Which rules on the use and handover of security data should be agreed in advance?

Video images, event logs and count values can be important during an operation and in later evaluation. However, the fact that a service provider technically provides this data does not settle who may access it, export it or continue to use it after the contract ends. These questions belong before commissioning.

Distinguishing types of data, purposes and roles

The first step is to determine which data is actually generated and stored. A live image is not a recording; a genuinely anonymous total count has to be treated differently from a movement log relating to individuals. For video devices, the European Data Protection Board explains that whether data relates to identifiable persons is decisive for the application of the GDPR [1].

For personal data, the purpose of processing, the legal basis and the actual roles need to be clarified. Commissioning a service provider does not automatically make it a processor. The GDPR distinguishes in particular between controllers, joint controllers and processors [2].

Describing access and export in concrete terms

A specification should record which functions need which information: who may view live images, who may retrieve recordings and who may approve an export? Contractually agreed access does not replace lawfulness under data protection law.

For planned exports, the scope of data, file format, time reference, delivery deadline and possible additional costs should be specified. It should also be clarified whether the client can evaluate the data with its own tools. Screen access alone does not guarantee a usable handover.

Passing video recordings on to third parties needs to be assessed separately. The European Data Protection Board stresses that disclosure is a processing operation in its own right and requires a legal basis [1].

Planning retention and the end of the contract

Retention periods must match the respective purpose. Personal data may not be kept indefinitely simply because it might be used later. For processing on behalf of a controller, Article 28 GDPR requires a contractual provision on deletion or return, at the choice of the controller, after the end of the service; statutory retention obligations still apply [2].

In practice, the time of handover, secure transmission, revocation of access and the handling of remaining copies should be agreed. Where evidence has to be preserved, a separate, legally reviewed procedure is needed. For data that does not relate to individuals, contractual rights of use and confidentiality remain relevant.

What matters are concrete agreements on which data must be accessible and usable for which purpose. This turns technical availability into a service that can be planned.

Read more: How can security offers be compared by what they deliver? on comparing offers, Which security decisions should be settled before requesting quotations? on preparing procurement and Who needs which situational information during an operation? on planning recipients and access.

Context: research as of 2 November 2026; the sources are taken from the author’s references and have not been checked against the original texts by the editors. The notes on file formats, deadlines, costs and handover procedures are editorial procurement recommendations. No general “ownership” of data is derived from this; the right to data portability under Article 20 GDPR belongs to data subjects and is not a general export entitlement of the client. Roles, legal bases and preservation of evidence have to be assessed in each individual case. No export functions or handover deadlines of MOVETOS OPS are promised here. General guidance, not legal or data protection advice.