CCTV and India's DPDP Act: what installers and their customers should know

CamVerion team · 7 November 2026 · 8 min read

A camera that can identify a person is collecting personal data, at least in the ordinary sense of the term. With India's Digital Personal Data Protection Act, 2023 (DPDP Act) and its Rules now moving towards full effect, customers are starting to ask their installers what it means for CCTV.

Here is the difficulty. The Act and Rules are written for digital personal data generally, and we have not found CCTV-specific guidance on how they apply to everyday footage. Anyone giving you a confident, detailed answer should be able to show where it comes from. This guide sets out what is known, what is unclear and what sensible practice looks like in the meantime. It is general information, not legal advice.

The legal framework in brief

The DPDP Act, 2023 sets rules for processing digital personal data in India. The DPDP Rules were notified in November 2025, and their provisions are being brought in over a phased period. A few rules applied straight away, the rule on consent managers follows after one year, and most of the duties that matter for CCTV, including notice (Rule 3), security, retention (Rule 8) and individuals' rights, apply 18 months after publication, around May 2027. Check the current position in the official notifications, as dates matter here.

Key terms in the Act include:

Personal data: data about an individual who is identifiable by or in relation to that data.
Data Principal: the individual to whom the data relates.
Data Fiduciary: the person or body that determines the purpose and means of processing.
Data Processor: one who processes data on behalf of a Data Fiduciary.

The Act imposes duties on Data Fiduciaries, such as giving notice, keeping data secure, reporting breaches and deleting data when it is no longer needed, subject to the details in the Act and Rules. It also provides for substantial penalties, and it sets up a Data Protection Board.

Is CCTV footage personal data?

Digital footage in which a person can be identified seems to fit the plain words of "personal data". Most commentary treats it that way, at least when the footage is stored digitally, as nearly all modern recording is. But how each duty applies in a typical shop, office or housing society remains unsettled. There are also exemptions and "certain legitimate uses" in the Act that may apply in some situations. A lawyer can help a customer work out which one fits.

Also note that the Act has an exemption for personal data processed for personal or domestic purposes. A camera at someone's own home may therefore be treated differently from a camera at a business, although the facts may matter.

Who is responsible: the installer or the customer?

In most cases, the customer decides why the cameras exist, where they point and how long footage is kept. That makes the customer look like the party with Data Fiduciary responsibilities.

Your position as an installer depends on what you actually do:

You install the system and hand it over, with no access afterwards. You are probably not processing footage in any ongoing way.
You keep remote access for maintenance. You might be able to see footage, so you may be handling personal data on the customer's behalf.
You host recordings or provide a monitored service. You are clearly more involved, and you should get proper advice and contracts.

Whatever the label, it is the facts that count. So it is worth knowing exactly who can reach what.

Practical steps for customers

These are sensible good practices even where the law's exact application is unclear. You can offer them as advice during a survey or handover. Encourage customers to take legal advice for anything important.

Be clear about the purpose

Write down why the cameras exist, such as security of premises or protection of staff. Use footage for that purpose. If they later want to use cameras to monitor staff productivity, they should consider that separately.

Tell people

Put up clear signs at entrances and in monitored areas. A good sign says that CCTV is in operation, who operates it, why, and who to contact. Rule 3 of the DPDP Rules deals with notice given by Data Fiduciaries, so a customer's lawyer can advise on whether a sign alone is enough for their situation.

Point cameras carefully

Do not cover toilets, changing rooms or other private spaces.
Avoid neighbours' windows and private property.
Limit coverage of public areas to what the purpose requires.
Use privacy masks where a view can't otherwise be avoided.

Think twice about audio

Many cameras include microphones. Recording conversations raises additional concerns beyond video, including the possibility of intercepting private conversations. Unless there is a specific reason and legal advice, a good default is to leave audio off.

Set a retention period

Keep footage for as long as you need it, not as long as the disk allows. Rule 8 of the DPDP Rules addresses retention, and the Rules set specific periods for some kinds of business, so a customer may need advice on how those apply. In some settings, a law or regulator could also require a minimum period, so check for sector-specific rules. Record the decision and the reason.

Control access

Give individual logins, not one shared password.
Limit who can view, and particularly who can export.
Keep the recorder physically secure.
Remove access promptly when somebody leaves.
Keep logs where the system supports them.

Manage requests and incidents

Decide who handles requests for footage. Police, a customer involved in an incident or an employee might each ask, and each is different. Record who asked, why, what was given and who approved it. Have a plan for what to do if footage leaks or a recorder is stolen, because the Act provides for breach notification.

Practical steps for installers

Your work has a direct effect on how safe these systems are, and how your customers can meet their duties.

Build privacy into the survey

Ask whether any planned view takes in a sensitive space, and record the answer. Our site survey checklist includes this check.

Configure with privacy and security in mind

Change default passwords, with a unique strong password per site.
Set privacy masks where needed.
Turn audio off unless the customer has decided otherwise.
Keep firmware up to date.
Keep cameras off the open internet, and use secure remote access.
Set up a retention period based on the customer's decision.

See our commissioning and handover checklist for more detail.

Control your own access

If your company needs remote access for support:

agree on it in writing
use named logins for your staff, rather than a shared one
use access only for support work
remove access when the contract ends
remove staff access when they leave your company

Never keep a customer's footage on a technician's phone or laptop. If you have to export a clip while troubleshooting, delete it afterwards and note what happened.

Check your contract

A maintenance contract should say what access you have, what you may do with any data you see, how you keep it secure, and how you will tell the customer of a problem. Ask a lawyer to review your template, particularly if you host footage for customers.

Take care with job photos

Technicians often photograph screens and rooms as proof of work. Those photos may show people or private spaces, so keep them in your business system rather than in personal chats, and don't use them in marketing without permission.

What about your own staff and customer data?

Your own business collects personal data too: leads, customer contact details, employee records, attendance and location. Consider the same questions for your own company. What do you collect? Why? Who can see it? How long do you keep it? When choosing software, check who can access data, where it is hosted and how it is deleted. Our own approach is in our privacy policy.

What we do not know yet

It is better to be open about this. These questions don't appear to have settled answers yet in the material we reviewed:

how notice should work for passers-by and visitors filmed by CCTV
which "legitimate use" fits common business CCTV in specific situations
how a Data Principal's request for access or erasure applies to footage involving other people
what retention period would be accepted as reasonable for each sector

Guidance from the Data Protection Board, or later decisions, may answer some of these. Until then, be careful about making firm statements to customers.

How to talk to customers about this

Most customers want a simple, trustworthy conversation. You might say:

"We can set the system up to support your privacy obligations, including careful camera positioning, access controls and a retention period you choose. We can't give you legal advice, so please check the specifics with your advisor, especially on signs and retention."

You can also turn this into a real service. A simple handover note covering purpose, retention, access and signs is helpful and sets you apart from installers who never raise the subject. Just don't market your work as "DPDP compliant", since compliance depends on how the customer operates the system over time.