CCTV and the PDPA: what Singapore businesses need to know

Is CCTV footage personal data?

Yes, when people can be identified in it. PDPC’s guidance is that an identifiable image of a person is personal data about them. Someone in the background who is too small or obscured to be recognised is not.

The same goes for audio. If your system records sound and a person can be identified by their voice, that recording is personal data too. PDPC’s CCTV guidance applies whether your cameras record video only, or video and audio.

Do you need consent?

Often you don’t, but you still need to tell people. PDPC’s guidance explains that exceptions to consent may apply:

• Open areas: footage of people in places open to the public may fall under the publicly available data exception
• Your own premises: the legitimate interests exception may apply, for example for security. Where you rely on it, assess the risks and take reasonable steps to let people know.

Either way, PDPC treats CCTV notices as good practice. Where consent is needed, notices or terms and conditions can be used to get it. PDPC’s example is a karaoke business recording inside its rooms, using its terms plus notices in each room.

What your CCTV notices should say

• That CCTV is in operation. That’s the key message.
• The general area covered, such as “this premises” or “this car park”. PDPC’s guidance says notices don’t need to reveal exact camera locations.
• Where people will see it before they’re recorded, such as at entrances. PDPC gives prominent notices placed below each camera as an example of sufficient notification.
• Who to contact, ideally your Data Protection Officer, for questions or requests to view footage

As good practice, don’t place cameras where people reasonably expect privacy, such as toilets or changing rooms.

Monitoring staff with CCTV

You can use CCTV to manage the employment relationship, for example for workplace safety and security. PDPC’s guidance says you must tell employees the purpose, for example in your employee handbook or HR policies.

How long to keep footage

The PDPA doesn’t set a fixed period. PDPC’s guidance is that you must stop keeping footage once it no longer serves its purpose and you have no legal or business reason to keep it.

In practice, many systems simply overwrite footage after a set number of days. Pick a period that suits your purpose, write it down, and make sure your recorder actually does it. Keep specific clips longer only when there’s a reason, such as an incident under investigation.

When someone asks to see footage of themselves

People can ask for access to their personal data, and CCTV footage is no exception. PDPC’s guidance says:

• You generally must provide access, unless an exception applies
• You can ask for details to locate it, such as the date, time and location, and ask why they want it
• You can choose a cost-effective format, such as a printout, an extract or a supervised viewing
• You can charge a reasonable fee for a copy
• Other people must normally be masked, unless an exception applies or they consent
• Footage should be provided at the resolution you hold it

Deletion is different. The PDPA doesn’t require you to delete footage just because someone asks, though your retention period still applies.

Keep footage secure

CCTV footage is covered by the PDPA’s requirement to make reasonable security arrangements to protect personal data. Basic steps:

• Limit access to the recorder and footage to people who need it
• Change default passwords on cameras and recorders, and keep their software updated
• Log exports. Note who copied footage, when and why.

Quick checklist

• Notices at entrances saying CCTV is in operation, with a contact for questions
• No cameras where people expect privacy
• Staff told about CCTV in the employee handbook or HR policy
• A written retention period, with the recorder set to overwrite on schedule
• A process for handling requests to view footage, including masking others
• Recorder access limited and default passwords changed