How Long Should CCTV Footage Be Kept? A Practical Storage Guide for Singapore Businesses

Quick answer: there is no single CCTV retention period that suits every Singapore business. Set a documented period based on why the footage is collected, how long incidents may take to be discovered, relevant legal or business needs, and the amount of storage available. The PDPC explains that the PDPA does not prescribe one fixed duration for all personal data; organisations should stop retaining personal data when it is no longer needed for business or legal purposes. See the PDPC data protection obligations for official guidance.

1. How many days of CCTV footage should you keep?

Start with the time it normally takes your team to notice and investigate an incident. A store that reconciles stock daily has different needs from a warehouse that may only discover a delivery discrepancy several weeks later. Then document why the chosen period is appropriate and review it when operations change.

The following are illustrative planning examples, not statutory requirements or guarantees. They are starting points for a site discussion, not a rule that every business must follow.

Do not automatically choose the longest period. Retaining footage for longer uses more storage and increases the amount of personal data your organisation must protect. If a specific incident, claim or investigation requires preservation, place the relevant clip under a documented hold rather than keeping every recording indefinitely.

2. What affects CCTV storage capacity?

Retention depends on more than the hard-disk size printed on a quotation. Main factors include:

• Number of cameras: every additional stream adds recording data.
• Average bitrate: higher bitrate generally produces larger files; bitrate changes with resolution, frame rate, compression and scene activity.
• Recording schedule: continuous 24/7 recording usually needs more space than motion-triggered recording, although motion recording can miss context if configured poorly.
• Compression and image settings: H.265 may reduce data use versus less efficient settings in supported systems, but actual savings depend on the scene and configuration.
• Audio and extra streams: where enabled, these can add to storage use.
• Usable disk capacity: formatting, recording-system requirements and any RAID arrangement can reduce capacity available for video.

3. Estimate storage with a simple calculation

For a rough estimate of continuous recording, a stream averaging 1 Mbps uses about 10.8 GB per day using decimal units, before allowances for overhead and system-specific differences.

If recording is not continuous, this simple estimate needs to be adjusted for the actual recording schedule and activity. Always compare the estimate with the NVR or VMS manufacturer's storage calculator and validate retention after installation.

Worked example: 16 cameras for 30 days

Assume 16 cameras, each averaging 2 Mbps, recording continuously for 30 days:

Add a planning allowance of 20%:

This is an illustrative estimate, not a product recommendation. Real-world bitrate varies with movement, image complexity, frame rate and configuration. Drive manufacturers commonly express capacity in decimal TB, while a recorder may show a different usable figure. Check the actual usable storage and recording calculation before selecting a drive size.

4. Continuous recording or motion recording?

Continuous 24/7 recording

Continuous recording creates a more complete timeline and can be suitable for key entrances, cashier areas, loading bays or other points where the sequence before an incident matters. It usually requires more storage and bandwidth.

Motion-triggered recording

Motion recording can reduce storage consumption in quieter spaces, but the result depends on detection zones, sensitivity, lighting and how well the camera distinguishes relevant movement. Test the setup at different times of day and include pre-event and post-event recording where supported and appropriate.

A mixed approach may be suitable for some sites, but do not reduce recording on a critical camera solely to save disk space without assessing the risk of missing useful context.

5. Retention is only useful if you can find the footage

A system may have enough storage on paper but still be frustrating to use. Test these everyday tasks:

• Search a specific date and time without guessing which timeline to use.
• Confirm the NVR, cameras and other systems use synchronised time.
• Export a clip in a usable format, including the player or verification details needed for review where available.
• Check playback remotely over the site's actual network connection.
• Confirm that export permissions are limited to authorised users and that exported files are stored securely.

6. Protect important footage and plan for equipment failure

Surveillance-rated hard drives are designed for the workload of compatible recording systems, but no hard drive is immune to failure. Check recorder health alerts, storage status and recording gaps regularly. A drive fault that goes unnoticed can leave a system recording fewer cameras—or none at all.

• Choose drives and capacities supported by the exact NVR model.
• Enable storage-health alerts if the system supports them and assign someone to review the alerts.
• Check actual retention periodically, rather than assuming the setup still meets the target.
• For incidents that require preservation, export and securely store the relevant clip under an approved process.
• Remember that RAID, where used, may help system availability but is not a separate backup by itself.
• Protect recorder access with unique credentials, appropriate permissions, updates and secure remote access.

7. Singapore privacy and retention considerations

CCTV footage may contain personal data. For organisations subject to the PDPA, the PDPC's Retention Limitation Obligation says organisations should cease retaining personal data, or remove the means of associating it with identifiable people, when the purpose is no longer served and retention is no longer necessary for legal or business purposes. The PDPA does not set one universal retention duration for every organisation, and other legal or industry-specific requirements may apply. Read the PDPC data protection obligations and Advisory Guidelines on Key Concepts.

• Document the purpose for CCTV use, who may access recordings and how footage is handled.
• Use appropriate signage and notices, and make the purpose of surveillance clear where required.
• Set a defined retention schedule and review whether continued storage remains necessary.
• Restrict viewing and exports to authorised people, and protect footage against unauthorised access or disclosure.
• Use an incident hold process for clips needed for a claim, investigation or legal matter; document the reason and review the hold periodically.

This section is general information, not legal advice. Businesses should assess the specific circumstances and any sector-specific or contractual rules that apply to them.

8. Common CCTV storage mistakes

• Buying a disk based only on camera count without estimating average bitrate and target days.
• Assuming the camera's advertised resolution alone determines recording size.
• Using motion recording without checking whether useful events are consistently captured.
• Failing to check whether the real retention period matches the written target.
• Keeping footage indefinitely without reviewing the purpose or necessity.
• Assuming a RAID disk array is a backup for important incident clips.

9. CCTV storage planning checklist

1. Write down the purpose of each camera and the required retention period.
2. Estimate storage using camera count, average bitrate, recording hours and target days.
3. Add a reasonable headroom allowance and verify the recorder's usable capacity.
4. Confirm the HDD model and capacity are compatible with the NVR.
5. Test playback, export, time synchronisation and remote access.
6. Document retention, access permissions, incident holds and periodic review.
7. Check actual oldest available footage after the system has been operating under normal conditions.

Frequently asked questions

Is there a fixed legal number of days that every Singapore business must keep CCTV footage?

No single PDPA retention duration applies to every business. Organisations should assess the purpose, reasonable business needs and any other applicable legal or sector-specific requirements, and stop retaining personal data when it is no longer needed.

Does a larger hard drive always mean longer retention?

Not necessarily. Actual retention also depends on bitrate, the number of recording streams, recording schedule, overhead and usable recorder capacity. Calculate and verify the expected result.

How can I check whether my system keeps footage for 30 days?

After the system has run under normal conditions, check the oldest available recording on each relevant camera and repeat the check periodically. Use recorder health and recording-status tools if available.

Should important incident clips be kept after normal footage is overwritten?

Where a clip is needed for an incident, claim or investigation, follow a documented preservation process, restrict access and review the reason for continued retention. Avoid extending the retention of all routine footage when only a specific clip is required.