A missing pallet, a staff safety incident or an after-hours break-in can turn a routine Tuesday into an urgent search for footage. If that footage has already overwritten, the quality of the camera system matters very little. This business CCTV retention policy guide helps Australian organisations set retention periods that protect evidence, respect privacy and keep storage costs under control.
There is no single number that suits every site. A retail store, logistics yard, aged care facility and school all face different risks, reporting timeframes and privacy obligations. The right policy is one your team can apply consistently, your system can deliver reliably, and management can justify if footage is requested or reviewed.
What a CCTV retention policy should achieve
A CCTV retention policy sets out how long video is kept, who can access it, when it may be exported, and how it is securely deleted or overwritten. It should also explain what happens when footage relates to an incident, complaint, investigation or legal matter.
The purpose is not to retain every recording indefinitely. Keeping footage longer than necessary can increase storage costs, complicate access requests and create more sensitive information to protect. Deleting it too quickly can leave a business unable to investigate a workplace incident, identify an offender or support an insurance claim.
For most organisations, the policy should balance five practical requirements: evidentiary value, privacy, operational risk, technical capacity and legal or contractual obligations. These factors should be considered together rather than treating retention as a simple setting in the recorder.
How long should business CCTV footage be kept?
Many commercial sites choose a standard retention period of 30 days as a practical starting point. It often gives managers enough time for an incident to be reported, reviewed and escalated while avoiding unnecessary long-term storage. However, 30 days is not a universal rule or a substitute for a risk assessment.
A shorter period may be appropriate where cameras cover low-risk areas and storage is limited. A longer period may be warranted for high-value stock, remote infrastructure, recurrent vandalism, large sites where incident reporting is delayed, or environments with extended investigation processes.
A warehouse may need enough coverage to investigate stock discrepancies discovered during a monthly cycle count. A school or aged care site may need to account for the time it takes for concerns to be raised through internal channels. A construction site may require longer retention where theft is discovered only when contractors return after a break.
The key question is not, “What period does everyone else use?” It is, “How long after an event could we reasonably need to find and preserve the footage?”
Build in a preservation process
Standard retention is only half the policy. When footage may be relevant to an incident, it should be isolated from the normal overwrite cycle immediately. This is often called a preservation hold.
The policy should authorise nominated staff to export and securely retain footage when there is a theft, injury, security breach, complaint, damage event, police request, insurer request or anticipated legal claim. Record the date, camera location, time range, reason for preservation and the person who handled the export.
Preserved footage should remain available until the matter is resolved and any applicable retention requirement has passed. It should not sit indefinitely in an individual manager’s desktop folder or be copied to an unsecured USB drive without controls.
Privacy obligations matter as much as storage
CCTV footage can contain personal information, including identifiable images of staff, visitors, customers and contractors. Australian privacy responsibilities may arise under the Privacy Act 1988, relevant state or territory laws, workplace surveillance rules and sector-specific requirements. The obligations that apply will depend on the organisation, location and use of the cameras.
A retention policy supports privacy compliance by demonstrating that recordings are kept only for a defined business purpose and for no longer than reasonably necessary. It should work alongside clear signage, a documented CCTV purpose, an access procedure and appropriate security controls.
Avoid using retained footage for purposes unrelated to the reason it was collected. For example, cameras installed to protect a loading dock should not become a casual tool for monitoring staff performance unless that use has been properly considered, communicated and is lawful. Workplace surveillance is a sensitive area, particularly where cameras capture staff in regular work areas.
For regulated industries such as healthcare, education and aged care, seek tailored legal and privacy advice before adopting a policy. The same applies if your organisation operates across multiple states or territories, stores recordings offshore, or uses facial recognition, licence plate recognition or other analytics.
Business CCTV retention policy guide: what to include
A useful policy does not need to be long, but it must be specific enough to guide decisions under pressure. It should identify the business purpose of the system, the areas covered, the standard retention period and the circumstances that trigger preservation.
It should also state who has authority to view live footage, search recordings, export clips and approve external disclosure. Limit access to people whose roles genuinely require it, such as security managers, authorised operations leaders or nominated administrators. Shared passwords and informal access arrangements make accountability difficult.
Your policy should address the following operational controls:
- the nominated retention period for each camera group or site type
- secure automatic overwriting or deletion once that period ends
- procedures for preserving incident-related footage
- access, export and disclosure approvals, including a record of who received footage
- storage security, user permissions, audit logs and password management
- review dates, system health checks and staff responsibilities.
Where practical, keep a register of exported footage. This creates a clear chain of custody and helps confirm that a clip has not been altered, misplaced or distributed beyond its approved purpose.
Match storage design to the policy
A policy that promises 60 days of retention is ineffective if the recorder only holds 18 days at the selected resolution and frame rate. Retention must be calculated during system design and checked whenever cameras, analytics or recording settings change.
Storage consumption varies significantly. Higher resolution cameras, more cameras, continuous recording, extended operating hours and high scene activity all consume capacity. AI analytics can reduce unnecessary recording in some applications through event-based recording, but it is not appropriate for every environment. Critical access points and cash-handling areas may still require continuous recording.
Cloud, on-site and hybrid storage each involve trade-offs. On-site network video recorders can offer predictable local access and retain recordings during internet interruptions, provided the system is correctly maintained. Cloud storage can support remote access and off-site resilience, but ongoing costs, upload bandwidth, data location and user permissions need close attention. A hybrid design can provide local recording with protected off-site copies of important events.
Do not rely on a storage estimate completed at installation and never reviewed. Camera angles change, new cameras are added, firmware updates affect settings and businesses evolve. A preventative maintenance program should include checks that actual retention meets the policy target, cameras are recording correctly and time stamps are accurate.
Make access requests and police enquiries manageable
A business may receive requests from individuals seeking access to their personal information, as well as enquiries from police, insurers, landlords or other parties. Staff should know not to release footage simply because someone asks at the front counter.
Set a clear escalation path. Requests should be assessed by an authorised manager or privacy contact, with consideration given to the identity of the requester, the reason for the request, the privacy of other people shown in the footage and any applicable legal requirements. In some cases, redaction or a limited viewing arrangement may be more appropriate than providing a full copy.
If police request footage, record the officer’s details, reference number, the precise footage supplied and the method of transfer. Urgent cooperation can be appropriate, but it should still be documented. This protects the integrity of the evidence and gives your business a reliable record of what occurred.
Review the policy after real incidents
The best test of a retention policy is what happens after an event. If staff cannot locate footage quickly, the relevant camera is obscured, timestamps are inaccurate or recordings have overwritten before review, treat it as an operational issue requiring correction.
Review your policy at least annually and after a significant incident, site expansion, change in operating hours or major system upgrade. Ask whether the current retention period gave the business enough time, whether access permissions remain appropriate and whether storage is performing as designed.
For organisations with multiple sites, a standard policy can provide consistency while allowing site-specific retention schedules. A remote solar CCTV unit protecting a farm gate will not necessarily need the same recording profile as cameras in a metropolitan office foyer.
A properly designed CCTV system is not only about seeing what happens. It is about being able to retrieve the right evidence when it matters, with clear controls around who can use it and why. ADACS Security can help assess whether your current cameras, recording capacity and maintenance arrangements support the retention policy your business needs.
