CCTV Rules in India: A Plain-English Overview for Businesses

There is no single CCTV law

India does not have one law that covers CCTV. Instead, several rules each touch a part of it: what cameras can be sold, how personal data must be handled, which premises must have cameras, and where cameras must never go. This overview pulls them together. It is general information, not legal advice.

The rules at a glance

Buying cameras

Since April 2025, new camera models need security certification under MeitY’s Essential Requirements, tested through STQC-recognised labs, and the relaxation for older stock was reported withdrawn from 1 April 2026. Ask for certified models and check the exact model number.

Handling footage

Footage of identifiable people is personal data under the DPDP Act. Organisations should display notices, keep footage only as long as needed, secure their recorders and limit access. Purely domestic home cameras are likely outside the Act.

Premises that must have CCTV

In Karnataka, establishments where 100 or more people gather must install CCTV and access control at entries and exits, common areas and parking, and keep 30 days of footage for the police. Schools affiliated to CBSE have their own requirements.

Hidden cameras and private spaces

Capturing images of people in private situations — toilets, bathrooms, changing rooms — is a criminal offence under Section 77 of the Bharatiya Nyaya Sanhita (voyeurism) and Section 66E of the IT Act (violation of privacy, up to three years’ imprisonment and a fine). Never place cameras in such areas, and do not use hidden cameras where people expect privacy.

Audio recording

There is no specific Indian law that bans audio on CCTV on your own premises, and some rules — such as CBSE’s for schools — now require audio-visual recording. Audio does raise extra privacy issues, so businesses should tell people that audio is being recorded and take legal advice before enabling it widely.

A simple compliance routine

• Buy certified cameras from an installer who gives model numbers and a GST invoice.
• Display CCTV notices.
• Keep at least 30 days of recording where the Public Safety Act applies.
• Secure the recorder and limit access.
• Keep cameras away from private spaces.
• Review the system once a year, or under an AMC.

Example: a restaurant checks its position

A restaurant in Indiranagar seating 120 guests worked through the rules in one afternoon. Because more than 100 people gather at a time, the Karnataka Public Safety Act applies: cameras at entries, exits, common areas and parking, with 30 days of recording. The NVR’s retention was checked and the disk upgraded to reach 30 days. New IP cameras for the terrace were bought only after confirming each model’s certification. Signboards in English and Kannada were put up, and a short CCTV policy named the manager allowed to export footage for police requests. No cameras were placed in toilets or staff changing areas.

Quick answers