Who Responds to Resident CCTV Requests in a Condo Building?

When a resident asks to see CCTV footage, the first question is often, “Who should deal with this?” In most condo and mixed-use buildings, the property manager is the practical first point of contact, while the board or owners’ association sets the rules and oversees how the system is used. The CCTV operator or service provider may retrieve footage, and a privacy lead or legal adviser may help assess a difficult request.

That division matters. A manager should not make up access rules on the spot, and a board should not casually browse recordings. Every request needs a documented route, a clear decision-maker and a secure way to handle any footage that is disclosed.

This guide explains the manager request handling process, the board oversight role and a workable response timeline process. It also covers data minimisation, camera positioning, retention and deletion. The right legal duties depend on where the building is located https://dlf-ne.org/how-do-i-stop-staff-from-watching-cameras-out-of-curiosity/ and who controls the system, so treat this as an operational guide rather than legal advice.

Start with one practical question

Before anyone retrieves a clip, ask: What security question does this camera answer? CCTV should be installed and operated for defined purposes, such as investigating a reported incident or protecting a particular entrance—not “just in case”. The same discipline applies to requests. Establish what happened, where and when, and what the resident is asking the building to do.

A request might be:

a report of theft, damage, harassment or a vehicle collision;
a request by someone to access footage in which they appear;
a request to preserve a recording for a police report, insurance claim or legal matter; or
a request to view footage out of curiosity or to check what a neighbour was doing.

These are not all the same. A request to preserve footage is not automatically permission to provide a copy, and a resident’s interest in an incident does not necessarily entitle them to see identifiable footage of other people.

Who does what?

Role Typical responsibility What the role should not do Property manager Receive and log requests, clarify details, follow the approved procedure, arrange a time-limited search and communicate the decision. Promise access, share raw footage informally or make a policy exception without authority. Board or owners’ association Approve the CCTV purpose, governance rules, access controls and retention schedule; review significant incidents and policy exceptions. Use recordings for personal interest, neighbour disputes without a defined basis or routine informal monitoring. Authorised CCTV operator or supplier Retrieve a specified recording, maintain system security and provide technical support under written instructions. Decide independently who is entitled to footage or keep unapproved copies. Privacy lead or legal adviser Advise on identity checks, third-party privacy, disclosure duties and complex or contested requests. Replace a clear day-to-day process for ordinary requests.

The manager’s role: receive, clarify and record

Managers usually handle the first contact because they know the building, can identify the relevant camera Article source and can coordinate with onsite staff. That does not make them the sole owner of the CCTV system. The building’s legal structure, contracts and applicable privacy law determine who is formally responsible for the data.

At intake, the manager should capture the request in a restricted-access log. Record the date received, the requester’s contact details, the incident date and approximate time, the location, the camera if known, the requested action and the next review date. Ask only for information needed to locate and assess the footage.

For example, “I think something happened sometime last week” is usually not enough to conduct a proportionate search. The manager can ask for a narrower time window, entrance or floor, and a short description of the event. Avoid asking for unrelated personal information. Verify identity appropriately before disclosing personal data, but do not collect or retain identity documents by default if a less intrusive check will do.

Log the request without creating a second privacy problem

The request log should be separate from general maintenance notes and available only to people who need it. Do not paste footage links into a broadly shared work-order system. Record the decision and rationale, but avoid copying sensitive details into multiple systems. The log itself needs a retention period and routine deletion when it is no longer required.

The board’s oversight role: set rules, not watch clips casually

The board should approve the purposes for each camera, the locations, who may operate the system, how requests are assessed and how long footage is retained. It should also make sure the building has written arrangements with any security contractor, including access restrictions, confidentiality, secure transfer and deletion obligations.

Good oversight does not mean directors routinely watch recordings. Curiosity is not a legitimate operational reason. Board members should receive a concise incident summary where possible; access to footage should be limited to people assigned a specific task. If a director is personally involved in a dispute, they should not decide the related request.

Policies should state who can approve a disclosure and when escalation is required—for example, a request involving a serious allegation, a dispute between residents, footage of a child, a request from law enforcement, or a disagreement about access. The board should review access logs and exceptions periodically, without turning that review into general viewing.

Use a consistent response timeline process

A response timeline should distinguish acknowledgement, preservation, assessment and final response. Applicable legal deadlines vary, especially where a request is formally made under data protection law. A building should not assume that its ordinary service target replaces a statutory deadline.

Acknowledge promptly. Confirm receipt, explain who is handling the request and ask for any essential missing details. Do not promise that footage exists or will be disclosed.
Check whether footage may be overwritten. If the request identifies a specific incident and there is a valid reason to retain the clip, arrange a restricted, documented preservation step before routine deletion. Preservation is not the same as giving the requester a copy.
Locate and assess only the relevant segment. Search the narrowest reasonable time and camera view. Record who searched, when, and what was found.
Decide the response route. Consider whether the requester is seeking their own personal data, whether other people are identifiable, and whether a safer or less intrusive way to address the concern is available. Escalate uncertain cases to the designated privacy lead or adviser.
Respond and document. Explain the outcome, any limits and any next steps. Record the decision, the basis for it, who approved it and any disclosure made.
Close the retention loop. Remove any temporary export when the approved purpose ends, and record the deletion in line with the building’s schedule.

Give residents a realistic update if assessment takes longer than expected. A simple message such as “We have preserved the relevant segment while we review the request; we will update you by [date]” is better than silence. Set internal targets that allow the building to meet the strictest applicable legal deadline, and train staff to refer formal access requests immediately.

Data minimisation begins before a request arrives

The safest clip is often the one the building did not need to record. Before installing or retaining CCTV, document the specific security purpose and consider whether lighting, access control, concierge procedures or repairs would address the problem with less monitoring.

Camera placement and field of view should match that purpose. A camera intended to monitor a vehicle entrance should not unnecessarily capture apartment doors, windows, private balconies, neighbouring property or areas where people expect greater privacy. Use privacy masking, angle adjustment or restricted zones where available. Review views after construction, landscaping or equipment changes; a camera can start capturing a different area without anyone noticing.

Keep a camera map and purpose register. For each device, note its location, field of view, purpose, responsible operator and retention period. If a request reveals that a camera misses the relevant area or captures too much, record the issue for a formal review rather than widening access or adding cameras by default.

Retention and routine deletion

Set a retention period based on the security purpose, practical incident-reporting needs and applicable law. There is no universally suitable number of days for every building. A longer period is not automatically safer: it increases the amount of personal information exposed in a breach and the chance of access being misused.

Automated overwrite or deletion should be the normal rule. If a specific clip needs to be preserved, isolate only the relevant segment, restrict access, record the reason and set a review or deletion date. Do not let “preserved” turn into “kept indefinitely”. When the investigation, claim or other approved purpose ends, delete the copy unless a continuing lawful reason requires retention.

Exports: know where the clip goes and who can open it

Before exporting footage, ask two questions: Where will this clip end up, and who can open it? A download to a personal laptop, raw footage attached are elevator cameras legal to an email or a shared-folder dump with no deletion date can defeat otherwise sound camera controls.

Use an approved, access-controlled transfer method. Limit access to named recipients, use encryption or a secure portal where appropriate, and record the file name, recipient, date, purpose and expiry or deletion date. Avoid sending unredacted footage to a broad board mailing list or residents’ group chat.

Keep a small redaction checklist: check faces, number plates, apartment or door numbers, screens and documents visible in the scene, reflections, audio, and details that could identify someone indirectly. Redaction should be reviewed before release; blurring faces alone may not be enough. Where safe and lawful, a limited viewing, still image or edited segment may address the request better than providing the entire recording.

What if the building cannot provide the footage?

Footage may not exist, may already have been routinely overwritten, may not cover the reported location, or may be unsuitable to disclose because of other people’s privacy or another applicable restriction. The manager should explain the outcome clearly and avoid implying that the building has retained footage when it has not.

If the building refuses or limits access, explain the general reason and any review or complaint route available under the building’s policy and applicable law. Do not disclose confidential details about another person or make promises about what police, insurers or courts will receive. Requests from authorities should be verified and handled through the building’s authorised process.

Common mistakes to avoid

Letting any staff member or director browse footage without a defined task.
Installing cameras “just in case” rather than documenting a specific purpose.
Giving a resident a raw clip without checking other identifiable people and sensitive details.
Keeping exports in personal email, devices or shared folders without access limits and a deletion date.
Promising disclosure before identity, purpose and privacy considerations have been assessed.
Failing to preserve a relevant segment while the request is being reviewed.

What about fees or prices?

There is no single building-wide price that can safely be quoted for every CCTV request. Whether a fee is permitted, and in what circumstances, depends on the applicable law and the nature of the request. Do not invent a charge or copy a figure from an unrelated article. If a resident asks about costs, check the governing documents, approved policy and local legal requirements, then give a clear answer before undertaking any chargeable work.

A short policy check for boards and managers

Is there a named person responsible for receiving requests and a clear escalation route?
Can staff identify each camera’s purpose and field of view?
Are access, searches, exports, disclosures and deletions logged?
Does the retention schedule include routine deletion and a process for temporary preservation?
Does every export have a named recipient, secure destination and deletion date?
Are staff trained not to watch footage out of curiosity?

Conclusion

In a well-run condo building, the manager handles the request operationally, the board provides governance and oversight, and an authorised operator retrieves only the footage needed. A documented response timeline, carefully controlled camera views, proportionate retention and secure deletion protect residents while helping the building respond credibly to incidents.

Make the process easy to follow before the next request arrives. When a request comes in, clarify what is being asked, preserve only what needs preserving, assess disclosure carefully and keep a record of the decision. That is more dependable—and more respectful of residents—than letting footage circulate informally.

Share on Facebook | Share on X (Twitter)