How Long Must a Factory Keep CCTV Footage in India?

There is no single number. No central Indian law fixes a CCTV retention period for factories. Your duration comes from whichever trigger applies: Karnataka's women-night-shift notification demands at least 45 days; a POSH complaint can arrive up to six months later; DPDP says erase once the purpose ends. A 30-day base with 90 days on sensitive zones covers most plants.

If you run a 200–1000 worker plant in India, you have probably been told "keep 30 days" by your DVR vendor and left it there. That number came from your hard disk, not from any statute. This page sets out where the real obligations come from, what each one demands, and what the extra days actually cost in rupees.

Key points

• No central retention rule exists for factories. Neither the OSH Code, 2020 — in force since 21 November 2025 — nor the Factories Act, 1948 it repealed ever specified a number of days of video.
• Karnataka is the clearest number in the country. Its 20 November 2019 notification permitting women on night shifts requires proper lighting and CCTV coverage inside and around the factory, with footage maintained "for a period of at least 45 days".
• Haryana mandates the cameras but sets no duration — and it is not a factories rule. The 13 October 2025 gazette notification is issued under the Haryana Shops and Commercial Establishments Act, 1958 and applies to shops and commercial establishments, not to factories. It requires "Closed Circuit Television (CCTV) videography and proper lighting" in and around the establishment — and is silent on how long you keep it. Silence is not permission to keep 3 days.
• Storing longer is now a legal cost, not just a disk cost. Under the DPDP Act, 2023 and the DPDP Rules notified 14 November 2025, worker faces are personal data and must be erased once the purpose is served.
• Rupee reality: budget roughly Rs 2,300 per TB of surveillance-grade disk (an 8 TB SkyHawk-class drive sits near Rs 18,000–19,000 at Nehru Place street prices — get a live quote before you commit). Thirty days of 40 cameras at 4 MP is about Rs 1.2 lakh of raw disk. Going to 90 days on all of them roughly triples it.
• The POSH window outruns most retention settings. A woman may file a sexual harassment complaint within three months, with a further three-month extension permitted in justified circumstances — up to 180 days. A 30-day DVR will have overwritten the evidence that would have cleared or convicted.

The Factories Act question, settled

Stop searching for a retention clause in the Factories Act, 1948. It does not have one, and as of 21 November 2025 the Act is repealed and subsumed into the OSH Code, 2020, which came into force along with the other three labour codes on that date.

The OSH (Central) Rules, 2026 prescribe conditions for employing women at night — written consent, safe transport to and from residence, well-lit premises, and functional CCTV surveillance. They prescribe the cameras. They do not prescribe the days.

Two practical consequences. First, the Central Rules bind central-sphere establishments; most private factories sit under their state OSH rules, and several states are still notifying theirs. Second, until your state notifies, the older state night-shift notifications — Karnataka 2019 for factories, Haryana 2025 for shops and commercial establishments, and the equivalents in Telangana and Tamil Nadu — remain the operative text your inspector will read from. See which Indian states require CCTV for women's night shifts for the state-by-state position.

Scenario x duration: what actually drives your number

Note the direction of the pressure. Every trigger except one pushes retention up. DPDP is the only one pushing it down — which is exactly why a written policy, not a default DVR setting, is what protects you.

The DPDP squeeze, and the one-year footnote

The DPDP Rules were notified on 14 November 2025 with a phased runway; the core substantive obligations — notice and consent, reasonable security safeguards — bite on 14 May 2027, eighteen months after publication. You have time, but not much.

Two things to know. Storage limitation means indefinite retention of shop-floor video is not defensible — "we keep everything forever" is now a finding, not a precaution. But Rule 6 on reasonable security safeguards cuts the other way for logs: a data fiduciary must "retain such logs and personal data for a period of one year, unless compliance with any law for the time being in force requires otherwise," so that unauthorised access can be detected and investigated. The safe reading for a factory: keep the continuous video for weeks, and keep the log of who viewed, exported and deleted it for a year. Most Indian NVRs do not log exports usefully — check yours. We go deeper on this in DPDP and worker CCTV.

What the days actually cost

Rough arithmetic for continuous H.265 recording, per camera:

A 40-camera 4 MP plant at 30 days needs roughly 52 TB — about seven 8 TB surveillance drives, around Rs 1.2–1.3 lakh of disk. Push all 40 to 90 days and you are near 156 TB, twenty drives, close to Rs 3.7 lakh, before RAID overhead or the bigger NVR chassis.

The tiered answer is much cheaper. Keep all 40 at 30 days, and extend only the 10 cameras that matter — gates, dispatch, weighbridge, the women's night-shift walkways — to 90 days. That is about 78 TB, roughly Rs 1.9 lakh. You have bought your 45-day Karnataka compliance and your 90-day POSH window for roughly Rs 60,000 more than the vendor default. Compare architectures in NVR vs cloud VMS in India and see what a factory camera AI system costs in India for the full budget picture.

A practical default policy

Write this down, sign it, and display the retention period on your camera notice boards:

1. 30 days on all cameras. This is the honest floor: below it, a production order under BNSS s.94 arriving three weeks after an incident finds nothing.
2. 90 days on gates, dispatch, weighbridge, stores, cash areas, and every route a woman on night shift walks. This clears Karnataka's 45 days with margin and matches the POSH primary window.
3. Event archive, indefinite until closed. The moment there is an injury, a theft, a POSH complaint or a buyer dispute, export the clip to a separate locked folder with a case number. Clips are megabytes; streams are terabytes. Long retention belongs to the small set of things that are actually contested — the same instinct behind the Supreme Court's directions on preserving CCTV recordings in police stations in Paramvir Singh Saini v. Baljit Singh (2020).
4. Log every export with name, date, reason, and case number. One register, kept a year, ready for DPDP.

What CCTV retention does not do for you

Be clear-eyed about the limits, because vendors will not tell you.

Longer retention creates evidence against you too. Ninety days of footage showing an unguarded press or workers without helmets is ninety days of proof that management could have known. If your plant has open safety gaps, fix the gap before you extend the retention — otherwise you are funding the plaintiff's case.

Footage nobody can search is not evidence. Thirty days across 40 cameras is roughly 29,000 camera-hours. When an incident is reported eleven days later with a vague time, a manual scrub costs days of someone's life and usually fails. Retention without search is a compliance prop, not a control.

Cameras cannot go everywhere. Washroom and changing-room interiors are out. The night-shift conditions are about lighting and coverage of the places women must move through in the course of the shift — not the inside of amenities. Placing a camera there converts a compliance measure into an offence.

Retention does not substitute for the rest of the night-shift conditions. Karnataka wants two female wardens per night shift, women in at least a third of supervisory roles, batches of not fewer than ten women, and escorted transport from residence. Haryana wants GPS-tracked transport, a control room or travel desk, and batches of not fewer than four. A perfect 45-day archive with no lady warden on the floor still fails the inspection. Work through the women's night-shift CCTV and retention checklist.

FAQ

Is 30 days of CCTV footage legally enough for an Indian factory? It depends on your state and your shift pattern. For a day-shift-only plant in a state with no specific notification, 30 days with a written policy is defensible. If you run women on night shifts in Karnataka, 30 days breaches the 45-day condition attached to your exemption. Check your state notification, not your DVR.

Does the OSH Code 2020 specify a CCTV retention period? No. The OSH Code, 2020, in force from 21 November 2025, and the OSH (Central) Rules, 2026 require functional CCTV surveillance as a condition for employing women at night, alongside written consent, safe transport and well-lit premises. Neither text fixes a number of days. State rules and older state notifications supply the numbers where they exist.

Can police force me to hand over factory CCTV footage? Yes. Under Section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023, a court or the officer in charge of a police station may issue a written order requiring production of a document or thing, including electronic records. You comply by producing the footage. If it has been overwritten, you explain why — and your written retention policy is the explanation.

Does DPDP mean I have to delete CCTV footage sooner? It means you need a stated purpose and a stated period, and you must actually erase on schedule. The core obligations apply from 14 May 2027. A documented 30/90-day tiered policy with an export log satisfies storage limitation far better than either indefinite retention or an undocumented three-day loop.

How much does 90 days of retention cost for a mid-size plant? For 40 cameras at 4 MP, roughly 156 TB, or about Rs 3.7 lakh of surveillance disk at current street prices. Tiering — 30 days everywhere, 90 days on 10 critical cameras — brings that to about Rs 1.9 lakh while still covering Karnataka's 45 days and the POSH window.

Should I keep footage for a full year for buyer audits? Not as continuous video. SMETA and IATF-driven audits work from records, not streams — SMETA document review typically covers the last 12 months of contracts, payroll and time-keeping records, and IATF 16949's retention clause covers quality records, not video. Keep continuous video for weeks, and keep exported clips tied to specific incidents, disputes and corrective actions for the full audit cycle.