Data Privacy and CCTV: What Indian Regulations Actually Require

Video footage that can identify an individual is personal data under India's evolving data protection framework, which means businesses operating CCTV systems have real obligations around how that footage is collected, stored, secured and eventually deleted — not just a security decision, but a compliance one.

Reasonable security measures to prevent unauthorised access to footage (access controls, not leaving systems on default credentials), a defined retention period rather than storing footage indefinitely without purpose, and clear signage informing people they're under surveillance are all practical steps that align with both good practice and emerging regulatory expectations.

Access controls, retention policies and audit logging are far easier to build into a system's design from the start than to retrofit after the fact — a business installing or upgrading CCTV today is well served by considering these requirements during the design phase, not treating them as a separate compliance exercise to handle later.