Disclosure of surveillance footage should have a lawful basis and be documented. The correct approach depends on the privacy law, the request and the circumstances.
At a glance
- Privacy guidance says disclosures outside the organization should be justified and documented.
- Organizations should know who is requesting the footage and for what purpose.
- Public-sector and private-sector privacy rules are not identical, so the applicable law matters.
What this means in practice
The official rules establish a baseline, but a workable security assignment still needs property-specific decisions. The client and provider should turn general requirements into clear instructions about what is checked, who can authorize exceptions, what must be documented and when another authority takes over.
Questions to confirm
- Is the request voluntary, legally compelled or part of an emergency?
- Who approved the disclosure?
- What portion of the footage is actually relevant?
Picture this at your property
Police ask a property manager for footage after a nearby incident. The organization should use its approved process, document the request and disclose only as authorized by the applicable rules.
The value of the example is the decision process: identify what is known, what remains uncertain, who has authority, and what information should be preserved for follow-up.
Practical takeaway
The strongest security process is usually the one that makes responsibilities, observations and escalation clear. That creates a service that can be understood and reviewed without overstating what security can guarantee.
Official sources & verification
1. Guidelines for Overt Video Surveillance in the Private Sector — Office of the Privacy Commissioner of Canada
2. Privacy Guide for Businesses — Office of the Privacy Commissioner of Canada
3. Guidelines for the Use of Video Surveillance — Information and Privacy Commissioner of Ontario
Last reviewed: 2026-08-08. This resource provides general information and is not privacy or legal advice. Privacy obligations depend on the organization, activity and applicable law. Confirm current requirements with the appropriate privacy regulator or qualified legal counsel.