In this guide · 8 sections
Short answer
CCTV is allowed under the PDPA. In areas open to the public you can usually rely on the publicly available exception; for private and staff areas, use the legitimate interests or employment exception and tell people. Put up notices, mask other people when giving out footage and delete old recordings.
Is CCTV allowed under the PDPA?
Yes. The PDPC's Advisory Guidelines on the PDPA for Selected Topics (revised 17 May 2022, chapter 4) cover CCTV in detail. The rules apply whether cameras record video only or video and audio. What changes is the legal basis you rely on, which depends on where the camera points.
| Where the camera is | Usual basis under the PDPA | Notice |
|---|---|---|
| Shop floor, reception, lift lobby (open to the public) | Publicly available data exception | Good practice |
| Storeroom, back office, corridors not open to the public | Legitimate interests exception, after a risk assessment | Required: tell people you rely on it |
| Staff-only work areas | Employment exception, for safety and security | Required: tell staff the purpose |
| Private rooms (e.g. treatment or karaoke rooms) | Usually consent | Required, clearly |
This guide is general information, not legal advice. For unusual set-ups, such as cameras with audio in consultation rooms, take advice and read the guidelines yourself.
CCTV notices: where and what to say
The PDPC says notices should give people sufficient awareness that CCTV is in use. The PDPA does not prescribe the wording, and you do not have to reveal the exact location of each camera; a notice for the general area is enough. Even where consent is not needed, the PDPC encourages notices as good practice.
- Place signs at entrances and before people enter covered areas, at eye level.
- Say that CCTV is in operation and why, for example security and safety.
- Give a contact for questions, such as your Data Protection Officer's email.
- Mention CCTV in your website privacy policy and, for staff, in the handbook.
If your cameras also catch the corridor or pavement outside, the PDPC says that is not prohibited, but keep coverage to what is reasonable for your purpose.
CCTV in the office: monitoring staff
For workplace cameras, the PDPC says you can rely on the employment exception if the purpose is managing the employment relationship, such as workplace safety and security. You still have to tell employees the purpose, for example in the employee handbook or HR policies. Consent is not required in that case, but notification is.
Be careful about scope creep. Cameras installed for security and then used to judge someone's performance is a different purpose. If you want to use footage for something new, update your notice first. Avoid cameras in toilets, changing rooms and similar private spaces.
Responding to a CCTV footage access request
People generally have the right to their own personal data, including footage of themselves. The PDPC's guidance sets out how to handle it.
Ask for the date, time, place and purpose
You may ask why they want it and for details, so you can find the right footage and choose the cheapest way to give access: a still, a clip or a supervised viewing.
Check the exceptions
You can refuse in limited cases, for example if access could threaten another person's safety. The PDPC expects strong reasons if you refuse because it would compromise your security arrangements.
Mask other people unless an exception applies
Section 21(3)(c) requires masking other individuals, unless you could disclose their data without consent anyway (for example, footage of a public area) or they consent. The PDPC notes solid masking is safer than blurring or pixelation.
Point to better routes where they exist
If footage is for a police report, you can tell the person the police can obtain it directly once investigations start.
Provide it, and charge only a reasonable fee
Give footage at the resolution you hold. You may charge a reasonable fee for copying. Aim to respond within 30 days, or tell the person within that time when you can.
You do not have to delete footage just because someone asks; the PDPC says the PDPA has no such requirement. But you must stop keeping it once it no longer serves your purpose.
How long to keep CCTV footage
The PDPA does not set a fixed number of days. Section 25 says you must stop keeping personal data once the purpose is no longer served and there is no legal or business need. For most shops and offices, that means a rolling period long enough to notice and investigate an incident, then automatic overwrite.
Decide your period, write it in your data protection policy and set the recorder to overwrite automatically. When an incident happens, export just the relevant clip and store it securely until the matter is closed.
Securing your DVR or NVR and camera app
The PDPA's Protection Obligation requires reasonable security for personal data, and a camera system is a computer on your network. CSA's Cybersecurity Labelling Scheme page notes that IP cameras were among the devices used in the 2016 Mirai botnet attacks.
CCTV system security checklist
If footage leaks because of a weak password, that can be a notifiable data breach. Our guide to PDPA data breach notification covers what happens next.
Do it yourself or get help?
Most of this is paperwork plus a few settings. Put up signs, add a CCTV section to your privacy and staff policies, set retention, change default passwords and decide who handles access requests. Our PDPA checklist for small businesses shows where CCTV fits, and if you have not named a DPO yet, see appointing a Data Protection Officer.
If you want help, our PDPA Compliance Pack (S$690) produces your privacy policy, staff data protection policy and breach plan, including a CCTV section. A Security Health Check (S$290) reviews your domain, email and workspace settings with a written fix list. We are not a law firm and we do not install cameras; your installer handles hardware, and we focus on the data and account side.
Frequently asked questions
Usually not for areas open to the public. The PDPC says you can rely on the publicly available data exception there, although putting up notices is good practice. For areas not open to the public you need another basis, such as legitimate interests or the employment exception, and you must tell people.
Yes, for purposes such as workplace safety and security. The PDPC says you can rely on the employment exception to consent, but you must tell staff the purpose, for example in the employee handbook. Do not put cameras in private spaces such as toilets or changing rooms, and do not use footage for unrelated purposes.
Generally yes, unless an exception in the PDPA applies. You can ask for the date, time and purpose, provide stills or a clip, and charge a reasonable fee. Other people in the footage must be masked unless an exception applies, such as footage of a public area, or they consent.
The PDPA does not set a fixed period. You must stop keeping footage once it no longer serves its purpose and there is no legal or business reason to keep it. Choose a rolling period suited to your business, write it in your policy and set the recorder to overwrite automatically.
No. The PDPA does not prescribe the content of CCTV notices, and the PDPC does not require you to show where each camera is. A clear sign saying CCTV is in operation, the purpose, and who to contact with questions is usually sufficient for most shops, offices and clinics.