Does the Privacy Act apply to my CCTV?
Yes, if your cameras capture identifiable people. The Office of the Privacy Commissioner (OPC) states that CCTV records footage of people, which can be stored, shared or changed, so how you use it must comply with the Privacy Act 2020. The Act applies to "agencies", which includes businesses, schools and organisations of every size.
Before you install: decide and document
The OPC says that before installing cameras you need to know:
- your purpose for using CCTV
- whether the cameras need to record audio as well as video
- how you will use the footage
- how you will tell people the cameras are there
- who can access the cameras and footage
- how long footage will be kept
- how it will be kept secure
- how you will handle someone asking to see footage of themselves
The OPC recommends a Privacy Impact Assessment (PIA) and publishes guides and templates for it. A PIA does not need to be long for a small site, but writing these answers down and turning them into a short CCTV policy is good practice and helps if your system is ever questioned.
The privacy principles that matter most for CCTV
Purpose and necessity (IPP 1)
Collect personal information only for a lawful purpose connected with your business, and only if it is necessary for that purpose. Theft prevention, staff safety and investigating incidents are common purposes. The OPC advises collecting the least amount of information you can.
Telling people (IPP 3)
People need to know they are being recorded. Most businesses use signs. The OPC says signs should be clear and obvious, say who owns and operates the system, and give contact details if that is not already obvious. If you record audio, you must tell people.
Fair and not unreasonably intrusive (IPP 4)
CCTV cannot be used in a way that is unlawful, unfair or unreasonably intrusive. The OPC says cameras should not record audio if video is enough, and should not move if a fixed view will do. Areas where people expect privacy, such as toilets and changing rooms, are generally not appropriate places for cameras. Hidden cameras are only justified in limited situations and need a very strong case.
Security (IPP 5)
Protect footage from loss and misuse: limit access to authorised people, use individual logins, secure the recorder physically and keep remote access locked down.
Access requests (IPP 6)
People have the right to ask for personal information about themselves, and that includes CCTV footage. The OPC's guidance is that your starting point should be to give the person access to footage that identifies them. The first step is to secure the footage immediately so it is not overwritten. You can crop or pixelate other people to protect their privacy, and the OPC is clear that not having the technology to redact footage is not a good reason to refuse access. Check the requester's identity before releasing anything.
Retention (IPP 9)
Do not keep footage longer than you need it for your purpose. The OPC recommends securely disposing of information once it is no longer needed. Set a defined retention period on your recorder so old footage is overwritten automatically, and preserve specific clips only when there is a reason, such as an incident or an access request.
Disclosure (IPP 11)
Only share footage in ways the Act allows, for example with Police when it is needed to help prevent, detect or investigate an offence. Keep a record of what you shared, with whom and why.
What changed in 2026: IPP 3A
The Privacy Amendment Act 2025 added a new principle, IPP 3A, which came into force on 1 May 2026. It requires agencies that collect personal information indirectly (from someone other than the person concerned) to take reasonable steps to tell that person, unless an exception applies. Most businesses' own CCTV is direct collection, but if you receive footage or personal information from another organisation, such as a landlord, neighbouring business or another agency, check the OPC's IPP 3A guidance.
Privacy breaches
If footage is hacked, leaked or shared inappropriately, that can be a privacy breach. Under the Privacy Act 2020, a breach that has caused, or is likely to cause, serious harm must be notified to the Privacy Commissioner and the affected people as soon as practicable. Good system security is the best prevention.
A practical checklist
- Write down why you need each camera and what it should see.
- Aim cameras at your own property and avoid neighbours' windows and private spaces.
- Turn audio recording off unless you have a strong, documented reason.
- Put clear signs at entrances saying CCTV operates, who runs it and how to contact you.
- Tell staff about workplace cameras and include them in your policies.
- Set a retention period on the recorder and limit who can view and export footage.
- Use individual logins, change default passwords and keep firmware updated.
- Have a simple process for access requests and Police requests.
When we install CCTV, we set systems up to support this: audio off by default, individual user accounts, defined retention and camera views agreed with you.
Frequently asked questions
Do I legally need CCTV signs in New Zealand?
Can my business CCTV record audio?
How long should we keep CCTV footage?
Someone has asked for footage of themselves. What do we do?
Can we give footage to the Police?
Sources
- Office of the Privacy Commissioner, CCTV
- Office of the Privacy Commissioner, Responding to access requests for CCTV footage
- Office of the Privacy Commissioner, Are there any rules about where CCTV can be used?
- Office of the Privacy Commissioner, IPP3A: notification requirements for indirect collection
- New Zealand Legislation, Privacy Act 2020 and Privacy Amendment Act 2025
This guide is general information, not legal advice. For your specific situation, see the Privacy Commissioner's guidance or get legal advice.