How long should you keep CCTV and number plate data?

By Gankya · 4 October 2026 · 6 min read

"How long should we keep CCTV footage?" is one of the first questions any security committee asks. The common answer is "as long as the recorder's disk allows". That is a storage decision, not a policy. This guide helps you set a deliberate retention period for video and number-plate data, with a simple policy you can adapt.

What data are we talking about?

A typical site holds several kinds of data, and they do not all need the same period:

• Raw video from cameras, stored on recorders.
• Number-plate records: a plate number with a time, a camera and often a small snapshot. These are created by ANPR (automatic number plate recognition) systems or by guards typing plates into a register or app.
• Visitor and vehicle registers: paper or digital entries with names, flats and purposes.
• Exported clips taken out for an incident.
• Access and audit logs: records of who viewed, searched or exported what.

Number-plate records deserve special care. A searchable list of every time a vehicle passed every camera reveals people's routines: when they leave for work, when guests visit, when a flat is empty. That is far more revealing than a single clip.

Why shorter is safer

• Less to leak. If a recorder is stolen or a system is breached, a short history exposes less.
• Less to misuse. Old routines are exactly what someone with bad intentions would look for.
• The law leans that way. Section 8(7) of the Digital Personal Data Protection Act, 2023 asks organisations to erase personal data once it is reasonable to assume the purpose is no longer served, unless a law requires it to be kept.
• Most incidents are reported quickly. Think about your own site's history: how many days after an incident did someone first ask for footage? Your retention period should cover that, with a margin.

The one-year question

The DPDP Rules, 2025 add two provisions that pull the other way, and sites should know about both:

• Rule 6(1)(e) asks fiduciaries to keep logs and personal data for one year, to help detect and investigate unauthorised access, unless another law requires otherwise.
• Rule 8(3) asks fiduciaries to keep personal data, related traffic data and logs of processing for at least one year from the date of processing, for the purposes in the Seventh Schedule (mainly information requests from the government), and then erase them unless another law requires longer.

Both rules start eighteen months after the Rules were published on 13 November 2025, so on 13 May 2027 under the timeline as notified. The government consulted in early 2026 on moving some dates earlier, so check the current position.

We do not know how these rules will be applied to raw CCTV video at a housing society or campus. Read literally, they could mean much longer retention than most sites use today. They could also be read mainly as covering logs and records of processing. This is unclear to us, and we would rather say so than guess. Take advice before 2027, and revisit your policy when guidance appears.

Keeping access and audit logs for at least a year is the easy part, and is good practice anyway.

Holds for open incidents

A short retention period only works if you can stop deletion for specific footage when you need to. Call this a "hold".

• A hold covers specific cameras and a specific time window, not "everything".
• Record who placed it, when, the incident reference and the reason.
• Set a review date, for example every 30 days.
• Release the hold when the matter closes, unless the police, a court or your lawyer asks you to keep the data. Keep any such request in writing.
• Exported clips given to the police follow the police process. Keep your own copy and its record under the hold.

Purge properly

Deletion should be automatic, complete and checkable:

• Configure recorders and software to delete or overwrite after the set period, not "when full".
• Check monthly that the oldest footage really is no older than your policy says.
• Remember copies: pen drives, laptops, email attachments, backups, and anything held by vendors.
• Require vendors, by contract, to delete data when the period ends and at the end of the contract.
• Log purges and holds in the same place as other access records.

Audit logs

Audit logs are what let a committee show that the system was used properly. A good audit log:

• Records every search, view and export, with the signed-in user, time and stated reason.
• Cannot be edited or deleted by operators or admins.
• Is kept for at least a year.
• Is actually reviewed, for example monthly by someone outside the control room.

A retention policy outline

Keep the policy short enough that people read it. A two-page outline:

1. Purpose: why the site records video and number plates (safety and security of people and property).
2. Who is responsible: the RWA or management as the decision-maker; named security head; vendors as processors.
3. Data covered: the categories listed above.
4. Retention periods: a table with each data type and its period, with a note on the one-year rules and the date of your last legal review.
5. Holds: who can place them, how they are recorded and reviewed, and how they are released.
6. Deletion: automatic purge, monthly check, copies and backups, vendor deletion.
7. Access: personal logins, roles, reasons for searches, export approval.
8. Requests: how residents, staff or visitors can ask about their data, and who answers.
9. Review: who reviews the policy, and how often (at least yearly).

Share the policy with residents or tenants. Clear rules on how long data is kept build more trust than any camera.

For reference, Gankya does not record or store video; your recorder keeps the footage. Gankya keeps its own records (vehicle sightings and small stills) for 30 days by default and purges them automatically, with no setup needed; the site can change that period. A legal hold stops the purge for records needed in a police or court matter. Its audit log, which records the signed-in user and reason for every search, is kept for at least a year and shows if anyone tampers with it. If that sounds useful, ask about a 30-day pilot.