The footage you forgot about: wiping cards, GDPR and personal data

Ask most people where their organisation’s personal data lives and they’ll point at a database or a filing cabinet. They rarely point at the drawer full of old memory cards. But a card that once sat in a CCTV recorder, a dashcam or a body camera has held images of identifiable people — and under UK GDPR, that’s personal data, wherever it ends up.

Dispose of that card with the footage still recoverable, and you haven’t just been untidy. You’ve had a data breach.

Footage is personal data — and it hides

Video of identifiable individuals is personal data under UK GDPR, and it carries real obligations: you have to keep it secure, and you have to dispose of it in a way that actually removes it. The catch is that footage lingers in places a quick delete never reaches.

• A format doesn’t erase it. Formatting rewrites the index, not the data. The footage is still there for anyone with recovery software.
• Flash hides data from overwrites. Memory cards quietly retire worn blocks with your data still inside them. An overwrite can’t reach those retired blocks — but chip-off forensics can.
• Cards travel. A card that leaves a vehicle or a site, or gets sold on, takes whatever it still holds with it.

What “properly” looks like

The standard the industry works to is NIST SP 800-88. For flash media the level that matters is Purge — the card’s own controller securely erasing every block, spares and retired blocks included, reaching the places an overwrite can’t. Then a read-back to prove it’s gone.

And crucially: a certificate. Certified erasure isn’t paperwork for its own sake — it’s your evidence that you disposed of personal data compliantly. If a question is ever asked, the certificate is the answer.

How we help

This is the heart of what we do.

• We wipe and certify. Cards come in, get erased to the right standard, and leave with a certificate — proof, not a promise, that the personal data is gone.
• We take the problem off your hands. We can buy your used cards, wipe them to standard, and give them a certified second life through our resale service — so retired media becomes value recovered instead of a breach waiting to happen. That service is spinning up now; get in touch and we’ll look after it directly while we build it out.

If you get through cards that have recorded people — dashcam fleets, CCTV estates, bodycam programmes — this is worth a conversation before the next batch goes in the bin.