Some Places are just storing for 7-10 days depending on size of their HDD or the amount of camera's on the system, in most cases the less time stored the greater the quality of the images, better frame rate ect capturing better images ..instead of the one second they are in view the next the are halfway out of the venue" you know what I mean" unless your venue as mega money and as the best of the best.
Most people will raise an issue with the venue/Shopping mall etc within a few days, so the chance is greater of getting images before they are over written.
Any good CCTV set up will have data subject access forms all set up for the venues they are in place with. And as others have said sometimes an admin fee is charged for the time taken to search etc and copy to disc etc. Template letters should be in place. Ie we were unable to find any images of you at said time and place, if you are un happy with thes finding please re contact us... etc. All this should be done within the 40 days of the CCTV owners receiving the request for images, and again this should be logged, the idea of the logs is should someone complain you can provide evidence that you have followed yur COP and complied with the ICO CCTV COP also.
There is a case that exist of the Car phone wherehouse, that did not follow the COP, they did not provide or acknowledge data request sent in by people and have been done by the ICO. So some of the Set up out ther will get done if they don't follow the COP but there are many others out there that don't and still get away with it !!
Lets remember that these Camera's are there to protect us aswell as the customers, so having an upto date and accurate system in place will be the best for all concerned.
Basha72