By the SightShield team · · 3 min read
CCTV footage is personal data
India’s Digital Personal Data Protection Act, 2023 (DPDP Act) applies to personal data held in digital form. Recordings of identifiable people on a DVR or NVR are digital personal data. So are fingerprint and face templates in an attendance machine. Businesses, offices, factories, shops and apartment associations that run CCTV or biometric systems will therefore have duties under the Act as its rules come into force.
This is a practical overview, not legal advice. Talk to your legal advisor about your specific situation.
Key dates
| Date | What |
|---|---|
| 11 August 2023 | DPDP Act enacted |
| November 2025 | DPDP Rules 2025 notified; Data Protection Board provisions start |
| About November 2026 | Consent Manager provisions start (one year after the Rules) |
| About May 2027 | Most obligations start — notices, security safeguards, breach reporting, retention, individuals’ rights (18 months after the Rules) |
Penalties
According to the government’s summary of the Act, penalties go up to Rs 250 crore for failing to keep reasonable security safeguards, up to Rs 200 crore for failing to report a breach or for breaching obligations about children’s data, and up to Rs 50 crore for other violations. The highest penalty is for weak security — which, for CCTV, means a poorly protected recorder or camera system.
Employees and attendance
The Act lets employers process personal data without separate consent for employment purposes and to protect themselves from loss or liability. Commentators read this as covering employee CCTV and attendance biometrics, though how far it reaches is still being discussed. Even where consent is not needed, employers should tell staff what is collected and why, and protect the data.
Biometric attendance systems →Homes and apartments
The Act excludes data processed by an individual for personal or domestic purposes, so a family’s own home cameras are likely outside it. An apartment association, RWA or managed community running CCTV for residents is in a different position and should follow the same good practices as a business.
Cameras for Home Staff →A simple CCTV notice
A notice at entrances should say that CCTV is in operation, why (for example, safety and security of people and property), who operates it, and whom to contact with questions. Keep it short and visible. Businesses can link to a fuller CCTV policy on their website or at reception explaining retention periods and who can access footage.
Requests from people in the footage
People may ask for footage that shows them, for example after an accident or dispute. Decide in advance who handles such requests, how you verify the request, and how you protect other people visible in the clip — for example by sharing only the relevant portion. Requests from the police should be handled under your export procedure and recorded.
Exporting footage for police and insurance →Practical steps to take now
- Put up clear CCTV notices at entrances saying that cameras are in use and who to contact.
- Keep recordings only as long as needed — 30 days is common, and is required for establishments under Karnataka’s Public Safety Act.
- Secure the recorder: strong passwords, updated firmware, locked location, cameras on a separate network.
- Limit who can view and export footage, and keep a record of exports.
- Do not point cameras into private spaces such as toilets or changing rooms.
- For attendance: delete biometric templates when staff leave, and choose software that explains how it secures data.
- Prepare a simple plan for what to do if footage or data leaks.
Quick answers
Does the DPDP Act apply to CCTV?+
Yes, for businesses and organisations. Recordings of identifiable people stored digitally are personal data. Purely personal home use is likely excluded.
When do DPDP obligations start for businesses?+
The Rules were notified in November 2025, with most obligations starting 18 months later, around May 2027. A proposal to shorten this was floated in 2026; check for updates.
Is biometric attendance allowed under the DPDP Act?+
Yes. Employers can process employee data for employment purposes, but must protect it, use it only for its purpose, and delete it when no longer needed.
Do I need a CCTV notice in my shop?+
Clear CCTV notices are good practice and support transparency obligations under data protection law.
Can I share CCTV clips on WhatsApp?+
Avoid sharing footage of identifiable people informally. Share only with police or those with a legitimate need, through a controlled process.