A break-in, customer dispute or workplace incident can turn CCTV footage into critical evidence within minutes. The problem is that footage is often overwritten before anyone realises it is needed – or retained indefinitely without a clear reason. Understanding CCTV retention requirements Australia helps businesses protect their premises while managing privacy, storage and legal risk sensibly.
CCTV retention requirements in Australia: is there a set period?
There is no single Australia-wide rule that says every business must keep CCTV footage for a fixed number of days. A café, warehouse, strata complex, medical practice and construction site can all have different risks, obligations and reasons for using cameras.
For many private businesses, the practical principle is simple: retain footage only for as long as it is reasonably needed for the purpose it was collected. If footage is being used to deter theft, investigate incidents and support insurance claims, the retention period should allow enough time for those events to be identified and reported. Once it is no longer needed, it should be securely deleted or overwritten.
Businesses covered by the Privacy Act 1988, including many organisations with annual turnover above $3 million, must handle personal information in line with the Australian Privacy Principles. CCTV images can be personal information where an individual is reasonably identifiable. The principles require reasonable steps to protect information from misuse, loss and unauthorised access, and to destroy or de-identify it when it is no longer required.
Queensland government agencies, local councils and other public-sector bodies may have additional privacy and records-management duties. Some industries, lease agreements, client contracts and insurer conditions can also set expectations for footage retention. For that reason, a retention period should never be copied from another site without checking what applies to your operation.
This is practical guidance, not legal advice. If your site has specialist regulatory, contractual or workplace obligations, obtain advice tailored to the business.
Start with the reason you have CCTV
A workable retention period starts with a clear purpose. Cameras at a retail counter may be needed to investigate theft, refund disputes or aggressive behaviour. Cameras at a gated industrial yard may be required to review after-hours access, vehicle movements and damage that is only noticed days later. A camera focused on a residential entry may primarily help verify visitors or deliveries.
The longer it commonly takes for an incident to be noticed and reported, the longer footage may need to be kept. Consider your reporting process as well. If only one person can access recordings and they are away for a week, a very short overwrite period creates an obvious gap.
Many organisations use a retention period somewhere between 14 and 90 days as an operational starting point. That is not a legal default or a universal recommendation. A low-risk site with close daily oversight may only need a shorter period, while a remote facility, high-value stock area or site with delayed incident reporting may justify longer retention.
Avoid keeping everything forever simply because cloud storage is available. Indefinite retention increases the amount of personal information you hold, the potential impact of a cyber incident, and the time required to locate relevant footage when something happens.
Questions that help set the right period
Before setting a number, work through these practical questions:
- What incidents are the cameras intended to help investigate?
- How long does it usually take staff, tenants, customers or contractors to report an issue?
- Are there insurance, contractual or industry-specific requirements?
- Does the site close over weekends, public holidays or seasonal periods?
- Can a manager reliably check and save relevant footage before automatic overwrite occurs?
Your answers should be recorded in a short CCTV policy. This gives managers a consistent process and provides a clear reason for the retention setting if it is ever questioned.
Storage capacity affects what you can retain
Retention is not just a policy decision. It is also a system design issue. A recorder with limited storage may not hold the number of days you have chosen, particularly when cameras are upgraded or added later.
Camera resolution, frame rate, compression settings, recording hours and the number of cameras all influence storage use. A system recording high-resolution footage continuously across multiple cameras will fill its hard drives far more quickly than one using motion-based recording in low-traffic areas.
Motion detection can extend retention, but it needs careful setup. Trees moving in wind, heavy rain, vehicle headlights and insects around infrared lighting can trigger excessive recording. This is particularly relevant in Cairns and Far North Queensland, where weather and tropical conditions can make poorly configured motion alerts less useful and consume storage quickly.
A good installation includes a realistic storage calculation rather than a guess. It should also allow for likely growth. Adding four cameras after the initial installation can substantially reduce the retention period across the whole system if storage is not expanded at the same time.
Privacy and access matter as much as retention
A CCTV system should collect only what is needed to protect the site. Camera placement deserves attention. Cameras covering entry points, car parks, cash-handling areas, loading zones and perimeter gates are often easier to justify than cameras directed at neighbouring properties, private spaces or staff break areas.
Clear signage helps people understand that surveillance is in use and who operates it. The signs do not need to reveal every technical detail, but they should be visible before people enter the monitored area.
Access to live views and recordings should be limited to authorised people. Shared logins, generic passwords and unrestricted mobile app access make it difficult to know who viewed or exported footage. At a minimum, use individual user accounts where available, strong passwords and multi-factor authentication for remote access.
Audio recording requires extra caution. Conversations can attract separate legal and privacy considerations from video-only surveillance. If audio is not necessary for the stated purpose, disable it.
Create a retention policy your team can actually follow
A policy does not need to be lengthy, but it should remove uncertainty when an incident occurs. It should state the purpose of the cameras, the normal retention period, who can view footage, and how staff request access or report an incident.
It should also explain what happens when footage is relevant to an investigation, complaint, insurance matter or police request. Relevant footage should be exported and preserved before the normal overwrite cycle deletes it. Record the date, camera location, time range, reason for saving it and the person who accessed it. This basic evidence trail is valuable if footage is later relied on.
Automatic overwrite is usually the most reliable way to manage ordinary retention. It prevents old recordings being forgotten on a recorder or cloud account. However, check the system regularly. A failed hard drive, incorrect date and time, lost network connection or full storage volume can quietly undermine the policy you thought was in place.
Plan for requests, incidents and system changes
When an incident occurs, act quickly. Identify the relevant cameras and time window, preserve a copy in its original format where possible, and keep it securely. Do not edit the only copy. If a short clip is needed for easy viewing, retain the original export as well.
Requests to view footage need a controlled process. An individual may ask about footage containing their image, but access should be considered carefully because recordings may also show other people. Police requests, insurer requests and legal demands should be handled by an authorised manager, with the details documented.
Review the retention setting whenever the site changes. A business expansion, new loading area, longer operating hours, additional cameras or move to higher-resolution equipment can all affect storage and the period actually achieved.
For commercial sites, the best outcome is not the longest possible retention period. It is a system that captures useful evidence, holds it for a defensible period, protects it from unauthorised access and reliably preserves it when an incident matters. A properly planned CCTV system gives you that confidence without paying for storage you do not need.