CCTV and the PDPA: Who Is Responsible for the Footage?

A camera pointed at a car park records number plates. A camera at a reception desk records faces. Both are personal data about identifiable people, which means the moment you switch the system on, you have taken on obligations under the Personal Data Protection Act 2010 — obligations that sit with you, the business that commissioned the system, not with the contractor who installed it.

Most CCTV quotations in Malaysia cover cameras, cabling, a recorder and labour. Very few cover any of what follows. That gap is worth closing before installation, not after somebody asks for a copy of the footage.

The distinction that decides everything

Malaysian data protection law separates the organisation that decides why and how personal data is processed from the organisation that merely processes it on instruction. If you decided to install cameras, chose where they point and set the retention period, you are the former. Your installer, and any monitoring company watching the feed, is the latter.

That matters because the obligations do not split evenly. The decision-maker answers for the system. So the questions to settle in writing are:

• Who holds the recordings? On a recorder in your building, on the installer’s cloud platform, or both?
• Who can access them, and how is that access logged? A maintenance login that can silently pull footage is a real exposure.
• What happens on termination? If the installer’s cloud holds twelve months of footage and you change supplier, what is deleted, when, and how is that confirmed?

Get those three answers as contract terms, not as verbal reassurance during commissioning.

Retention: pick a period and be able to justify it

There is no single legal number of days. The workable principle is that you keep footage as long as you have a reason to, and no longer. In practice most offices and retail sites settle somewhere between two weeks and a couple of months, driven by how long it typically takes for an incident to be noticed and reported.

What matters more than the exact figure is that the period is deliberate, documented and actually enforced by the system. A recorder that was set to overwrite at 30 days but has been quietly full for a year is a problem that only surfaces when someone requests footage, and by then you are explaining why you still hold six months of a former employee’s movements.

Ask the installer to configure the retention period, show you where it is set, and confirm that overwrite is working.

Notice is cheap and it is expected

People should be able to tell they are being recorded before they are. Signage at entrances is the ordinary way to do this, and it is inexpensive compared with everything else on the quote.

Two things worth specifying: the sign should identify who is operating the system and give a contact point, and the coverage should match the signage. Cameras pointing somewhere people reasonably expect privacy — changing areas, prayer rooms, toilets — are difficult to justify under any reading of the law, and no installer’s default layout should put one there.

Requests will come, and you have to be able to answer them

At some point someone will ask whether they appear on your footage, or ask you to hand a clip to an insurer, a lawyer, or the police. You need a process before that happens:

• Who inside your company decides whether to release footage.
• How you verify the person asking is who they say they are.
• How you redact or restrict a clip that also shows uninvolved people.
• How releases are recorded, so you can show what left the building and why.

Your installer can build the technical means for this — export, clipping, access logs — but only if you ask for it at the design stage. Retrofitting it onto a closed system is harder.

What to ask before you sign

Ask any CCTV supplier for: the storage location and whether any footage leaves your premises; the retention period, configured and demonstrated; the access list, including their own maintenance accounts; the export and audit-log capability; and the deletion commitment on termination.

None of this is exotic — a supplier who does commercial installations will have answered it before. If the answers only arrive after installation, you have already been operating the system without them.

---

This is a general guide to what to settle with a supplier, not legal advice. Requirements in this area have been amended in recent years, including changes to breach notification and data protection officer obligations — confirm the current position with the Personal Data Protection Department (JPDP) or your own adviser before relying on any of it.