Guide
CCTV and biometrics under DPDP
Cameras and fingerprint readers collect personal data every day. DPDP has no separate category for them, so the ordinary duties apply in full.
Short answer
CCTV footage and biometric records such as fingerprint attendance data are personal data under DPDP when they relate to an identifiable person, and digital systems hold them as digital personal data (s.2, s.3). The Act has no separate biometric or sensitive category, so the ordinary duties apply: a ground under s.4 (consent, or a s.7 legitimate use such as s.7(i) for employment), purpose limits, security safeguards (s.8(5), Rule 6), erasure when the purpose is served (s.8(7)) and contracts with vendors who access the systems (s.8(2)). Seek counsel for edge cases such as facial recognition or cameras that capture public spaces.
When CCTV and biometrics are personal data
Personal data is any data about an individual who is identifiable by or in relation to it (s.2). Footage in which people can be recognised, and fingerprint or face templates linked to an employee ID, meet that test. Digital CCTV and biometric systems hold digital personal data within s.3.
The Act does not define sensitive personal data and has no biometric category. That does not lower the bar: sensitivity of data is one of the factors the government weighs when notifying SDFs (s.10), and your sector regulator may have its own rules.
Ground, notice and signage
| Setting | People captured | Points to settle |
|---|---|---|
| Office CCTV | Employees, visitors | s.7(i) may cover employees; for visitors, settle the ground with counsel |
| Biometric attendance | Employees | s.7(i) employment purposes; consider offering a non-biometric option |
| Shop or branch CCTV | Customers, staff | s.7(i) is framed around employment; take advice before relying on it for customers |
| Residential or campus gates | Residents, visitors, children | Children's data brings in s.9 and possibly Rule 12; take advice |
Put clear signs at every entrance, before people enter the camera's view, saying that recording happens, why, who runs it and whom to contact. Point the sign to a fuller notice, for example through a short web address.
Facial recognition, audio capture, cameras that see public spaces and cameras in children's spaces raise questions the Act does not answer in detail. Take advice before you deploy them.
Steps to set up CCTV and biometrics
- 01List devices
Record every camera and biometric reader: where it is, what it captures and who runs it.
- 02Fix the purpose
Write one purpose per system, such as premises security or attendance, and do not reuse the data for another purpose without a fresh ground.
- 03Choose the ground
Decide between consent and a s.7 legitimate use for each group of people, with counsel for anyone who is not an employee.
- 04Give notice
Put up signs, publish the fuller notice, and cover CCTV and biometrics in your employee notice.
- 05Limit access
Restrict who can view, export or search footage and templates, and log every access (Rule 6).
- 06Set retention
Choose a period for each system based on its purpose, then overwrite or erase automatically (s.8(7)).
- 07Handle requests
Decide how you will answer a request for footage, including masking other people in it.
Vendor access to feeds and templates
- Treat the security agency, CCTV installer and biometric vendor as processors where they act for you, under a valid contract (s.8(2)).
- Include Rule 6 security terms: access control, logging, and encryption or masking where possible.
- Know where cloud-hosted footage or templates are stored (s.16).
- Require breach notice without delay, and erasure on your instruction (s.8(7)).
- Remove vendor remote access when it is not needed.
Retention and checklist
Keep footage and biometric records only as long as the purpose needs, then erase them unless a law requires you to keep them (s.8(7)). Rule 6 requires logs and personal data to be kept for one year to detect and investigate unauthorised access, unless another law requires otherwise. Check with counsel how the one-year periods in Rule 6 and Rule 8(3) apply to your systems.
- Device register complete
- Purpose and ground recorded for each system
- Signs at every entrance and a fuller notice published
- Access restricted and logged
- Retention period set and applied automatically
- Vendor contracts with security terms
- Process for footage requests
- Counsel review of edge cases
How TruePrivacy helps
TruePrivacy does not manage cameras or biometric devices; it helps you govern the data they produce. Records of processing holds each CCTV and biometric system with its purpose, and retention sets rules per data category or connected system, logs executions and flags items that need a manual purge.
Vendors and processors tracks contracts and assessments for your security and biometric vendors, and Data Principal requests logs requests for footage with an audit trail. Related template: the DSR request form.
Is CCTV footage personal data under DPDP?
Yes, where people in it are identifiable and the footage is digital (s.2, s.3).
Does DPDP treat biometric data as sensitive?
The Act has no separate biometric or sensitive category. The ordinary duties apply, and sensitivity of data is one of the s.10 factors for SDF notification.
Do we need employee consent for biometric attendance?
Section 7(i) covers processing for employment purposes, which may include attendance. Check the scope with counsel, and consider offering a non-biometric option.
How long can we keep CCTV footage?
Only as long as the purpose needs, unless a law requires longer (s.8(7)). Set a period for each system with counsel, keeping in mind the one-year retention in Rule 6.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin