or disclosing unrelated footage.

What Happens If Other People Appear in the CCTV Footage?

This is one of the most important issues when dealing with CCTV footage.

Imagine that you appear in a recording together with five other people. Giving you the complete unedited video could potentially disclose personal data belonging to those other individuals.

The organization may therefore need to consider ways to protect the privacy of other people before providing access, depending on the circumstances and applicable requirements.

This is also why a CCTV request should not be treated as simply asking for a downloadable video file.

How Long Is CCTV Footage Kept?

There is no single universal retention period that applies to every CCTV system. The appropriate retention period depends on the organization's purpose, policies, legal requirements, and the circumstances in which the CCTV system is operated.

This is important because CCTV systems often use limited storage capacity. Once the retention period expires, older footage may be overwritten by new recordings.

If you need footage relating to an incident, it is therefore better to make a request as soon as possible rather than waiting until the recording may have been overwritten.

Can You Request CCTV Footage From a Neighbor?

This situation requires additional caution.

If a neighbor's CCTV camera captures an area involving you, you cannot simply assume that you have an automatic right to obtain the neighbor's entire recording.

The recording may contain information about your neighbor, visitors, family members, or other people. The owner or controller of the CCTV system therefore needs to consider the applicable privacy and data protection requirements before disclosing the footage.

If there is a serious incident, dispute, or suspected crime, using an appropriate legal or law-enforcement process may be more suitable than attempting to obtain the footage informally.

What Should CCTV Owners Do When Someone Requests Footage?

If you operate CCTV at a home, shop, office, condominium, or other property, it is useful to establish a clear process for handling requests.

• Verify the identity of the requester.
• Determine whether the requester is the person appearing in the footage or is requesting another person's information.
• Identify the date, time, and camera involved.
• Check whether the relevant footage is still available.
• Consider whether other individuals appear in the recording.
• Assess whether disclosure is permitted under the applicable legal requirements.
• Limit disclosure to information that is appropriate for the request.
• Keep a record of how the request was handled when appropriate.

The PDPC's GPPC platform includes a specific system for managing data subject access requests, reflecting the importance of having a structured process for handling these requests. :contentReference[oaicite:1]{index=1}

Does Installing CCTV Mean You Must Give Anyone the Footage?

No.

Installing CCTV does not mean that every person who asks for a recording automatically has the right to receive it.

The key question is what personal data is contained in the recording, who is making the request, why the footage is being requested, and what legal requirements apply to the disclosure.

For organizations operating CCTV, it is therefore important to have a clear CCTV privacy policy, appropriate access controls, retention practices, and a procedure for handling data subject requests.

Conclusion: Can You Request CCTV Footage?

Yes, you can request CCTV footage when you have a legitimate basis for accessing personal data relating to you, but the right to access does not automatically mean that you can obtain any CCTV recording in its entirety.

If you are the person appearing in the footage, you may exercise applicable data subject rights by contacting the organization responsible for the CCTV system. The organization should then assess the request, verify your identity, locate the relevant footage, and consider the privacy rights of other people appearing in the recording.

For CCTV owners, the safest approach is not to simply hand over recordings whenever someone asks. Instead, establish a clear process for verifying requests and handling CCTV footage in accordance with the PDPA.

FAQ: CCTV Footage and PDPA

Can I request CCTV footage of myself?

You may have a right to request access to your personal data contained in CCTV footage, subject to the applicable conditions and limitations under Thailand's PDPA.

Can I request CCTV footage of another person?

Not automatically. CCTV footage may contain personal data belonging to other individuals, so the organization should assess whether disclosure is legally permitted before providing the recording.

Can a shop refuse to give me the entire CCTV video?

Yes, there may be circumstances where the organization cannot provide the entire recording, particularly when it contains personal data relating to other individuals or when a legal restriction applies.

Should I request CCTV footage immediately after an incident?

Yes. CCTV systems may have limited storage and older recordings can eventually be overwritten. Making a request promptly can improve the chance that the relevant footage is still available.

Does appearing on CCTV automatically give me the right to download the video?

No. A right to access personal data does not necessarily mean an unrestricted right to receive the complete original recording. The organization must consider the applicable PDPA requirements and the rights of other people appearing in the footage.

References

• Office of the Personal Data Protection Committee (PDPC) Government Platform for PDPA Compliance (GPPC)
• PDPC Data Subject Access Request Management (DSAR)
• PDPC Handling Data Subject Rights Requests
• PDPC Data Subject Access Request Management