Table of Contents
- Why CCTV Storage Footage Is Personal Data Under Australian Law
- CCTV Footage Retention Period: How Long to Keep Recordings
- CCTV Data Security Best Practices for Stored Footage
- CCTV Footage Access Policy: Who Can View Recordings
- CCTV Privacy Policy Template: Essential Components
- Handling Access Requests, Disclosure, and Secure Deletion
- Frequently Asked Questions
Last Updated: October 10, 2026
Why CCTV Storage Footage Is Personal Data Under Australian Law
CCTV storage footage is personal data under the Privacy Act 1988 (Cth), and organisations must handle it carefully and legally.
A person’s face on camera meets the definition of personal data. Footage of customers, employees, or visitors is protected data and cannot be stored carelessly or shared without proper safeguards.
CCTV footage is personal data the moment it’s recorded. You must protect it with the same care you would protect customer names, addresses, or payment information.
CCTV Footage Retention Period: How Long to Keep Recordings
Retention periods depend on your purpose, industry, and applicable state or sector-specific requirements. The Privacy Act 1988 (Cth) requires data minimisation: identify your legitimate purpose first, then set a retention period that matches it.
Determining your retention period
Document why you record. Common purposes include:
- Incident investigation (theft, assault, property damage): 60-90 days is typical. This window allows time to detect a problem, review footage, and take action before old recordings are deleted.
- Compliance or audit (workplace safety, regulatory obligation): Check your industry rules. Aged care facilities, for example, may face different expectations than retail premises. If your industry regulator publishes guidance, follow it.
- Deterrence only (visible cameras to discourage crime): 30 days may suffice if you’re not actively investigating incidents.
- Legal hold or ongoing dispute: Retain footage for the duration of the dispute plus a reasonable buffer (typically 12 months after resolution).
Write a specific retention schedule: “We retain CCTV footage for 60 days to investigate security incidents. After 60 days, footage is automatically deleted.” Vague retention invites regulatory scrutiny.
Jurisdiction-specific considerations
Some sectors and states publish guidance:
- Workplace safety: Safe Work Australia and state-based work health and safety regulators may expect footage of incidents to be retained for the duration of any investigation and for a period afterward (often 12 months) in case of legal claims.
- Retail and hospitality: No universal rule, but 60-90 days is standard practice and defensible.
- Aged care and disability services: The Aged Care Quality Standards and National Disability Insurance Scheme Quality and Safeguards Commission may expect longer retention (up to 12 months) if footage relates to allegations of abuse or neglect.
- Financial services: If your CCTV is part of a broader compliance obligation (e.g., under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006), retain footage for at least 7 years if it relates to a transaction or customer interaction.
If you operate across multiple states or sectors, apply the longest retention period required and document which rules apply.
Creating a deletion schedule and checklist
Create a documented deletion schedule to ensure footage is actually deleted when retention periods expire:
| Recording date | Retention period | Deletion date | Status |
|---|---|---|---|
| 1 October 2026 | 60 days | 30 November 2026 | Deleted |
| 15 October 2026 | 60 days | 14 December 2026 | Pending |
For each deletion, follow this checklist:
- Confirm no active investigation or legal hold – Before deleting, check whether the footage relates to an ongoing incident, complaint, or legal dispute. If it does, extend retention until the matter is resolved.
- Verify deletion from all copies – Delete from your primary storage system, any local backups, and cloud storage. Ask your cloud provider in writing to confirm deletion.
- Use secure deletion – Do not simply remove the file from a folder. Use secure deletion software that overwrites the data multiple times, making recovery impossible. For cloud storage, confirm your provider uses secure deletion methods.
- Document the deletion – Record the date, time, footage range, and method of deletion. Keep this log for at least 12 months. It proves you comply with data minimisation if a regulator asks.
- Flag exceptions – If footage relates to an incident, legal hold, or regulatory request, document the reason and the new deletion date. Keep a separate log of exceptions.
Keeping footage longer than your documented retention period is a privacy breach under the Privacy Act, even if the footage is encrypted and secure. Regulators view excessive retention as a failure to minimise data. Conversely, deleting footage too early (before a legitimate investigation is complete) may breach your duty to investigate incidents properly. Your retention schedule must balance these obligations.
Handling retention during disputes or investigations
If an incident occurs, place a legal hold: document the incident, note the footage range, and extend retention until resolved. Once the investigation is complete, delete securely and document the deletion.
If law enforcement requests footage, retain it until the investigation concludes.
CCTV Data Security Best Practices for Stored Footage
Secure storage is the foundation of compliant CCTV systems. Protect recordings from unauthorised access, accidental loss, and theft.
Encryption and secure access
Encrypt all CCTV footage, whether stored locally or in the cloud. Without encryption, anyone with access to your storage device could view recordings.
Use strong passwords and change them regularly. Limit access to staff who genuinely need to review footage. Track all access to spot unauthorised viewing and prove proper control.
Consider multi-factor authentication. This requires users to provide two forms of identification (like a password plus a code sent to their phone) before viewing footage.
Storage location and backup
Local storage keeps footage under your physical control but creates a single point of failure: if the drive fails, you lose everything.
Cloud storage offers redundancy and automatic backup across multiple locations. If you operate a business in Bunbury or the surrounding region and need secure physical storage for equipment, servers, or backup drives, Business Storage in Bunbury can provide a climate-controlled, secure facility to complement your digital backup strategy.
Many organisations use both local storage for quick access and cloud backup for protection.
Test your backup and recovery process at least once a year. If your primary storage fails, can you actually restore footage from backup? Find out before you need it.
CCTV Footage Access Policy: Who Can View Recordings
Create a clear policy stating who can access CCTV footage and under what circumstances.
Book Online in 3 Minutes & Get 50% Off Instantly →
Name specific roles (e.g., security manager can access anytime; other staff need approval). Employees should know the policy exists to deter casual snooping.
Define legitimate reasons for access: investigating theft, reviewing safety incidents, or responding to legal requests.
Under the Privacy Act, people can request footage of themselves within 30 days.
CCTV Privacy Policy Template: Essential Components
Your privacy policy should explain how you collect, store, and use CCTV footage:
Purpose statement: Explain why you’re recording. “We record our premises to prevent theft and investigate incidents.”
Retention period: State how long you keep footage.
Access controls: Describe who can view footage and how. “Only authorised security staff can access recordings.
Data subject rights: Explain how people can request their own footage.
Security measures: Summarise your protections. “Footage is encrypted and stored securely.
Third-party sharing: State whether you share footage with anyone.
Contact information: Provide a way for people to ask questions.
Post this policy visibly near cameras or on your website.
Handling Access Requests, Disclosure, and Secure Deletion
CCTV footage may be requested by the person recorded, law enforcement, or other parties with a legal right. Each type requires a different response.
Data subject access requests
Step 1: Verify the request and the requester’s identity
When you receive a request, ask the person to provide:
- Full name and contact details
- Specific date(s) or time period they’re requesting footage for
- Location (which camera or area)
- Reason for the request (optional, but helpful for context)
Verify identity with a government-issued photo ID before releasing footage. Do not release based on email alone.
Step 2: Locate and review the footage
Locate the relevant recordings and review whether they contain images of other identifiable people.
Step 3: Redact third parties
Blur or pixelate faces and bodies of other identifiable people before providing the copy.
Book Online in 3 Minutes & Get 50% Off Instantly →
Step 4: Provide the footage securely
Do not email footage as an attachment. Instead:
- Use a secure file-sharing service (such as a password-protected cloud link or encrypted file transfer).
- Create a unique password for the download link.
- Send the link and password separately (e.g., link via email, password via SMS or phone call).
- Set an expiry date on the link (e.g., 7 days) so the file cannot be accessed indefinitely.
- Keep a record of what was provided, when, and to whom.
Step 5: Respond within 30 days
Respond within 30 days. If you need more time, contact the requester and explain the delay.
Create a template response letter that confirms receipt of the request, states your 30-day timeframe, and explains what information you need from the requester. This sets clear expectations and creates a paper trail.
Law enforcement and legal requests
Police or other law-enforcement agencies may request CCTV footage under a warrant, court order, or subpoena.
Verify the request
Before releasing footage to law enforcement, ask for a formal legal document:
- Warrant: A court order authorising police to obtain the footage. The warrant should name the investigation, describe the footage sought, and be signed by a magistrate or judge.
- Subpoena: A court order requiring you to produce footage as evidence in legal proceedings.
- Statutory request: Some legislation (e.g., the Crimes Act 1914 (Cth)) allows law enforcement to request information without a warrant in certain circumstances. Ask the officer to cite the specific power they’re relying on.
If the request is informal (without a warrant), you may ask the officer to provide a formal legal document. However, if there is an imminent threat to safety, you may provide footage voluntarily.
Decision tree for law-enforcement requests
- Is there a warrant, subpoena, or statutory power cited? If no, ask the officer to obtain one (unless there is imminent threat to safety).
- Does the warrant describe the footage sought (dates, times, locations)? If no, ask for clarification.
- Provide only the footage described in the warrant or order.
- Document the disclosure.
Do not redact third parties for law enforcement
You do not need to redact third-party faces in footage provided to law enforcement under a warrant or court order. However, provide only what is requested.
Documenting all disclosures
Create a disclosure log every time you release CCTV footage:
| Date | Requester | Type of request | Footage dates/times | Legal basis | Redactions | Delivery method | Confirmed receipt |
|---|---|---|---|---|---|---|---|
| 20 Oct 2026 | John Smith | Data subject access | 18 Oct, 10:00-11:00 | Privacy Act s.12CB | Third parties blurred | Secure link | 21 Oct |
| 22 Oct 2026 | Detective Jane Doe, NSW Police | Warrant | 18 Oct, 09:00-12:00 | Warrant #ABC123 | None | USB drive | 22 Oct |
Keep this log for at least 12 months to demonstrate you only release footage for legitimate reasons and follow a consistent process.
Secure deletion after disclosure
After providing footage to a requester, continue to apply your retention schedule. When the retention period expires, delete your copy securely.
If you’ve provided footage to law enforcement or in response to a legal hold, do not delete it until the investigation or legal matter is concluded and any appeal period has expired.
Sharing CCTV footage without a legal basis (e.g., giving it to a third party without the data subject’s consent or a warrant) is a breach of the Privacy Act. Even if the footage is encrypted, unauthorised disclosure is a serious violation. Always verify the requester’s identity and legal right before releasing footage.
Frequently Asked Questions
How long should CCTV storage footage be kept?
Retention depends on your organisation’s purpose and legal obligations. For incident investigation, 30-90 days is typical. Longer retention (up to 12 months) may apply if you have a documented business need and lawful basis. Australian Privacy Principles require you to keep CCTV storage footage only as long as necessary for the stated purpose. Document your retention schedule and delete footage systematically once it expires.
What should a CCTV privacy policy include?
Your CCTV privacy policy template must state: the purpose of recording (security, incident investigation), the lawful basis (consent, legitimate interest), who has access, how long footage is retained, where it’s stored, security measures, and how people can request access or complain. Include notice at camera locations so individuals know they’re being recorded. Review it annually and update it if your storage methods or access controls change.
Who can access stored CCTV footage?
Only authorised personnel should access CCTV storage footage. Define roles clearly: security staff, management, law enforcement (with warrant or court order). Implement access controls so each person can only view footage relevant to their role. Log all access attempts, including who viewed what and when. Restrict access to prevent unauthorised viewing, which could breach privacy and trigger a data breach response.
How can a business securely delete CCTV footage?
Use a documented deletion checklist aligned to your retention schedule. Overwrite data physically (degaussing or destruction) or use secure deletion software that removes files beyond recovery. For cloud storage, confirm the provider permanently removes your footage when you request deletion. Record deletion dates and methods for compliance audits. Never simply delete files from a folder; ensure the underlying data is unrecoverable.