Does the DPDP Act apply to CCTV cameras in my office, shop or housing society?

Question

Accepted Answer

Yes. Footage in which a person can be recognised is personal data under s.2(t), recording and storing it is "processing" under s.2(x), and a digital recorder puts it inside the Act under s.3(a). The Act never mentions CCTV and has no "legitimate interests" ground, so the real question is which lawful basis you are standing on. The one clean exit is s.3(c)(i): a camera an individual runs for a purely personal or domestic purpose is outside the Act. None of this is enforceable before 14 May 2027. Who is the Data Fiduciary Whoever decides why the cameras exist and how the system runs is the Data Fiduciary (s.2(i)): the shop owner, the company, or the society committee. The cloud DVR provider storing footage is a Data Processor (s.2(k)). You stay responsible for what it does "irrespective of any agreement to the contrary" (s.8(1)). The home camera carve-out s.3(c)(i) excludes "personal data processed by an individual for any personal or domestic purpose". A doorbell camera on your own flat fits. A committee's cameras over the lobby and parking do not: a committee is not an individual. A private camera that mostly watches a neighbour's door is the untested grey zone. Lawful basis: where GDPR habits mislead s.4(1) allows processing only with consent under s.6 or for a use named in the closed s.7 list. The European answer, legitimate interests plus signage, has no footing here. A sign is not consent either: s.6(1) needs a "clear affirmative action", and walking past a board is not one. Two textual hooks remain, both readings rather than holdings: Staff. s.7(i) permits processing "for the purposes of employment or those related to safeguarding the employer from loss or liability". Cameras on tills, stockrooms and entrances sit inside that. A camera in the staff rest area, or pointed at one desk all day, is much harder to fit. Customers, visitors and residents. The second limb of s.7(i) does not say the person filmed must be an employee, so shoplifting cameras are arguable under it. The stronger hook for a plain security camera is s.17(1)(c), which lifts Chapter II (except s.8(1) and s.8(5)) and Chapter III where "personal data is processed in the interest of prevention, detection, investigation or prosecution of any offence". The price is that the footage can be used for nothing else. Footfall analytics, attendance marking, marketing or face-recognition entry fall outside the exemption and need their own basis, which for strangers means consent. What you owe whichever route you take Security of the footage (s.8(5)). It survives every s.17(1) exemption. Rule 6 sets the floor: encryption or masking, access control, access logs, backups, and processor contracts that pass the duties on. Rule 6 is secondary-sourced here, so verify against the notified Gazette text. Retention. Under s.7(i), s.8(7) applies: erase footage "as soon as it is reasonable to assume that the specified purpose is no longer being served". For security footage that is a short rolling window. No rule fixes the days for CCTV operators (the Third Schedule under Rule 8 does not list them), so pick a period, write it down, and let the recorder overwrite. Breach notice (s.8(6)). A hacked DVR, leaked footage or ransomware locking the recordings is a "personal data breach" under s.2(u), which includes loss of access. Inside Chapter II, the Board and every affected person must be told. Under s.17(1)(c) the duty is lifted, one reason to document which basis you chose. A named contact (s.8(9)) and a grievance route (s.8(10)) inside Chapter II. The s.11 access right attaches only to consent-based and s.7(a) processing, so a resident has no DPDP right to footage of their own incident under s.7(i) or s.17(1)(c). Give it anyway. Children s.9(3) bars "tracking or behavioural monitoring of children". A play-area camera that happens to capture children is not tracking them; a system that follows or profiles under-18s is, and parental consent does not cure it. Schools get a limited carve-out under Rule 12 and the Fourth Schedule for safety-related processing (verify the Gazette text), but s.9(2), the bar on anything detrimental to a child's well-being, can never be exempted. Worked example: a 60-flat society Eight cameras: gate, two parking levels, four lift lobbies, the play area. A written resolution records the purpose as prevention and detection of offences and names s.17(1)(c) as the basis. Boards at the gate say what is recorded, why, and whom to contact. Two named committee members and the security supervisor can view footage, every view is logged, and recordings overwrite after 30 days. No microphones, no face recognition, no camera angled into any flat's door or window, no analytics on the play area. Footage leaves the system only to the police on a written request, which also sits inside s.17(1)(c). Penalties All ceilings, none predictions: up to Rs 250 crore for failing s.8(5) security safeguards, up to Rs 200 crore for a s.9 children's breach, up to Rs 50 crore for anything else, and only if the Board finds the breach "significant" under s.33(1). In April 2026 the government told the Rajya Sabha that AI-enabled CCTV falls within the DPDP framework. That is a policy statement; there is no Board jurisprudence on cameras yet. Not legal advice. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.