How Long Should New Zealand Businesses Retain CCTV Footage?

CCTV footage retention in New Zealand is not a question with one standard number for every business. The useful answer comes from purpose: why was the footage collected, how long is it genuinely needed for that purpose, and what happens when a particular clip becomes relevant to an incident? A thoughtful policy reduces privacy exposure, storage cost and confusion while preserving evidence when there is a valid reason to do so.

This guide provides an operational framework rather than legal advice. Businesses should check the rules that apply to their sector and circumstances and obtain specialist guidance when needed.

Understand the official starting point

The Office of the Privacy Commissioner explains that the Privacy Act does not prescribe a general minimum retention period. Its official retention guidance says an organisation should not keep personal information longer than it has a lawful purpose for keeping it, while recognising that another law or regulation may require certain records to be held for a particular period.

Information privacy principle 9 is the key reference for ordinary CCTV policy. The Commissioner’s Principle 9 summary says an agency must not keep personal information longer than required for the purposes for which it may lawfully be used. That points businesses towards a justified, documented period rather than an arbitrary “keep everything” default.

Map purpose to a workable period

Start with discovery time

Consider how soon the type of event is normally discovered and reported. An after-hours break-in may be obvious the next morning. Stock discrepancies may emerge during a weekly count. A delivery dispute might surface when an invoice is reconciled. Use evidence from real processes instead of picking the recorder’s maximum capacity.

Separate routine footage from preserved incidents

Routine footage can follow an automatic deletion cycle. When an authorised person identifies footage connected with a reported incident, the business may need a controlled way to preserve only the relevant segment while the matter is handled. Record why it was preserved, who approved it, where it is stored, who may access it and when the need will be reviewed.

This distinction prevents one exception from quietly changing the rule for every camera. It also makes storage forecasting easier: the main archive remains predictable, while a much smaller incident library receives individual review dates.

Create a retention decision worksheet

For each camera group or use case, capture the following:

• the specific purpose and people or property the view covers;
• how quickly relevant events are usually reported;
• who owns the footage and approves exceptions;
• the proposed automatic deletion period and reasoning;
• any sector-specific requirement that has been checked;
• how a relevant clip is preserved, reviewed and ultimately deleted; and
• how people are informed about the retention approach.

A retail entrance, remote farm gate and high-risk loading area do not necessarily need the same setting. Group cameras by a shared purpose rather than forcing a single period across the whole organisation. Keep the result readable enough for managers and operators to follow.

Make the technology enforce the policy

A policy that relies on someone remembering to delete files will drift. Configure automatic overwrite or deletion, then test it. Confirm whether copies exist on recorders, cloud services, phones, exported drives or email attachments. Deleting the main recording does not remove uncontrolled duplicates.

Limit export permission, use individual accounts and keep a log of preserved clips. Protect recordings during storage and transfer, and include backup behaviour in the design. The Privacy Commissioner’s broader CCTV guidance recommends deciding how long information will be kept, how it will be secured and who can access it before cameras are installed.

Plan capacity after setting policy

Storage depends on camera count, resolution, frame rate, compression, recording schedule and scene activity. Decide the justified period first, then ask a supplier to size capacity with stated assumptions and a margin for normal variation. Smart event detection may improve review efficiency, but do not assume it automatically changes what is recorded or deleted. Confirm the actual system behaviour.

Review camera compatibility if existing equipment will feed the system, and read how Surnexo works to understand the alert workflow around recorded video. Ask how offline cameras, full disks and failed deletions are reported; silent failures undermine both security and governance.

Review the policy, not just the storage meter

Set a review date and revisit the policy after material changes such as new analytics, longer opening hours, extra sites or a changed incident process. Sample cameras to confirm deletion occurs when expected. Review preserved clips and close those with no remaining purpose. Train staff so they know not to download or share footage casually.

A defensible retention approach connects purpose, discovery time, controlled exceptions and reliable deletion. If you want help translating those decisions into a camera and storage design, request a quote for a tailored assessment.