Not legal advice. This page describes common themes in privacy regulation as they affect video systems, to help you ask better questions. Obligations depend on jurisdiction, deployment and organisation. A qualified assessment for your own deployment is the only thing that settles it.
Video of identifiable people is personal data
This is the starting point under essentially every modern privacy regime. Footage in which a person can be recognised is personal data about them, which means someone is accountable for how it is collected, stored, shared and deleted — regardless of whether any AI is involved.
A useful early distinction: a system that detects that a person is present is doing something materially different from one that determines which individual they are. Facial recognition and re-identification are commonly treated as a heightened category with stricter conditions. Presence-based detection avoids that category entirely — it reduces sensitivity, though it does not remove the underlying obligation, because identifiable video is still being recorded.
India — the DPDP Act 2023
For deployments in India, the Digital Personal Data Protection Act 2023 is the operative law. Recurring themes relevant to video:
- Notice — people should be informed that processing is occurring, in clear terms. For premises, that generally means visible signage rather than a document nobody sees.
- Lawful basis — processing needs a defensible ground, whether consent or a recognised legitimate use. Which applies is a determination to make deliberately and record, not to leave implicit.
- Purpose limitation — footage collected for premises security should not quietly become an attendance or productivity system. Scope creep is a compliance event.
- Retention — personal data should not be kept indefinitely without reason. A documented retention period is easier to defend than "until the disk fills."
- Security — reasonable safeguards against unauthorised access.
- Data-principal rights — individuals have rights regarding their data, which requires knowing what you hold and being able to find it.
Europe — GDPR
GDPR applies where there is an EU establishment or EU data subjects. Its video-relevant themes overlap substantially with the above — lawful basis, transparency, minimisation, storage limitation, security, and subject rights including access and erasure. Two additional points come up repeatedly for camera systems: a Data Protection Impact Assessment is often expected for systematic monitoring of public or semi-public space, and biometric identification carries materially stricter conditions than presence detection.
Where these systems usually go wrong
In practice, non-compliance rarely looks like a dramatic misuse of data. It looks like:
- No signage, or signage that does not say who is responsible or how to contact them.
- Cameras pointed beyond the boundary — into a neighbour's garden, a public pavement, or a changing area. Coverage is a compliance decision, not just a technical one.
- Retention that is simply "until it runs out", with no documented period and no way to honour a deletion request.
- A single shared login on the recorder, so "who viewed this footage" cannot be answered.
- Footage leaving the site to a cloud service or a personal phone, often without anyone deciding that it should.
- Purpose drift — a security system gradually used to monitor staff.
Design choices that make compliance easier
Architecture can reduce obligations rather than merely documenting them:
- Keep processing and storage local. Footage that never leaves the premises removes an entire class of question about transfers, processors and cross-border flows.
- Detect presence, not identity. If the use case only needs "someone is here and has been for a while," building it that way avoids the biometric category altogether.
- Make retention a policy, not an accident. A configurable, documented retention period that actually deletes is far more defensible than a disk that overwrites when full.
- Authenticate and log access. Per-user credentials and an access record turn an unanswerable question into a report.
- Minimise what you send. An alert that carries a short relevant clip discloses less than one that exports an hour of footage.
A starting checklist
- Is there signage, and does it identify who is responsible and how to reach them?
- Have you written down the lawful basis and the purpose?
- Does any camera see beyond your boundary?
- Is there a defined retention period, and does deletion actually happen?
- Does footage leave the site, and did someone decide that deliberately?
- Can you say who has accessed footage?
- Could you respond if someone asked what you hold about them?
- Are children or patients in scope? Expect a higher bar.
Where ManasaView fits
ManasaView is built so several of these questions have structural answers: processing and footage stay on the device, detection is presence-based rather than identity-based, retention is a configurable policy that genuinely deletes, and access requires a login. See also privacy by design in video AI. None of that constitutes compliance on your behalf — the deployment decisions and the assessment remain yours.
Frequently asked questions
Is CCTV footage personal data?
Where individuals are identifiable, yes — under GDPR, India's DPDP Act and most comparable regimes. That makes someone accountable for how it is collected, stored, shared and deleted, whether or not any analytics are applied.
Does using AI on video make compliance harder?
It depends what the AI does. Systems that identify specific individuals, such as facial recognition, are usually treated as a heightened category with stricter conditions. Systems that only detect that a person is present, without determining who, avoid that category — though the footage itself remains personal data.
Do I need signage for security cameras?
Transparency obligations generally mean people should know that recording is happening, and visible signage is the usual way to achieve that on premises. Effective signage typically also identifies who is responsible and how to contact them.
How long can I keep CCTV footage?
There is rarely a single fixed number. The principle is that personal data should not be kept longer than necessary for the stated purpose, so a documented, justified retention period that is actually enforced is what matters. Sector-specific rules may impose their own minimums or maximums.
Does keeping video on-site instead of the cloud help?
It removes a substantial class of questions about transfers, third-party processors and cross-border data flows, and reduces the number of parties who can access footage. It does not remove the underlying obligations around notice, purpose, retention and access control.
← Back to Knowledge