DPDP and CCTV: Are Camera Recordings Personal Data?

Published on 10/18/2026 • Updated on 10/22/2026

Most factories, offices and campuses run cameras at the gate, in the corridors and in the car park. The footage shows faces, vehicles and movements of employees, visitors and contractors. Does the Digital Personal Data Protection Act, 2023 apply to it?

In most cases, yes. This guide explains why, what the Act and the DPDP Rules, 2025 say that matters for CCTV, what to put on a sign, how long to keep footage and how to respond when someone asks for a clip. It is general information, not legal advice. Confirm your approach with your legal adviser.

Why camera recordings are usually personal data

The Act defines personal data as any data about an individual who is identifiable by or in relation to such data. A clear image of a face, or a vehicle number plate that can be tied to an owner, is data about an identifiable person. The Act applies to digital personal data, including data collected in non-digital form and then digitised. CCTV footage is digital from the start.

So the organisation that runs the cameras decides why and how the footage is processed, which makes it a Data Fiduciary for that footage. The duties in the Act and Rules follow from that.

The basis for recording

The Act allows processing for consent or for certain legitimate uses. A common reason for CCTV is security of premises and people. Whether that fits a legitimate use or needs notice and consent is a legal judgement for your adviser. What does not change is that you should be able to say, in writing, why each camera exists.

What notice to give

Where you rely on consent, Rule 3 expects a notice in plain language, with an itemised description of the data and the purpose, and a way to contact you. A sign at each entry is the simplest form for CCTV.

The 30 days in the sample is an assumption. Set your own period and write it into your policy. Employees need to be told separately, in their joining pack or by notice, because they pass the cameras every day.

Safeguards for footage

The highest penalty in the Act's Schedule, up to Rs 250 crore, applies to a failure to take reasonable security safeguards. Rule 6 sets out a minimum: access control, logs and monitoring, backups, encryption or masking where suitable, one year of log retention and suitable contract terms with processors.

• Keep the recorder in a locked room.
• Use named logins, not one shared password.
• Log who viewed or exported footage.
• If a vendor hosts footage, check the contract covers security.

A recorder with a default password on a network that anyone can reach is the kind of weakness regulators will treat as no safeguard at all.

How long to keep footage

The Act expects data to be erased once its purpose is served and the person withdraws consent, unless the law needs it kept. Rule 8 sets a minimum of one year for certain data and logs for specified purposes, so ask your adviser whether any of your footage falls in that group. For footage with no incident, a short fixed cycle, often thirty to ninety days, is typical practice. Pick the shortest period that meets your real need.

When an incident happens, copy the relevant clip to a protected folder and record why. The rest of the footage keeps its normal cycle.

When someone asks for a clip

Police requests are different. Ask for the request in writing and take legal advice before handing footage over.

Employees, contractors and workplace monitoring

Staff are watched for far longer than visitors, so their position needs more care. Tell employees which areas are covered, why, and who can view the footage. Do not use cameras to track toilet breaks or private conversations. If footage is later used for a disciplinary case, the employee should be told that it exists and be shown the relevant clip.

Contractors and gate staff from outside agencies are in the same position. Add a clause to the agency contract that states how footage showing their people is handled, and who answers requests.

Audio recording is a separate matter. Most plants have no real need for sound, and recording conversations raises further questions under other laws. If your cameras can record audio, switch it off unless your adviser agrees that there is a clear need.

Finally, limit who can view live feeds. A control room needs them, a reception desk usually does not. Fewer viewers means fewer ways for a clip to leak. Review the viewer list every quarter and remove people who have changed roles or left the company, since stale access is a common and avoidable gap.

A worked example for a plant

The example shows that the work is mostly paperwork and settings, not new equipment.

Common mistakes

Another mistake is pairing CCTV with facial recognition without a fresh review. Biometric matching raises the stakes, and our guide on biometric attendance covers that point.

A last mistake is forgetting that visitors and contractors are also watched. Your gate notice should speak to them as well as to employees.

A one-week camera audit

Check cameras before the commencement date.

Record the audit date and repeat it each year. Keep the one-page rule sheet next to the recorder so the next person on duty can follow it without calling anyone.

Five-minute self-check

Check your cameras against these points.

Two or more no answers mean this is worth fixing before anything else on your list.

Reader Q&A

Bottom line

CCTV footage is personal data in most cases, so the Act's duties apply. The work is practical: a purpose for each camera, a sign, locked storage, named logins, a retention period and a log of exports.

Do the audit once, write the rules on one page and review it every year.

Author of the Blog Post

Aadeshwar Modi

Technical Content Writer at VisitorFlow

Aadeshwar Modi is a marketing technical content writer who loves writing on technology and AI topics.