CCTV at a small business: plan the digital data trail

A camera is only the first part of a CCTV system. Footage may sit on a recorder, be available through an app, appear on a shop monitor and leave as a clip in a staff message. A privacy assessment that stops at the camera’s position misses much of the digital trail.

Before installing or expanding CCTV, write down the specific problem the camera is intended to address. Then map what it captures, where the recording goes and who can use it. The result should guide the configuration, rather than merely describe it afterwards.

Check scope and the processing route

Images that identify a person, directly or through their context, can be personal data under section 2(t). The future scope provision in section 3 covers digital personal data processed in India, among its other provisions. A small business should not assume that recorded video falls outside the framework because it is not a customer spreadsheet.

As of 22 October 2026, the relevant substantive duties are scheduled for 13 May 2027 under the commencement notification. Existing obligations must still be assessed. For the coming framework, examine the actual processing route under sections 4 to 7; there is no general DPDP legitimate-interest ground that can simply be imported from another regime.

A sign can explain that recording occurs, but it does not by itself settle the legal basis or make every form of consent valid. Do not assume that walking through a doorway necessarily supplies the specific consent or voluntary-provision conditions your assessment requires. Difficult cases need a reasoned review of the actual use.

Design the field of view around the purpose

Ask whether the camera needs to capture the entire area or a narrower entrance, stock zone or transaction point. Avoid recording unrelated private spaces or neighbouring premises merely because the device can see them. Review additional functions, such as audio or analytics, separately from ordinary video recording.

The purpose should also shape access. A person who needs to check a stock incident may not need continuous remote access to every camera. Keep a record of authorised accounts, remove unused access and protect the recording system. The future rule 6 safeguards will be relevant to those controls.

Where children are likely to be recorded or a system adds tracking features, assess the additional section 9 framework and its applicable conditions carefully. Do not infer a blanket exemption from the fact that the camera is used for safety.

A hypothetical convenience-store review

A convenience-store owner wants to understand repeated damage near a stock entrance. The first proposed camera view includes the entrance, a neighbouring home’s doorway and a staff rest area. The owner narrows the field of view to the relevant entrance and checks the result in both day and evening conditions.

Only the owner and a designated manager can review recordings. The public-facing monitor does not display unnecessary private areas. When a particular clip is needed for an incident, the manager records why it was exported, where the copy is stored and who received it through the approved process.

The review also identifies an installer account that still has remote access. The owner checks whether that access is needed and closes or restricts it accordingly. The useful finding comes from mapping the system, not from adding a larger sign.

Give exports their own control

A clip copied to a phone or sent through a messaging channel can escape the recorder’s deletion settings. Make exports exceptional, authorised and traceable. Share only the relevant interval and assess whether unrelated people or details can be excluded without defeating the legitimate purpose of the disclosure.

Do not distribute a clip publicly simply because an incident is frustrating. Consider the purpose, appropriate recipient and applicable legal process. A business’s internal security reason does not automatically justify broad publication.

Set retention with the right qualifications

Do not choose a CCTV retention period from a generic recommendation. Under the future section 8(7), erasure is subject to legal retention. In particular, rule 8(3) and the Seventh Schedule will require covered personal data, associated traffic data and processing logs to be retained for at least one year from processing for the specified Schedule purposes. Further retention may be required by other law or a government notification. Map those requirements to the actual recording and any applicable exception before setting deletion. Required retention does not authorise unrelated viewing, analytics or publication.

Document both ordinary recording retention and the treatment of clips preserved for a specific matter. Restrict retained material to the justified purpose, and review it when that matter changes.

Finally, test the configuration rather than relying on the settings page. Check access removal, recording availability and the treatment of an exported test clip. A manageable CCTV policy follows the actual footage throughout its life.