How long can CCTV footage be kept before it must be deleted?
Reviewed by Confidential Dispatch Editorial Team · Updated 28 Oct 2026 · 4 min read
There’s no single number written into Indian law. What governs CCTV retention instead is a principle under the DPDP Act: footage has to be erased once the purpose it was collected for is served, unless another law specifically requires holding onto it longer, an active investigation or legal dispute, for instance. In practice, different sectors have settled into different common ranges, but these are norms that have built up over time, not a fixed legal ceiling everyone must follow.
Educational resource only. This explains what actually governs how long CCTV footage can be kept in India, and what different sectors typically do in practice; it is not formal legal advice.
The situation
You’ve walked past a camera at your housing society, your office or a shop, and wondered how long it keeps what it records. Behind every CCTV camera is a hard drive filling up and looping over. India has no single number for how long that footage can stay there, but it does have a rule for when it has to go.
Is there a fixed legal retention period anywhere?
No single, universal number exists across Indian law
Unlike some regulated activities with an explicit retention clock, general CCTV footage doesn’t have one fixed period that applies to every camera in the country. A few specific, narrow situations have had time-bound directives, the Reserve Bank of India, for example, once directed banks to preserve certain branch and currency-chest CCTV recordings tied to the 2016 demonetisation period, later extended indefinitely because of ongoing investigations and court proceedings, but that’s a targeted directive tied to a specific historical event, not a general rule for all banking CCTV going forward.
What actually governs it instead?
The DPDP Act’s purpose-based erasure principle: once the reason footage was collected no longer applies, it’s supposed to go
Whoever operates the camera, a shop, an office, a housing society, is a Data Fiduciary under the Act, and Section 8(7) requires erasing personal data once its stated purpose is served, unless another law specifically requires keeping it. For ordinary security footage, that purpose is usually short-lived: once the window for spotting an incident has passed with nothing flagged, there’s no remaining reason under the Act to keep recycling the footage indefinitely.
What do different sectors typically do in practice?
In most places, the real limit is storage: a camera keeps footage until its disk or cloud plan fills, then records over the oldest
How long that takes depends on how much storage the operator bought and how long it decided to keep footage, not on a rule. Common practice still varies by setting, and these are norms that have developed over time, not legal minimums or maximums.
- Shorter, common ranges: residential and home CCTV often cycles every 15 to 30 days; retail shops and small offices commonly run 30 to 60 days.
- Longer, common ranges: banks and other regulated financial premises often keep footage for 90 days or more; hospitals and critical infrastructure sites sometimes extend well beyond that.
None of these figures come from a single binding rule that applies everywhere; they reflect what’s become standard practice in each setting, shaped by each operator’s own risk assessment and, in regulated sectors, by that regulator’s own separate expectations, rather than one shared CCTV-specific law.
Does an ongoing dispute or investigation change the clock?
Yes, and this overrides whatever the operator’s routine cycle normally is
If footage becomes relevant to a police investigation, a court proceeding, or a formal complaint, the ordinary retention window stops applying to that specific footage, and it needs to be preserved until the matter resolves. This is also the practical reason speed matters if you ever need footage of an incident involving you: asking for preservation immediately matters more than the retention period itself, since routine footage can be gone before a formal request even gets processed.
FAQ
Can a business just keep CCTV footage forever “to be safe”?
No, not under the DPDP Act’s own principle. Holding onto footage indefinitely without a purpose that still applies runs against the erase-once-served rule, even without a specific numeric limit being breached.
What if I ask a shop to delete footage of me and they refuse?
Ask what purpose they say it’s still serving. If there’s no ongoing investigation, dispute, or other law requiring retention, that refusal is harder to justify under the DPDP Act’s own principle, though enforcing it in practice depends on escalating the request formally.
Does a housing society have to publish its CCTV retention period?
There’s no specific law forcing this, but good practice, and increasingly common committee policy, is stating a clear retention period in writing so residents know what to expect.
Is there a difference between how long footage is kept and how long it’s backed up?
Yes, and this is a common gap. A camera’s local recycling period doesn’t always match how long a cloud backup or archived export sits elsewhere, so ask about both if you’re trying to understand your actual exposure.
If footage gets overwritten before I can request it, is that itself a violation?
Not necessarily. Routine, purpose-based deletion is what the DPDP Act’s own principle expects. It only becomes a problem if the operator kept overwriting footage after being told it was needed for a specific, active dispute or investigation.
Every article is checked against the current law and the judgments it cites before it is published.
Updated 28 October 2026 · Not legal advice.
