How Many Days of CCTV Footage Should Your Business Keep? Retention Rules & Storage Math for India

Most Indian businesses should retain CCTV footage for a minimum of 30 days; several regulated categories — liquor retail, jewellery, banking touchpoints, fuel stations, schools and PG/hostels in some states — face 30–90 day requirements from licensing authorities, and insurers increasingly ask for 60–90 days when claims are involved. Retention is a storage-capacity decision, and the math is simple once you know your bitrate.

What the rules actually say

India has no single national CCTV retention law for private businesses; requirements come from state rules, licensing conditions and sector regulators:

• Licensing conditions: excise (liquor) licenses in several states mandate 30–90 days of footage; jewellers' associations and insurers commonly expect 90 days.
• State public-safety rules: some states require establishments above a size threshold (hotels, malls, hospitals, schools) to install CCTV and retain footage — commonly 30 days.
• Police & incident practice: investigating officers routinely request 30–45 days of history; footage overwritten in 7 days has repeatedly cost businesses in disputes and claims.
• DPDP Act 2023 angle: CCTV footage of identifiable people is personal data — keep it only as long as you need it for a stated purpose, secure it, and delete on schedule. Retention should be a documented policy, not an accident of hard-disk size.

Practical rule: 30 days minimum for any business; 90 days if you handle cash, valuables, alcohol, fuel, children or insurance-sensitive inventory. Confirm your specific license conditions with your local authority.

The storage math (why DVRs quietly keep only 6–10 days)

Storage needed = bitrate × hours × cameras. Per camera per day at typical H.265 settings:

• 2MP (1080p): roughly 10–20 GB/day continuous
• 4MP: roughly 20–35 GB/day continuous
• Motion-triggered recording cuts this by 40–70% for most business premises

So a 10-camera 4MP site recording continuously needs roughly 6–10 TB for 30 days. The 2TB disk your installer put in the DVR? That is 6–10 days before overwrite — which is exactly when you discover the incident from three weeks ago is gone.

DVR/NVR retention vs cloud retention

• Local (DVR/NVR): retention is capped by disk size; disks fail silently; and in thefts the recorder itself is the first thing taken — along with your evidence.
• Cloud: retention is a plan setting (7/30/60/90 days), not a hardware constraint. Footage survives theft, fire and disk failure; access is from anywhere with role-based control and audit logs. Bandwidth is the constraint to design for — roughly 2–4 Mbps upload per continuously streaming 2MP camera, less with event-based upload.
• Hybrid: local buffer + cloud for critical cameras (entrances, billing, vault) is a common cost balance.

Build a one-page retention policy (template)

1. Purpose: security of premises, staff and customers; incident investigation; regulatory compliance.
2. Retention period: X days per camera group (billing counters 90, general floor 30, perimeter 30) with the licensing basis noted.
3. Access: who can view live vs recorded; two-person rule for exports; audit log retained.
4. Incident holds: footage relevant to an incident is exported and preserved beyond normal retention.
5. Deletion: automatic overwrite/expiry at end of period; no informal copies.
6. Signage: visible "premises under CCTV surveillance" notices at entrances.

Frequently asked questions

How long is CCTV footage kept by default?

As long as the disk allows — typically 6–15 days on common DVR setups, which is why incidents older than two weeks are so often unrecoverable. Set retention deliberately.

Is 30 days of cloud CCTV storage expensive?

Costs have fallen sharply with H.265 and event-based upload; in a rental/SECaaS model, 30-day retention is usually bundled per camera rather than priced as raw gigabytes.

Can police demand CCTV footage?

Yes, with appropriate legal process — and producing it promptly is in your interest. Exported clips with timestamps and chain-of-custody notes carry more weight.

Does the DPDP Act apply to my shop's CCTV?

If footage identifies people (it does), treat it as personal data: stated purpose, limited access, defined retention, secure storage. A written one-page policy covers most of it.

This article is general information, not legal advice. Retention requirements vary by state, sector and license — verify your specific conditions with your local authority or counsel.