New Privacy Regulations Affecting CCTV Installations in 2026

Key Regulatory Changes

Several jurisdictions have introduced updated regulations in 2026 governing the use of video surveillance. These include stricter requirements for signage indicating surveillance areas, mandatory data retention limits (typically 30-90 days), and stronger consent requirements for capturing footage beyond the property boundary.

The regulations particularly affect high-traffic areas like retail stores, shopping centres, and public-facing businesses. Systems that capture images of public sidewalks or neighbouring properties now face additional scrutiny and may require privacy masking.

Compliance Requirements

All CCTV systems must now display clear signage at every entrance and at regular intervals within the surveilled area. Signs must include the data controller's contact information, the purpose of surveillance, and information about data subject rights.

Businesses must conduct and document Data Protection Impact Assessments (DPIAs) before installing or upgrading surveillance systems. This includes mapping camera positions, justifying the purpose of each camera, and identifying privacy mitigation measures.

Best Practices for Compliance

Use privacy masking to block out areas beyond your property boundary. Configure motion zones to exclude public spaces where possible. Limit recording resolution in non-critical areas to balance security needs with privacy obligations.

Establish a clear data retention and deletion policy. Most new regulations require that footage be deleted within 30 days unless it is part of an active investigation. Implement automatic deletion policies in your NVR or VMS software.