How Long to Keep CCTV Footage in Australia: Legal Requirements and Best Practice

One of the most common questions we are asked by both homeowners and businesses is: how long should we keep our CCTV footage? The answer depends on a combination of legal requirements, industry guidelines, your specific situation, and practical storage considerations. Australian law does not prescribe a single universal retention period for CCTV footage, which creates confusion. This guide cuts through that confusion with clear, practical guidance.

We have structured this article to cover the legal framework first (what you are required to do), followed by industry best practice (what you should do), and finally the practical storage implications (what it costs to do it). Whether you are running a residential security system or managing cameras across a commercial operation, this guide provides the information you need to set an appropriate retention policy.

The Legal Landscape: An Overview

Australia does not have a single, unified piece of legislation that governs CCTV footage retention for all contexts. Instead, the requirements come from a patchwork of federal and state laws, industry-specific regulations, and common law principles. The key pieces of legislation are:

• Australian Privacy Act 1988 (Cth): Applies to organisations with annual turnover above $3 million, health service providers, and Australian Government agencies. It does not directly apply to most residential CCTV or small businesses, but its principles influence best practice across the board.
• State and territory surveillance legislation: Each state has its own surveillance devices legislation that governs the installation and use of cameras and recording devices.
• Workplace surveillance laws: Several states have specific legislation governing employer surveillance of employees.
• Industry-specific regulations: Certain industries (licensed premises, gaming, critical infrastructure) have specific CCTV requirements including mandated retention periods.

State-by-State Legal Requirements

The legal framework for CCTV varies by state and territory. Here is a summary of the key provisions relevant to footage retention in each jurisdiction:

South Australia

South Australia's Surveillance Devices Act 2016 replaced the earlier 1972 Act and governs the use of optical surveillance devices including CCTV cameras. Key provisions:

• You may install and operate CCTV on your own property without specific approval.
• Cameras must not be positioned to record areas where people have a reasonable expectation of privacy (neighbouring properties, shared areas in apartment complexes).
• Audio recording has stricter requirements — at least one party to a conversation must consent to recording.
• There is no mandated minimum retention period for general residential or commercial CCTV in SA.
• Licensed premises (pubs, clubs, bars): Under the Liquor Licensing Act 1997 and associated conditions, venues are typically required to retain CCTV footage for a minimum of 28 days and make it available to police on request.

New South Wales

The Surveillance Devices Act 2007 (NSW) and the Workplace Surveillance Act 2005 (NSW) are the primary statutes. NSW requires that employers notify employees of any workplace surveillance and provide 14 days' notice before covert surveillance commences. There is no general mandated retention period for commercial CCTV, but licensed premises under the Liquor Act 2007 are typically required to retain footage for 30 days.

Victoria

The Surveillance Devices Act 1999 (Vic) governs the use of optical and listening devices. Victoria has some of the strictest surveillance laws in Australia, particularly regarding audio recording (all-party consent is generally required for private conversations). For CCTV footage retention, there is no general mandated period, but licensed premises are typically required to retain footage for 28 to 30 days under liquor licensing conditions.

Queensland

Queensland's Invasion of Privacy Act 1971 governs listening devices and surveillance. Queensland has relatively permissive CCTV laws for visual-only recording on your own property. Licensed premises must retain footage for a minimum of 30 days. The Information Privacy Act 2009 (Qld) applies to Queensland government agencies and imposes storage and handling requirements on their CCTV footage.

Western Australia

The Surveillance Devices Act 1998 (WA) governs the use of surveillance devices. WA allows visual surveillance on your own property without specific consent requirements. Licensed premises are typically required to retain footage for 28 days under licensing conditions. There is no general mandated retention period for other commercial CCTV.

Tasmania, ACT, and Northern Territory

These jurisdictions have their own surveillance devices legislation with broadly similar provisions to the larger states. None mandates a specific retention period for general residential or commercial CCTV. Licensed premises in each jurisdiction have specific retention requirements under their respective liquor licensing frameworks, typically 28 to 30 days.

Australian Privacy Act Considerations

The Privacy Act 1988 does not apply to most residential CCTV users or small businesses with turnover under $3 million. However, for organisations that are covered by the Act, several Australian Privacy Principles (APPs) are directly relevant to CCTV footage:

APP 11: Security of Personal Information

Organisations must take reasonable steps to protect personal information (including CCTV footage containing identifiable images) from misuse, interference, loss, and unauthorised access, modification, or disclosure. This means CCTV recordings must be stored securely, with access limited to authorised personnel.

APP 4: Dealing with Unsolicited Personal Information

If your CCTV system captures footage of people who are not the subject of your surveillance (passers-by on a public footpath, for example), you must handle that information in accordance with the APPs even though you did not solicit it.

APP 11.2: Destruction or De-Identification

If an organisation no longer needs personal information for any purpose for which the information may be used or disclosed under the APPs, it must take reasonable steps to destroy the information or ensure it is de-identified. In practical terms, this means you should not retain CCTV footage indefinitely — once the retention period has passed and the footage has no ongoing purpose, it should be deleted.

For organisations covered by the Privacy Act, failing to manage CCTV footage in accordance with the APPs can result in complaints to the Office of the Australian Information Commissioner (OAIC) and potential regulatory action.

Industry Best Practice: Recommended Retention Periods

In the absence of a universal mandated retention period, industry bodies and security professionals recommend retention periods based on the typical timeframe within which incidents are reported and investigated. The following recommendations represent the consensus of Australian security industry associations and are informed by practical experience.

Storage Calculations: How Much Space Do You Need?

The amount of storage required for a given retention period depends on three main variables: the number of cameras, the resolution and compression settings, and the recording mode (continuous or motion-triggered).

Storage Per Camera Per Day

These figures assume H.265+ compression, which is the current industry standard for efficient video storage. Older systems using H.264 compression require approximately 40 to 50 percent more storage for the same footage quality. The range within each row reflects differences in scene complexity (a camera pointed at a busy street generates more data than one pointed at a static wall) and frame rate settings.

Total Storage by System Size and Retention Period

Motion-only recording can reduce these figures by 40 to 60 percent, making longer retention periods more affordable. However, motion-only recording has a trade-off: events that occur during the brief transition before motion detection triggers may be partially or completely missed. For critical positions (entry points, high-value areas), continuous recording is recommended. For lower-priority positions, motion-only recording is a reasonable compromise.

Cloud vs Local Storage

CCTV footage can be stored locally (on an NVR or DVR at your premises), in the cloud (on remote servers), or using a hybrid approach.

Local Storage (NVR / DVR)

• Advantages: No ongoing subscription cost, fast access to footage, not dependent on internet speed, footage remains under your physical control.
• Disadvantages: Vulnerable to physical theft or damage (if an offender takes the NVR, you lose all footage), limited by hard drive capacity, requires periodic hard drive replacement (typically every three to five years for surveillance-grade drives).
• Cost: A 4TB surveillance-grade HDD costs $120 to $180. An 8TB HDD costs $200 to $350. NVRs typically accommodate two to four HDDs.

Cloud Storage

• Advantages: Footage is off-site and survives physical incidents (theft, fire, flood), accessible from anywhere, scales without hardware changes.
• Disadvantages: Ongoing subscription cost, dependent on upload speed (a four-camera 4MP system generating 100+ GB/day requires substantial upload bandwidth), potential privacy and jurisdictional concerns about where data is stored.
• Cost: $10 to $50/month per camera for commercial cloud CCTV platforms. Some platforms charge per GB of storage rather than per camera.

Hybrid Storage

The most robust approach combines local and cloud storage. All footage is recorded locally on the NVR for immediate access and retention. Critical events (motion-triggered clips, alarm events) are simultaneously uploaded to the cloud as a backup. This ensures that even if the NVR is stolen or damaged, the most important footage survives in the cloud.

Most modern NVR systems from brands like Hikvision and Dahua support hybrid recording out of the box, either through proprietary cloud services or integration with third-party platforms.

Practical Recommendations

For Adelaide Homeowners

A 30-day retention period covers the vast majority of residential scenarios. This gives you enough time to notice an incident, review the footage, and provide it to police if needed. A 2TB or 4TB NVR handles 30-day retention for most four to six camera residential systems with modern compression.

For Adelaide Small Businesses

30 to 60 days is appropriate for most small commercial operations. If your business handles cash, has significant stock, or is in a higher-crime area, lean toward 60 days. A 4TB to 8TB NVR covers this for systems with up to eight cameras.

For Licensed Premises

Your liquor licence conditions specify your minimum retention period (typically 28 to 30 days in South Australia). We recommend slightly exceeding this — 35 days provides a buffer that ensures you are always compliant even if the system's oldest footage is slightly older than the nominal retention period due to storage management.

For All Users

• Use H.265+ compression to maximise storage efficiency.
• Use motion-only recording on low-priority cameras to conserve storage.
• Set your NVR to overwrite the oldest footage automatically when storage is full (this is the default behaviour on most systems).
• If an incident occurs, immediately export and save the relevant footage to a separate device (USB drive, external HDD) so it is preserved even as the NVR continues to overwrite older recordings.
• Test your retention period periodically — check the oldest available footage on your NVR to confirm it matches your intended retention period.

Frequently Asked Questions

Am I legally required to keep CCTV footage for a specific period in South Australia?

For general residential and commercial CCTV, there is no mandated retention period in South Australia. Licensed premises are required to retain footage for 28 days under liquor licensing conditions. For all other users, retention is a matter of best practice rather than legal mandate.

Can police request my CCTV footage?

Yes. SAPOL can request access to your CCTV footage during a criminal investigation. In most cases this is a voluntary request, and cooperation is strongly encouraged. In some circumstances, police may obtain a warrant or court order compelling disclosure. If police request footage, export and provide only the relevant time period rather than giving access to your entire recording history.

How long should I keep footage after a reported incident?

If you have reported an incident to police, keep the relevant footage until the investigation is complete and any legal proceedings have concluded. This can take months or even years. Export the relevant footage to a separate storage device and retain it indefinitely until you are advised by police or your legal representative that it is no longer needed.

Does the Privacy Act apply to my home CCTV system?

The Privacy Act 1988 generally does not apply to individuals acting in a personal capacity. If your home CCTV is for personal/domestic security, the Privacy Act is unlikely to directly apply. However, state surveillance legislation (the Surveillance Devices Act 2016 in SA) does apply, and you should ensure your cameras are positioned appropriately and not recording areas where others have a reasonable expectation of privacy.

What happens if my NVR fails and I lose footage?

If your NVR's hard drive fails, all locally stored footage is lost. This is a key argument for hybrid storage (local + cloud backup). To mitigate this risk, use surveillance-grade hard drives (designed for 24/7 operation), monitor NVR health alerts, and consider cloud backup for critical cameras. Regular system maintenance, including periodic HDD health checks, reduces the risk of unexpected failure.

How The Alarm Guy Helps

When we design and install CCTV systems for Adelaide homes and businesses, we configure the storage and retention settings to match your specific requirements. We recommend appropriate hard drive sizes, set up compression and recording modes for optimal balance between footage quality and retention period, and ensure you understand how to manage and export footage when needed.

If you are unsure about your retention requirements — particularly for commercial or licensed premises — we can advise based on your industry and the specific conditions of your licence or insurance policy. We also set up cloud backup for clients who want the added security of off-site footage storage.