Police, a Patient, or an Insurer Asks for CCTV Footage - What to Do

Tomasz, the owner of a physiotherapy practice, gets a call from a patient who says she slipped on a wet floor in the waiting room the day before and wants the CCTV footage "as evidence for her insurer." Two weeks later, a police officer walks into the practice asking about footage from the parking lot outside the building, where two patients' cars collided. In both cases, Tomasz has the cameras, he has the recordings -- and no idea who he's allowed to hand them to, or under what conditions.

This isn't a hypothetical. Physiotherapy practices are installing video surveillance more and more often -- for security, to protect equipment, and sometimes at the request of the building's insurer. But having cameras is only half the obligation. The other half is knowing how to respond when someone -- an authorized authority or a private individual -- demands access to a recording. A wrong call in either direction is risky: an unjustified refusal toward the police is a procedural problem, and handing footage over to anyone who simply asks for it is a GDPR violation. This article shows how to tell these situations apart and how to document them properly.

Why this is a GDPR matter at all

CCTV footage showing the image of identifiable people -- patients, their companions, staff, passers-by -- is personal data under the GDPR. Recording itself is processing, and every further action on that footage -- viewing, copying, sending, handing it to third parties -- is also processing. We cover the general rules of implementing GDPR at a practice, including the basics of running video surveillance, in the article GDPR at a physiotherapy practice.

The consequence is simple: the data controller (the practice owner) is responsible not only for recording, but also for who receives the footage and under what circumstances. Handing a recording to an unauthorized person, or without a proper legal basis, is just as serious a violation as failing to secure access to the camera system itself.

Four typical scenarios from practice life

Theft in the waiting room

A patient reports that someone took her phone from a bag she left in the waiting room during her session. She asks to view the footage, or wants to report it to the police right away and provide the recording as evidence. This is a case where the footage can genuinely help -- but that doesn't mean the practice should simply "hand it over" to whoever asks.

A collision or a fall in the parking lot outside the practice

Two drivers collide in the parking lot belonging to the building where the practice is located. One of them, or their insurers, wants the footage to settle a claim. What matters here is also whether the camera even covers the parking lot, and whether that scope of surveillance was properly declared and signposted.

A patient claims they fell inside the practice and demands the footage as evidence

This is the most sensitive case, because it directly involves the practice's own liability. A patient reports being injured on the premises and wants the footage to document the circumstances -- e.g. for a compensation claim. Here the practice owner is simultaneously a party to a potential dispute, which calls for extra procedural care.

Police request footage in connection with an investigation

An officer arrives with a written request (or a verbal one, citing an ongoing investigation) asking for the footage from a specific date and time to be secured and handed over. This is the only one of the four scenarios where the practice generally has an obligation to cooperate -- provided the request has a proper legal basis.

[SP] Example -- Solo practice: Ewa, who runs a one-person practice, gets a call from a patient asking her to "send yesterday's footage because someone took her gloves." Instead of sending the file right away, Ewa asks for a written report of the incident and explains that the footage will be secured, with a decision on any disclosure to follow once it's clear whether the matter goes to the police.

Authorized-authority request vs. a private individual's ask -- the key distinction

This is the crux of the whole topic, because treating these two situations as the same thing leads either to an unnecessary conflict with the police, or to a GDPR violation against the people captured on the recording.

A request from an authorized authority -- the police, the prosecutor's office, a court -- citing a specific legal basis (e.g. an ongoing investigation, a formal demand to produce an item or document) must be fulfilled. The practice isn't the one who decides whether it wants to cooperate here -- it has an obligation to hand over the secured material within the scope of the request. It's still worth verifying the officer's identity and the form of the request (preferably written, with the unit's official stamp), and documenting the handover itself.

A request from a patient, their companion, the other party to a collision, or an insurer, without any legal basis (e.g. no court order, no formal procedural motion), is not an automatic obligation for the practice. That doesn't mean you should always refuse -- you can consider disclosing the footage with the consent of everyone whose image appears in it, or on the basis of a legitimate interest in the matter (e.g. when it helps clarify an incident the practice also has a stake in). What matters is that such a decision is conscious, documented, and not made "over the phone" with no paper trail.

Who is asking	Basis	Obligation to disclose	What to do
Police / prosecutor's office	Ongoing investigation, written request	Yes, an obligation	Verify identity and the form of the request, draw up a handover record
Court (order)	Procedural ruling	Yes, an obligation	Disclose within the scope of the order, document it
Patient / companion without legal basis	No formal request	No, the practice's decision	Consider consent from those recorded, document the decision
Insurer (without parties' consent)	No legal basis	No, the practice's decision	Usually refer to the party concerned, or obtain consent
Other party to a parking-lot collision	Usually no formal basis	No, the practice's decision	Consider a joint statement/consent from both drivers

Who at the practice has access to recordings

Before you even get to "who should we hand the footage to," you need clarity on who at the practice can view recordings on a day-to-day basis in the first place. Access to the surveillance system and the footage archive should be limited to a closed circle of authorized persons -- not every employee or collaborator automatically has the right to view the footage. A practical tool here is a list of people authorized to operate the surveillance system, kept as part of the practice's GDPR documentation, specifying the scope of each person's access (e.g. live view only vs. archive access with export rights).

Without such a list, in practice you can't demonstrate, during an inspection or after an incident, who technically had the ability to copy or disclose a recording -- which is itself a weak point in the practice's data-protection setup.

The record of securing and disclosing a recording

This is the element most often forgotten -- even when handing footage to the police, i.e. a recipient whose entitlement isn't in doubt. The mere fact that the requesting party is entitled to the recording doesn't relieve the practice of its own obligation, as data controller, to document what it did.

Without a formal record, disclosing a recording -- even when fully justified -- can be assessed as undocumented processing and disclosure of personal data, i.e. a GDPR violation on the practice's part, regardless of the recipient's entitlement to receive it. The record should answer a few basic questions:

• Who made the request (the officer/authority's details, or the private individual's).
• To whom the recording was actually disclosed (name, position/role, unit).
• When the disclosure took place (date and time).
• What segment of the recording was disclosed -- the exact range of dates, times, and cameras, not "the whole drive."
• For what purpose the recording was disclosed -- what matter it relates to.
• On what basis the disclosure was made -- a request from an authorized authority, consent from those recorded, or legitimate interest.

Such a record also serves as evidence of the practice's due diligence, should the UODO -- or the patient whose image ended up in the footage -- ask why and to whom the recording involving them was disclosed.

[GR] Example -- Group practice: A police officer shows up at a practice employing several physiotherapists with a verbal question about footage from a week earlier. Instead of copying the file onto a USB drive right away, the receptionist asks for written confirmation of the request, informs the practice manager, and only after their decision prepares the handover -- along with a record specifying the scope of the material disclosed and the officer's details.

Extending retention for an ongoing case

The standard retention period for CCTV footage at most practices is a few days up to a few months at most (typically up to around 3 months), after which the system automatically overwrites older recordings. This is correct from a data-minimization standpoint -- there's no reason to keep footage "just in case" indefinitely.

The problem arises when a specific segment of footage is needed as evidence in an ongoing case (criminal, civil, insurance) -- and the standard retention cycle will overwrite it before the case is resolved. The solution isn't extending the retention period of the whole system, but isolating and separately securing the specific segment relevant to the case. In practice this means:

• copying the relevant segment (a specific date/time range, specific cameras) to a separate, secured medium or a separate location within the system,
• recording the reason for isolating it (e.g. "patient fall report of [date]," "police request, case no. [X]"),
• defining how long this isolated segment will be kept -- usually until the case is concluded, after which it should be deleted.

Once isolated, that segment is no longer subject to the regular overwriting cycle of the surveillance system, but it still needs its own documented basis and retention deadline -- otherwise the practice risks being accused of keeping data longer than necessary.

Step by step: what to do when someone asks for footage

1. Establish who is asking and on what basis -- an officer with a written request is a different situation from a phone call from a patient.
2. Check the list of authorized persons -- who at the practice can even technically access the footage.
3. If it's an authorized authority -- verify identity and the form of the request, prepare the disclosure within the requested scope.
4. If it's a private individual with no legal basis -- consider consent from those recorded, or refer the matter for formal clarification before disclosing anything.
5. Isolate and secure exactly the segment relevant to the case -- not the entire archive.
6. Draw up a record of the disclosure or securing of the footage -- who, to whom, when, what scope, for what purpose.
7. Note the retention deadline for the isolated segment and return to it once the case is resolved, to delete it.

Frequently asked questions

Does a practice have to hand over footage to the police if an officer asks verbally?

It's always worth asking for the request in writing, or at least verifying the officer's identity and the unit they represent. If the request has a genuine legal basis tied to an ongoing investigation, the practice is obligated to fulfill it, but the disclosure itself should still be documented with a record specifying the scope of the material handed over, regardless of the form in which the request was made.

Does a patient who claims they fell at the practice have a right to demand the footage?

A patient can ask for it, but without a formal legal basis (e.g. a court order in an ongoing case), the practice has no automatic obligation to disclose the footage on request alone. The practice owner can consider disclosure with the consent of everyone visible in the recording, or refer the matter for clarification through another channel, but the decision should be made consciously and documented, especially since the practice is itself a party to a potential dispute here.

How long does a recording that's needed as evidence have to be kept?

The standard retention cycle for surveillance footage (e.g. 3 months) applies to ordinary recordings nobody needs. If a specific segment has evidentiary value in an ongoing case, it should be isolated and secured separately, with a recorded reason and a planned retention deadline -- usually until the case concludes, after which it should be deleted.

Can an insurer demand CCTV footage from a physiotherapy practice?

An insurer may request it as part of a claims process, but the insurer's request alone, without consent from those recorded or another legal basis, doesn't create an automatic obligation for the practice to disclose it. In practice, it's often more sensible to refer the insurer to the party the case concerns, or to obtain written consent from all interested parties before disclosing the footage.

CTA: Video surveillance at a practice isn't just cameras -- it's also procedures for handling requests and asks for footage. The PREMIUM package includes a full audit of your practice's GDPR documentation, including areas related to video surveillance and personal-data procedures. See FizjoReady packages →

Related articles:
- GDPR at a physiotherapy practice -- a complete guide
- Video surveillance at a physiotherapy practice and GDPR
- Employee monitoring -- employer obligations