“The video stays on site” can be true of the main recording while clips, thumbnails or incident notes travel elsewhere. Map the record types separately.
The idea in view · Planning diagram
Different information can follow different routes
- Local recording
- Event clip
- Review notes
- Remote access
- Authorized export
- Lifecycle owner
Follow each record type
Video, event metadata, contact details and incident notes may follow different paths. Ask the provider to describe the proposed architecture rather than assuming all records stay on the recorder or all records move to the cloud.
Record the decision owners
For each path, identify the organization operating it, authorized users and purpose. Keep technical secrets outside the worksheet. A storage country alone does not describe where reviewers or support staff can access the record.
Resolve unknowns before approval
Mark uncertain destinations and access roles explicitly. Have privacy and IT owners review the resulting map against contract terms. Revisit it when a subprocessor, integration or export workflow changes.
Draw the smallest map that answers the decisions
Use one path per record type: capture, transmission, review, storage, export and deletion. Name the organizations or role groups responsible at each stage. A simple diagram with a marked unknown is better than a polished architecture picture that quietly assumes the missing party or location.
Review the map with IT and the privacy owner against the proposed contract. Ask how configuration changes are communicated, particularly a new receiving system or support arrangement. Keep credentials and detailed internal addresses in the restricted technical record. The planning map needs to explain responsibility and movement, not grant access to the system.
Map information categories, not just the video stream
A monitoring data-flow map should show what moves, from where, to which system or organization and for what purpose. Ordinary recording is one category. Event clips, snapshots, thumbnails, review notes, contact records and exports may follow different routes. A single arrow labeled CCTV can hide the copies and responsibilities that matter most to the review.
Use a practical level of detail. Name the system or role and the information category without publishing addresses, credentials or private footage links in a general diagram. The map should let the responsible technical, operating and governance owners discuss the same flow. Detailed configurations can remain in restricted references maintained by the authorized administrator.
Include access as well as storage
Information can be accessed remotely without every recording being permanently copied to the same place. Conversely, a service that retains only selected event material still creates a downstream record. Distinguish access, transmission, storage and export rather than treating them as one operation. Ask the provider and system owner to confirm the actual architecture.
Record who controls each step, who can retrieve or disclose material and which retention decision applies. Avoid assuming the buyer, installer, cloud service and monitoring provider have identical roles or obligations. Those relationships require assessment for the actual arrangement. The planning map supplies facts; it does not decide the legal classification of every party from a product name alone.
Use the map to review change and exit
A new integration, incident platform or remote support tool can add a route that the original procurement did not describe. Check the map when those changes are proposed. Identify the purpose, approved recipients, permissions and deletion or return process before activating the route. The fact that a tool is technically convenient does not establish that its use has been approved.
At exit, follow the relevant flows to identify accounts and records that need action. Removing a camera account may not remove incident attachments retained in another system. Equally, ending remote access does not necessarily delete local recordings the business continues to need. Keep the technical action and record-handling decision separate, with an owner and verification for each.
Reference context: ICO: surveillance data protection principles
A fictional map with an overlooked thumbnail path
A business believes the monitoring arrangement involves only live viewing from its recorder. During a review, the team identifies event thumbnails stored with incident notifications and occasional authorized exports for follow-up. Those records are not the same as continuous recording, but they still need an identified purpose, access and lifecycle.
The team adds the paths, confirms the relevant system owners and checks the approved retention and access arrangements. The map now distinguishes local recording, remote review and incident records. It does not claim that the architecture is unlawful or compliant simply because a new arrow was drawn. It gives the responsible people the facts needed to make and verify the actual decisions.
Make the call
Which path is still unclear?
| Situation | Decision to make | What to ask for |
|---|---|---|
| Main recordings stay on the NVR | Whether event clips leave it | A separate event-data path |
| The storage country is known | Where people access the record | Reviewer and support-access locations |
| A new integration receives incident notes | Which fields it needs | An approved purpose and minimum data set |
Before you move on
- List video, metadata and incident record paths.
- Identify storage and access locations separately.
- Resolve unknowns with the responsible provider and privacy team.
A worksheet you can actually use
Start with the blank sheet. Add one row per item, assign an owner and mark anything unresolved as pending. The completed example shows the level of detail to aim for.
Keep completed security plans private. Use aliases; keep passwords, access codes, personal contacts and footage links in your approved systems.
How to fill the worksheet
- Record type
- Name the information category, distinguishing ordinary video, event clips, thumbnails, review notes and authorized exports where relevant.
- Origin
- Identify the source system or role at a useful level without distributing detailed camera-access information unnecessarily.
- Destination
- Record which system or organization receives or accesses the category, not just the provider's marketing headquarters.
- Purpose
- State why this flow exists so technical convenience does not silently become an approved new use.
- Storage location
- Record confirmed storage facts and mark uncertain locations pending instead of inferring them from a general cloud label.
- Access location
- Distinguish where authorized access occurs from where material is stored; the two facts need not be identical.
- Owner
- Assign the party that confirms the flow and the relevant access, retention or exit responsibility for the actual arrangement.
A worked example
Fictional map: video stays on a local NVR while an event clip goes to a review service. The buyer asks separately where clips are stored and where reviewers access them.
| Record type | Origin | Destination | Purpose | Storage location | Access location | Owner |
|---|---|---|---|---|---|---|
| Event clip | NVR-A | Proposed review service | Incident review | To confirm | To confirm | Privacy lead |
Questions readers bring to this task
What else should you know?
Does live viewing count if nothing is recorded remotely?
For identifiable people, live processing still raises privacy questions. Ask the responsible privacy owner to assess the actual operation under applicable rules. Do not describe a live-only path as outside governance simply because it creates no permanent remote recording.
Link to this answer ↗Does a data-flow map need every network port?
Not for a general governance and operating review. It should identify information categories, systems, organizations, purposes and lifecycle responsibilities. The authorized technical owner can maintain detailed network rules in a controlled reference linked to the map.
Link to this answer ↗Is remote access the same as storing video abroad?
Not necessarily. Access, transmission and storage are different facts that need to be established for the actual design. Jurisdictional implications require appropriate review. Do not infer where all information is held from a provider's marketing address or a general cloud label.
Link to this answer ↗Who should confirm the map?
The site and system owners, provider and relevant governance reviewer should confirm the parts they control or understand. Keep unknown flows visible with an owner. A diagram prepared by one person without checking the architecture should remain a draft rather than evidence of the final arrangement.
Link to this answer ↗Notes & sources
This map does not establish compliance or confirm NightMarshal infrastructure, residency or subprocessors. Those facts require a specific written service design.
Reviewed October 27, 2026. The examples and worksheets are planning aids, not customer results or a statement of contracted service.
- ICO: surveillance data protection principles
UK surveillance guidance on purpose, retention, secure access and transparency. Guidance is under review; check it when making a decision.
- ICO: international transfer obligations
UK international transfer review context. Obtain advice for the actual organizations and countries involved.