The footage you forgot about: wiping cards, GDPR and personal data

Ask most people where their organisation’s personal data lives and they’ll point at a database or a filing cabinet. They rarely point at the drawer full of old memory cards. But a card that once sat in a CCTV recorder, a dashcam or a body camera has held images of identifiable people, and under UK GDPR, that’s personal data, wherever it ends up.

Dispose of that card with the footage still recoverable, and you haven’t just been untidy. You’ve had a data breach.

Footage is personal data, and it hides

Video of identifiable individuals is personal data under UK GDPR, and it carries real obligations: you have to keep it secure, and you have to dispose of it in a way that actually removes it. The catch is that footage lingers in places a quick delete never reaches.

• A format doesn’t erase it. Formatting rewrites the index, not the data. The footage is still there for anyone with recovery software.
• Flash hides data from overwrites. Memory cards quietly retire worn blocks with your data still inside them. An overwrite can’t reach those retired blocks, but chip-off forensics can.
• Cards travel. A card that leaves a vehicle or a site, or gets sold on, takes whatever it still holds with it.

What “properly” looks like

The standard the industry works to is NIST SP 800-88. For flash media the level that matters is Purge, the card’s own controller securely erasing every block, spares and retired blocks included, reaching the places an overwrite can’t. Then a read-back to prove it’s gone.

And crucially: a certificate. Certified erasure isn’t paperwork for its own sake, it’s your evidence that you disposed of personal data compliantly. If a question is ever asked, the certificate is the answer.

How we help

This is the heart of what we do.

• We wipe and certify. Cards come in, get erased to the right standard, and leave with a certificate, proof, not a promise, that the personal data is gone.
• We take the problem off your hands. We can buy your used cards, wipe them to standard, and give them a certified second life through our resale service, so retired media becomes value recovered instead of a breach waiting to happen. That service is spinning up now; get in touch and we’ll look after it directly while we build it out.

If you get through cards that have recorded people, dashcam fleets, CCTV estates, bodycam programmes, this is worth a conversation before the next batch goes in the bin.