CCTV Signs, Privacy Notices and Footage Requests

Plenty of buildings have a CCTV sign. Far fewer can say what happens when someone walks up and says, 'I would like to see the footage of me.' Who takes the request, what do they check, and how is the video handed over? The sign and the request process belong together, because the sign implies that someone is answerable for the cameras.

For the general PDPA position on cameras in offices, shops and condominiums, read CCTV in the workplace. This article goes into what the new NCSA guideline adds: it treats the sign, the notice and the request as one process.

A note on quotations. The guideline has no official English translation yet, so its quotes appear in the Thai original, each followed by an English reading of our own. PDPA and the PDPC access notification are quoted in the unofficial English translations held in our law library.

What must you settle before putting up a sign?

Why you installed the camera. A sign can only be worded properly after the owner has answered that. Clause 2.3.1 sets out the order of thinking, before installation or before changing how the cameras are used.

The clause asks you to work through a sequence: purpose, necessity of using cameras, the areas that must be recorded, the data needed, the retention period needed, and who needs access. That sequence matches the boxes the sign and notice must later fill. If you skip the early steps, the 'why' on the sign becomes a broad phrase that commits you to nothing.

Clause 2.3 also treats the home separately. If an individual installs a camera purely for personal or family purposes, such as watching their own house, the guideline says it falls within the exception in section 4 (1) of PDPA. That exception does not mean footage can be published without limit, and cameras run by a condominium juristic person, a shop or an office are outside it.

The legal basis the owner chooses, such as legitimate interest or performance of a contract, is a case-by-case decision, and it belongs in the detailed notice as well. For help choosing one, see when consent is not needed under TDPG.

What should a CCTV sign contain?

The guideline suggests four items for the basic sign. The list of what the law requires you to tell people is longer, and must be given before or at the time of collection. PDPA section 23 is the source of that longer list.

The two layers split the work cleanly. The sign must be readable at walking pace, so it carries only four things. Retention, recipients, system providers and data subject rights go into the detailed notice that the sign points to.

One caution: a sign does not make the recording lawful. Clause 2.3.2 says so directly, in the sentence an owner should remember best from this part of the guideline.

In practice, footage recorded for safety cannot be redirected to check staff attendance or to feed marketing on the argument that 'there was a sign'. You go back to purpose and legal basis under clause 2.3.1 above.

How should the two-layer sign be worded?

The table below is a sample drafted by the author to show the shape. It is not text from the guideline or the Act, and it is not a standard wording that fits every site. Anything in square brackets must be replaced with your own facts, above all the number of days of retention, which must match what the recorder really does.

In a building with several entrances and common areas, use the same sign design everywhere and point every QR code to one notice. Change it once and every sign is correct.

For writing a notice people actually read, see a privacy notice people actually read. AIPDPA's public rights-request page comes with a link and a QR code you can print on the first-layer sign. You can see the real screens in the demo account.

Someone asks to see footage: what do you check before sending anything?

First, who is asking and in what capacity, because the answer differs. A person in the footage asking for their own image is exercising a right. Anyone else asking for footage of other people is asking you to disclose someone else's data. Clause 2.3.3 says to have a request process in place before the first request arrives.

The seven points follow the order of the real work: who takes the request, verify identity, find the footage, look at other people in it, mask if needed, hand it over safely, then write it down. The next table matches each type of requester with what to check first.

The first row is the one owners meet most often and the one with the clearest legal rules. The rows below it rest on the guideline's principles, so the reader must add the detail of whatever law each requester relies on.

When may you refuse a request from someone who is in the footage?

Only where the law or a court order requires it, or where giving access would adversely affect the rights and freedoms of others. Almost every CCTV clip has other people in it, so this rule bites harder for cameras than for most data.

The PDPC notification on access and copies, B.E. 2569 (2026), which our library records as taking effect on 15 September 2026, spells this out in clause 8. It does not say to refuse the whole request. It says to do what can be done without undue harm to others.

For CCTV, this supports the common method of blurring or masking other people's faces before sending a clip, or cutting out irrelevant stretches. The text speaks of erasing, redacting or otherwise dealing with the data. If you do refuse, tell the requester with reasons and record the refusal in the register under section 39.

On identity, clause 7 of the same notification has the controller ask the requester to amend or add documents when identity cannot be confirmed, rather than refusing at once.

Cameras add a second layer to identity: the requester must really be the person in the shot. You can test that by asking the requester to state the time window, the place they walked through and what they were wearing, then searching on those details. It is wiser not to open a whole day of footage for the requester to pick through, because that quietly discloses other people (the author's suggestion).

Clause 10 of the notification also allows an extension of not more than a further 30 days where the volume of data is large or there is another necessary cause, with the reasons given to the requester. Footage that must be searched across many cameras and days might qualify, but it is a case-by-case call. The full counting rules are in answering access, erasure and objection requests on time.

From receipt to hand-over, in what order should you work?

The order below is drawn from the seven points in clause 2.3.3 and the DSR notification's steps, with one important addition from the author: protect the footage from overwriting from the day the request arrives.

1. Day the request arrives
   Log the request: date received, requester and what they asked for. Place a temporary hold on the requested stretch of footage only (the author's addition, because the retention cycle may be shorter than the time needed to process the request).Clause 2.3.3 (who receives, and the record)
2. Identity and request check
   Verify the requester and whether the request is complete; if not, ask them to amend it or send more documents.DSR notification clause 7
3. Searching
   Search only the time window and camera the requester gave, and note which cameras and periods were searched.Clause 2.3.3 (finding and identifying the data)
4. Checking for other people
   See whether others appear; mask or trim the part that would affect them, or refuse only that part with reasons.PDPA section 30, second paragraph; DSR notification clause 8
5. Hand-over
   Deliver through a secure channel, for example a password-protected link that expires, or collection at the desk against ID, not an ordinary chat app (the methods are the author's examples).Clause 2.3.3 (secure delivery)
6. No later than 30 days from receipt
   Close the case and record the decision, the approver, what was sent and what was masked, then lift the hold if there is no reason to keep the footage.PDPA section 30, fourth paragraph; clause 2.3.3 (the record)

The first step ties into retention. If the recorder keeps 14 days and a request arrives on day 13, the footage may be overwritten before anyone gets to search. For how to decide the number of days, see how many days of CCTV footage to keep and how much disk it takes.

What should you record when police or an insurer ask for footage?

Evidence that can be checked later: why it was sent, who approved, what was sent and how. This is the last paragraph of clause 2.3.3, and it differs from a data subject's request in that the requester is an outsider.

This does not say whether to hand the footage over. It says to consider the relevant law and to write it down. How much weight a police letter carries, and which legal basis supports a disclosure, is covered in the article on police requests, which reads the PDPC's published consultation answers.

You can record each disclosure in the section 39 register or in a separate footage-disclosure log, provided it can be searched later. A good log has at least the date, the requester and agency, the matter cited, the cameras and period sent, the approver, the method, and the date the hold was lifted (column headings are the author's suggestion).

Which sign and request mistakes come up most often?

What can you start within a week?

1. Write the purpose of each group of cameras first, then draft the sign, following the order in clause 2.3.1.
2. Draft a first-layer sign with the four items from clause 2.3.2: that CCTV is in use, the main purpose, who is responsible, and where to read more.
3. Build the detailed notice that the sign points to, with the retention days matching what the recorder really does.
4. Name the person who receives requests and the approver, with deputies, and make a short request form asking for date, time, camera and how identity will be confirmed.
5. Agree how other people's faces will be masked (who does it and with what software) and how footage will be delivered securely.
6. Keep a register of requests and disclosures that covers both data-subject requests and requests from police or insurers.
7. Rehearse once with a made-up request, timing it from receipt to delivery, and check that it fits within 30 days and that the footage is not overwritten before you find it.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)