CCTV under the DPDP Act: notice, purpose, retention and access

A hotel lobby, a jewellery showroom, an office reception and a school corridor have one thing in common: a camera that never stops recording. Most organisations installed CCTV for security years ago and have not thought about it since. From 13 May 2027, that footage sits under the same rules as any other personal data, and it raises questions that a consent form never will.

This guide walks through those questions. The Act does not mention CCTV, and the Data Protection Board has issued no guidance on it, so parts of this are about choosing a defensible position and recording why.

Footage is personal data

A recording from which a person can be identified, directly or with other information such as a visitor log, a bill or an access-card record, is personal data. Modern CCTV records digitally, so the Act applies under Section 3. There is no separate “biometric” or “sensitive” category in the Act; a face in footage is personal data like any other, though its nature matters when the Board weighs a breach.

The organisation that decides why cameras are installed and how footage is used is the Data Fiduciary. The security agency, the company that maintains the recorder and any cloud service that stores footage are usually Data Processors, acting under your instructions.

One exclusion matters. Cameras at your own home for purely personal or domestic purposes are outside the Act (Section 3(c)(i)). A shop, hotel, office, school or housing society’s shared cameras are not “purely domestic”, and should be treated as covered.

Choosing the ground for recording

Section 4 allows processing for a lawful purpose and only on consent or a legitimate use under Section 7. There is no “legitimate interest” ground, which is the one most foreign CCTV policies rely on. That leaves fewer options than people expect.

Who is on camera	Possible ground	What to watch
Employees	Section 7(i): employment purposes, including protecting the employer from loss or liability	Covers security of premises and assets; does not stretch to using footage for publicity or unrelated performance monitoring
Visitors, guests, customers	Consent, given with a notice	Whether walking past a sign is a “clear affirmative action” under Section 6(1) is uncertain; take advice
Enrolled children in schools, creches and child transport	Verifiable parental consent under Section 9, or the Fourth Schedule exemption for the safety of enrolled children, to the extent needed	The exemption is for safety; it does not cover sharing clips with parents’ groups or social media
Anyone, for police or court requests	Section 7(d) and 7(e): legal obligation to disclose to the State, or a court judgment or order	Disclose only what is asked for, and record it

For visitors, the honest position is that the Act gives no ground made for CCTV. Many organisations will rely on a clear notice at entry with consent built into the visit (a check-in form, a registration page, a booking confirmation) and keep camera coverage to the areas that need it. Others will look for a legitimate use that fits their facts. Write down which you chose and why, because Section 6(10) puts the burden of proving notice and consent on you.

Notice that actually works

The Section 5 notice must accompany or precede a consent request, and Rule 3 expects it to be standalone and understandable on its own, with an itemised description of the data and specified purposes, and a way to withdraw consent, exercise rights and complain to the Board. A sticker with a camera icon does not do that alone.

A layered approach works for most premises:

Sample wording, adapt with counsel

CCTV in operation. [Organisation name] records video in this lobby, the entrances and the car park for the safety of guests and staff and to protect property. Footage is kept for [number] days unless needed for an incident. Scan the code or visit [web address] for the full notice, how to ask about footage of you, and how to raise a grievance. Contact: [name or role, phone, email].

The full notice online should list the camera areas, the purposes, the retention rule, who can view footage, which vendors process it, and how a person can raise a grievance under Section 13. Offer it in English and the main local language under Section 5(3).

Limit who sees footage

Section 8(5) requires reasonable security safeguards, and Rule 6 lists what that means in practice: access control, logs and monitoring of access, backups, keeping those logs for at least one year, and security terms in processor contracts. For CCTV, that translates to:

• Named people with live-view and playback rights, not a shared password on the recorder.
• A log of every playback and every export, with the reason.
• Exports only to an encrypted drive or a secure link, never to a personal phone or a WhatsApp group.
• A written contract with the security agency, the maintenance company and any cloud recorder service under Section 8(2), covering security, confidentiality, breach reporting and erasure.

The Schedule’s highest maximum, up to ₹250 crore, applies to failing to take reasonable security safeguards. It is a ceiling the Board decides after an inquiry, considering factors such as gravity and mitigation, not an amount per camera or per person.

Retention and erasure

The Act sets no CCTV retention period. Section 8(7) requires erasure once the specified purpose is no longer served, unless another law requires you to keep it. The Third Schedule’s fixed periods apply only to specified classes of large platforms, not to premises CCTV. So:

• Set a default overwrite cycle that matches the purpose, and document why that length.
• When an incident occurs, export only the relevant clip, tag it to the incident, and delete it when the matter closes.
• Make sure the vendor’s cloud copy follows the same rule.

Children and face recognition

Schools, creches and child transport operators can rely on the Fourth Schedule exemption for the safety of enrolled children only to the extent needed. Section 9(3) bars tracking and behavioural monitoring of children; analytics that follow a child across cameras or score behaviour raise exactly that question. Adding face recognition to CCTV, for anyone and especially for children, needs specialist advice before it is switched on. For schools, see our guide for schools and education.

When footage leaks

A clip from your recorder shared on social media, or a recorder left reachable on the internet, can be a personal data breach. Section 8(6) and Rule 7 require you to inform the Board and each affected person without delay, and to send the Board a detailed report within 72 hours. Have the steps written down before you need them.

A CCTV checklist

1. List every camera, what it covers, and why.
2. Record the ground for each group on camera: employees, visitors, children.
3. Put up layered signage with a link to a full notice.
4. Name who can view and export, and switch on access logs.
5. Sign processor contracts with every CCTV vendor.
6. Set and document a retention rule; check the cloud copy follows it.
7. Write the breach and police-request procedures.
8. Never reuse security footage for marketing. For that, see CCTV footage on LinkedIn.

Where the edges are

Three questions are genuinely open. Whether a visitor’s entry after seeing a sign amounts to valid consent; how a person’s request for a copy of footage of them sits with Section 11, which gives a right to a summary rather than a copy; and how CCTV that another law or a licence condition expects you to run fits Section 4. Take advice on each for your premises. For hotels and venues, our hospitality guide covers the rest of the guest journey, and retail and brands covers stores.

Getting ready

Start with the camera list and the retention rule; they are the two things most organisations cannot produce today. If you want help mapping CCTV alongside your other photos and video, book a readiness call.