What counts as personal data
Is CCTV footage personal data?
- Short answer
- Yes. Recognisable images of people are personal data, and CCTV recording is digital processing. Running cameras therefore brings notice, purpose limitation, retention and security duties, even where the footage is never reviewed.
Footage identifies people by appearance, which is enough. Adding facial recognition raises the stakes considerably but is not required for the footage to count.
The two failures that recur are indefinite retention, because the recorder simply overwrites when full rather than following a stated period, and unrestricted access, where any staff member can pull footage.
A visible notice at the point of entry, a stated purpose, a retention period you actually apply, and a short list of who may access recordings covers most of what is expected.
Where this comes from
- Section 5 and Section 8(7), DPDP Act 2023
- Rule 3 and Rule 6, DPDP Rules 2025
The mistake people make
Running cameras for security with no notice, no retention rule and no access control, on the basis that nobody watches the footage.