CCTV Surveillance & the DPDP Act 2023: Enterprise Compliance Guide

1. How CCTV Footage Is Classified Under DPDP Act 2023

India's Digital Personal Data Protection Act, 2023 introduces comprehensive statutory obligations for organizations handling digital personal data. Section 2(t) defines personal data as 'any data about an individual who is identifiable by or in relation to such data.'

Because high-resolution surveillance video captures recognizable human faces, physical characteristics, and personal movements, recorded CCTV footage containing identifiable individuals is legally classified as digital personal data.

Consequently, enterprise surveillance cannot be operated arbitrarily without clear data governance frameworks.

2. Core Obligations of Corporate Data Fiduciaries

Enterprises operating surveillance cameras are designated as Data Fiduciaries under the Act. Core obligations include:

• Purpose Limitation: Video surveillance must be deployed solely for legitimate, documented business security, physical asset safety, or life safety purposes.

• Mandatory Notice: Facilities must display clear, prominent physical signage informing visitors and employees that video surveillance is active and detailing the purpose of recording.

• Reasonable Security Safeguards: Data Fiduciaries must implement robust technical safeguards—such as role-based access controls and encrypted storage—to prevent surveillance data breaches.

3. Legal Boundaries for Face Recognition & Biometrics

Facial recognition is a sensitive subset of computer vision. Under DPDP principles, processing biometric identifiers requires heightened compliance diligence:

• Consent-Based Verification: In enterprise settings, facial verification should be confined to opt-in operational workflows—such as voluntary employee shift attendance—where individuals provide explicit informed consent.

• Strict Prohibition Against Mass Surveillance: Commercial enterprises must not deploy indiscriminate facial recognition to build public biometric databases or profile visitors without lawful basis.

4. Storage Limitation & Automated Purge Schedules

The principle of storage limitation dictates that personal data must not be retained indefinitely. Enterprises must define explicit data retention periods (typically 30 to 90 days) based on legitimate operational requirements.

At the expiration of the retention window, automated purge routines must permanently delete expired video files and alert snapshots, preventing unmonitored data accumulation.

5. Operator Audit Trails & Data Principal Rights

To demonstrate compliance during regulatory audits, surveillance platforms must maintain tamper-evident audit logs capturing every user login, live stream view, configuration change, and video clip export.

To learn how Resurgenix designs its architecture to support customer compliance, review our Security & Privacy Overview.