In this paper, I argue that careful attention needs to be paid to the handling of urban CCTV digital data. Since the early 1990s, CCTV has left an indelible mark on UK cities, and beyond. CCTV is a crime-reduction strategy, and its activation owes much to the laws and regulations that govern its function and the passivity with which it is often viewed. I consider the nature of security when CCTV signs, recorded images and the rights of citizens are interlinked in controlled urban spaces. Despite the regulatory powers of the Data Protection Act, the management of CCTV data is at times poorly operationalised and often obfuscated. The paper discusses my experiences of identifying 17 different CCTV cameras and being recorded, and my attempts to access my images through subject access requests (SARs). In what follows, I draw on different topologies of experience in expanding upon the mutable, unpredictable and intensive relations that guide the management of CCTV data.