What Should You Do When a Resident Asks for Your CCTV Footage?

What Should You Do When a Resident Asks for Your CCTV Footage?

It's one of the questions I get most often from MCSTs: can we just pull the CCTV footage?

A car gets scraped in the basement carpark. A parcel goes missing outside a unit. Someone wants to know who let a contractor into the lift without registering them. The council, or the managing agent, reaches for the obvious answer — check the camera.

That part is usually easy. Most estates have the cameras, and pulling a clip isn't a technical problem.

What trips MCSTs up is everything around it.

The camera was never the issue

An MCST is an organisation under the PDPA, the same as any company. That surprises some council members, who assume the Act is written for businesses and MCSTs just happen to have some data lying around. It isn't like that. The PDPC has said so directly, in advisory guidelines written specifically for management corporations.

That means the full set of obligations applies: a designated DPO, a policy for how personal data is handled, reasonable security around it, and a proper process for responding when someone asks for their own data.

CCTV footage of a resident is their personal data. Asking for it is an access request, the same category as someone asking what's in their file. And two PDPC cases show what happens when an MC hasn't thought that through.

Two cases, same gap

In 2020, PDPC found that a condominium's MC and its security vendor had both failed to put reasonable security arrangements in place to stop CCTV footage from being disclosed without authorisation. The footage showed identifiable people on the premises, and it ended up circulating beyond anyone who was meant to see it. The vendor was found to have breached the Protection Obligation. The MC was found to have breached it too, alongside the Accountability Obligation, because it had no DPO, no data protection policy, and no data protection terms in its contract with the security vendor. Nobody had set out what the vendor's staff could and couldn't do with the footage, so there was nothing stopping it from moving beyond the estate.

The second case is closer to the everyday version. In April 2024, a resident of a condominium was involved in a collision near the estate and asked the MC for CCTV footage that might have captured it. The managing agent refused.

As it turned out, the footage wouldn't have identified the resident anyway, so there was no obligation to hand it over on that specific request. But PDPC still found the MC in breach of the Accountability Obligation. It had no DPO for most of the period in question, and no data protection policy.

Worse, it had never given its managing agent any instructions on how to handle a request like this one. The managing agent didn't get it wrong so much as get nothing to go on.

PDPC accepted a voluntary undertaking from the MC in May 2025, covering staff training, a documented request process, and a proper data protection policy.

In both cases, the answer to the underlying question - can we release the footage - wasn't really the problem. The problem was that nobody had decided, in advance, who makes that call and how.

Why it happens

CCTV in an estate gets treated as a security matter, full stop. It sits with the managing agent, or with whichever council member volunteered to deal with the vendor. Nobody frames it as a personal data matter, because nobody's thinking about the PDPA when they're comparing quotes for camera installation.

The vendor contract covers hardware, maintenance, and monitoring. It rarely says anything about who can copy footage, who can see it, or what happens when a resident asks for it. So when a request lands, whoever picks it up is guessing — sometimes into a phone, sometimes into a flat refusal, neither of which holds up well.

What to put in place before the next request

A few things make the difference between guessing and having an answer ready.

• Designate a DPO, and make sure residents and the managing agent both know who it is. The MC can delegate day-to-day handling to the managing agent, but the MC stays responsible either way — delegating the task doesn't delegate the accountability.
• Write down the CCTV purpose and stick to it. Security is the usual answer. If footage starts getting used for something else — settling a by-law dispute over a pet, say — that's a separate decision, not an automatic extension of "we have the footage anyway."
• Put data protection terms in the security vendor contract. Who can access footage, how it can be copied, what channels are and aren't allowed. The 2020 case turned on exactly this gap.
• Have a written process for requests. When a resident asks for footage, work out whose data it actually is. If it shows the person asking, it's their access request — respond within a reasonable time, and where other residents also appear in frame, mask them out rather than refusing outright. If it shows someone else, or the request is really about settling a dispute or a claim, that's a different question, and it's worth getting advice before anything goes out.
• Set a retention rule, not an indefinite one. The PDPA doesn't set a fixed number of days for CCTV footage. It does expect the MC to stop keeping it once the purpose it was collected for is no longer being served, rather than defaulting to "we might need it someday."

None of this requires new equipment. It requires someone to have made the decisions once, written them down, and told the people who'll actually be handling the request.

That's usually the gap we find when we sit down with an MC or its managing agent — not that the cameras are wrong, but that nobody had worked out, ahead of time, what happens the next time someone asks.