CCTV is regulated. The specifics vary by jurisdiction, but the principles are similar everywhere. This is a general overview; consult local law for specifics.

1. Signage

Most jurisdictions require visible notice that surveillance is in use:

  • Posted at entrances and visible from outside
  • Clear language ("CCTV in operation")
  • Often must include contact for the data controller

A sign that's hidden or too small to read may not satisfy the requirement.

2. Privacy zones

Cameras must not capture areas where there's a reasonable expectation of privacy:

  • Bathrooms, locker rooms, changing areas — never
  • Neighboring properties — masking required
  • Through windows into private residences — masking required

If a camera's field of view incidentally includes such an area, configure a privacy mask in camera settings.

3. Retention

How long footage is kept varies by purpose:

  • Routine security — typically 30 days
  • Active incident investigation — until resolved + retention period
  • Insurance / legal requirements — varies, often 7 years for some industries

Excessive retention without justification can violate privacy law. Verify you're not keeping footage longer than needed.

4. Data subject access requests

In many jurisdictions (GDPR, CCPA, etc.):

  • Individuals can request footage of themselves
  • You must provide or deny with reason within a set period
  • Identifying others in the same footage requires redaction or denial

This is a real workflow that needs to be set up — who handles requests, how long does it take.

5. Recording audio

Audio is more restricted than video in most places:

  • Often requires explicit consent of those being recorded
  • Some jurisdictions require two-party consent
  • Many businesses disable audio for legal simplicity

Check before enabling audio on cameras.

6. Employee monitoring

Recording employees has additional requirements:

  • Notification (often in employment contracts)
  • Clear policy on what's monitored and why
  • Cannot be used to circumvent labor laws (breaks, organizing activities)

Some places require collective bargaining consultation before installing.

7. Public spaces vs. private property

Different rules apply:

  • Private property: you generally control what's filmed
  • Public spaces (sidewalks, streets): limited by what's in your field of view
  • Customer-facing areas of businesses: notice usually required

8. Third-party sharing

Sharing footage outside your organization:

  • Insurance investigations: usually permitted with proper authorization
  • Law enforcement: depends on jurisdiction; sometimes court order required
  • Media / social media: rarely permitted; risk of privacy claims

Have a written process for who can request and what's released.

9. Vendor cloud storage

If your cameras stream to a vendor cloud:

  • Where is the data stored (jurisdiction)?
  • Who has access on the vendor side?
  • What happens to data if you cancel service?
  • Is the vendor subject to your jurisdiction's privacy laws?

Some industries (healthcare, finance) have strict data residency requirements that vendor clouds may not meet.

10. Incident response

When something happens that requires footage review:

  • Document the request (who, when, why)
  • Export only the relevant footage (not the entire day)
  • Maintain chain of custody if it may be evidence
  • Don't share more than needed

When to ticket

Raise a ticket if:

  • You're being asked to remove or modify footage you believe should be retained
  • A request to share footage looks unusual
  • New jurisdiction requirements have changed (GDPR-style changes are happening worldwide)
  • You need privacy zones configured to comply with a new requirement

Include the regulatory or policy requirement, what cameras / data are involved, and what action is needed.