India Factory CCTV Compliance Calendar 2026: Every Deadline in One Place

There is no single "factory CCTV law" in India with one deadline. There are four separate regimes — a camera-certification ban, the OSH Code that replaced the Factories Act, the DPDP data-protection rollout, and state-by-state women's-night-shift rules — each on its own clock, run by a different ministry. This page pulls every dated obligation into one calendar, links each to its primary source, and is honest about the dates that are still "awaited" or that only exist state by state. Two dates already passed (the sale ban on 1 April 2026 and the OSH Code on 21 November 2025); the big one still ahead is DPDP's full compliance phase in May 2027.

If you run a 200–1000 worker plant somewhere between Coimbatore and Ludhiana, the problem is not that the rules are harsh. It is that they are scattered across MeitY, the Ministry of Labour, and your own state's factory inspectorate, and every installer WhatsApp forward mashes them into one panicked "replace everything by April." This is the calendar we keep for our own scoping work. Use it to see what has actually bitten, what is coming, and — just as important — where a confidently-quoted "deadline" turns out not to exist.

Key points

• Four regimes, four clocks. Camera certification (MeitY/STQC), workplace safety (OSH Code 2020), data protection (DPDP), and women's night-shift permissions (each state). They do not share a deadline and they are not enforced by the same people.
• The camera sale ban is already live. From 1 April 2026, no internet-connected CCTV camera can be sold in India unless the exact model meets the Essential Requirements (ER) for security under the BIS Compulsory Registration Order. The record to check today is the BIS "ER Certified CCTV" list (checked 16 Oct 2026). It binds manufacture, import and sale — not the cameras already on your wall.
• There is no by-name "Hikvision/Dahua ban" notification. The effective block on Chinese cameras runs through the ER certification regime, not through a separate order naming those companies. Government/critical procurement carries an additional, older restriction on land-border-country bidders.
• The Factories Act 1948 is gone. The OSH Code 2020 came into force on 21 November 2025; the OSH (Central) Rules were notified 8 May 2026. CCTV appears there only inside the women's-night-shift package.
• DPDP is the deadline still ahead. Full data-protection duties on your footage — notice, purpose, retention, security, breach reporting — bite in the third phase, on 14 May 2027. There is no headcount threshold: a single-shed unit is a full data fiduciary.
• Women's night-shift CCTV is state law, not central. Maharashtra, Gujarat, Karnataka and others have each notified their own conditions and retention windows on their own dates. There is no single national date.
• Some "deadlines" do not exist. There is no all-India Fire-NOC CCTV date and no blanket FSSAI CCTV mandate. We mark those honestly rather than invent one.

⚠️ This is a reference, not legal advice. Laws, notification numbers and dates change, and several items below are administered state by state. Verify every date against the primary source linked in its row, and confirm your own position with a qualified compliance advisor before you rely on it commercially.

The master calendar

Dates are given as notified. Rows are ordered by the date the obligation takes (or took) effect. "Applies to" separates the genuinely universal rules from the ones that only bite government buyers or specific states.

Regime 1 — the camera certification "ban" (MeitY / STQC / BIS)

This is the one every installer is calling you about, and it is the most misunderstood.

What is actually true: from 1 April 2026, an internet-connected CCTV camera cannot be legally sold in India unless the specific model carries BIS CRS registration under IS 13252 (electrical/fire safety) and meets the Essential Requirements for security (the cybersecurity layer notified by gazette Order S.O. 1652(E) on 9 April 2024). Since MeitY's circular W-18/26/2025-IPHW of 4 February 2026, STQC issues the ER test report under the Compulsory Registration Order, and STQC's older list of certified network cameras is frozen for historical reference. The live record is the BIS "ER Certified CCTV" list: on 16 Oct 2026 it showed 57 R-numbers carrying 927 ER model entries, plus 1,092 analogue models in a separate column. Recorders (NVRs and DVRs) need the BIS safety registration; the ER test is written for IP cameras. The MeitY Office Memorandum of 16 January 2026 withdrew the last relaxation for old stock, and there has been no further extension. Compliance is listed per model, not per brand — a "CP Plus quotation" proves nothing until the exact SKU resolves on the list. Mama's certified CCTV finder and certificate checker search both lists by exact model string.

What is a myth: that there is a standalone government order naming Hikvision, Dahua or TP-Link and banning them from critical infrastructure on 1 April 2026. There is no such by-name notification. The effect is a consequence of the ER regime, not a separate ban: on the BIS ER list checked 16 Oct 2026, no Hikvision or Dahua model appears in the security-ER column, and none of the five China-based R-numbers carries an ER model. Hikvision's 376 analogue models sit under Prama Hikvision India's R-71004456 (status Registered); 64 Dahua analogue models sit under R-71011460, whose status is Cancelled. Analogue cameras are outside the security ER, which is why those analogue listings exist at all. Reporting that says "India bans Chinese CCTV from 1 April" is describing the certification rule, correctly in substance but loosely in form. Treat the ER regime as the operative law.

The extra layer for government work: if you supply or bid public tenders, a separate and older restriction applies — the 23 July 2020 public-procurement order requiring bidders from land-border countries to register with the DPIIT Registration Committee and clear MEA/MHA. That, plus the February 2026 linkage of STQC ER test reports to the Make-in-India procurement order, is what actually keeps Chinese vendors out of government/critical projects. A purely private plant is not bound by the procurement order.

What it does not do: it does not force you to rip out working cameras. There is no retrospective clause and no inspection regime aimed at owners for holding older installed cameras. The rule bites the next time you buy. Analogue cameras are exempt from the security ER entirely (they still carry BIS safety registration). See do I have to replace my factory CCTV in 2026?, the deeper dive in BIS/STQC 2026 for factory cameras, and the certified-brand comparison in best Hikvision & Dahua alternatives.

Regime 2 — workplace safety (OSH Code 2020, not the Factories Act)

The Factories Act 1948 was repealed on 21 November 2025, when the four Labour Codes were brought into force; the OSH Code 2020 subsumed it along with 12 other central laws. The OSH (Central) Rules were notified on 8 May 2026. For cameras, the Code itself is nearly silent — the one place CCTV appears is inside the conditions for employing women on night shifts (Regime 4 below).

Two practical consequences for an owner:

1. Stop citing the Factories Act in the present tense. Any vendor page quoting "Section 66" as live law is stale. We keep our older Factories Act explainer online only as clearly-marked history; the current position is in the OSH Code 2020 and factory CCTV.
2. Your operative rulebook is your state's OSH rules, once notified — not the Central Rules — unless you are a central-sphere establishment. States are notifying on their own timelines through 2026, so labour is genuinely in transition. Confirm your own state's status directly.

CCTV is not a general safety requirement under the Code. A vendor claiming the OSH Code mandates cameras on every production line is overclaiming — see is CCTV mandatory in Indian factories?.

Regime 3 — data protection (DPDP), the deadline still ahead

Video of a recognisable worker is personal data under the Digital Personal Data Protection Act, 2023. There is no headcount or turnover threshold — a single-shed unit is a full data fiduciary, and the compliance duty lands on the factory, not on your CCTV vendor or AMC contractor.

The DPDP Rules 2025 commence in three phases:

• 13 November 2025 (Phase 1): Data Protection Board constituted, definitions and the Board's procedure live.
• 14 November 2026 (Phase 2): Consent Manager registration opens (Rule 4; Act s.6(9)).
• 14 May 2027 (Phase 3): full compliance — notice/consent, data-principal rights, security safeguards, breach reporting, retention & deletion, children's data, and cross-border transfer under Section 16 / Rule 15.

Phase 3 is the date that matters for your footage. By then you need CCTV signage, one written purpose, data minimisation (cameras on machines and lanes, off rest rooms and private areas), a capped retention window with auto-overwrite, and a locked-down NVR with role-based access. The penalty ceiling for failing reasonable security safeguards is ₹250 crore. The operational how-to is in DPDP and worker CCTV, the notice wording in worker CCTV privacy notice under DPDP, and the retention question in how long to keep footage.

Date note — 14 May 2027. Rule 1(4) brings Rules 3, 5 to 16, 22 and 23 into force "eighteen months after the date of publication", and the Rules were published on 13 November 2025. G.S.R. 843(E) of 13 Nov 2025 brings Sections 3 to 17 of the DPDP Act into force on 14 May 2027; only s.6(9), Consent Manager registration, starts earlier, in Nov 2026 (Gazette of India). Some trackers print 13 May; plan to be compliant before mid-May 2027 either way.

Regime 4 — women on the night shift (state law, no national date)

The OSH Code (s.43) permits women to work nights everywhere in India with consent; the OSH Central Rules 2026 put CCTV inside the safeguard package. But because labour is a Concurrent-List subject, the operative conditions — including retention length — are set state by state, each on its own notification date. There is no single national deadline.

We maintain the fuller, dated version of this table in which Indian states require CCTV to run women at night, with the operational placement detail (where the cameras go, and where they must not) in running women on the night shift and the Maharashtra specifics in the Maharashtra women night-shift CCTV guide.

Deadlines that people quote but that do not exist

Being honest about the absence of a date is part of what makes a calendar trustworthy.

• All-India Fire-NOC CCTV date — none. Fire safety is administered by state fire-services acts and the National Building Code; there is no national CCTV mandate or single renewal date. NOC renewal cycles are state-specific (commonly annual, but verify your state). See Fire NOC for an Indian factory and cameras. Status: state-dependent / ongoing.
• Blanket FSSAI CCTV mandate — none. No general FSSAI direction requires cameras in food factories; Schedule 4 mandates practices, and cameras are how you evidence them, not a legal box with a date. See cameras in food-processing plants: FSSAI. Status: no fixed date.
• Factory-licence renewal — no national date. Renewal cycles are set by each state's factory rules, not by a central calendar. Status: state-dependent.
• A named "Hikvision/Dahua ban" order dated 1 Apr 2026 — does not exist as a standalone notification. The block operates through the ER certification regime (above). Status: reframed, not a separate deadline.

Putting the calendar to work

Bring it down to four questions, in this order:

1. Buying a new camera this year? Then the 1 April 2026 ER rule applies to that purchase — ER-listed SKU only. Shortlist with the certified CCTV finder and confirm the vendor's exact model in the certificate checker. Installed cameras are fine.
2. Running (or planning) women at night? Then your state's rule sets your CCTV coverage and retention — find your row above and confirm it locally.
3. Filming identifiable workers? Then DPDP Phase 3 (14 May 2027) is your real deadline — signage, purpose, retention cap, locked NVR.
4. Bidding government work? Then the procurement restriction and the STQC ER test report for each model apply on top.

The complete step-by-step sits in the India factory camera compliance playbook 2026, and the one-page tick-list in the factory CCTV compliance checklist. Compliance decides what you may buy and how long you keep footage; it never answers how many cameras and where. Record a two-minute phone walk of your floor and Mama returns a placement plan — count, mounting, zones and hazards — plus a plain-language read of the space.

FAQ

Is there one factory CCTV law in India with a single deadline? No. Four separate regimes touch factory cameras — camera certification (MeitY/STQC, live 1 April 2026), workplace safety (OSH Code 2020, in force 21 November 2025), data protection (DPDP, full compliance 14 May 2027), and women's night-shift conditions (each state, various dates). They are run by different authorities and do not share a deadline.

Are Hikvision and Dahua banned in India from 1 April 2026? Not by a notification naming them. From 1 April 2026 any internet-connected camera that does not meet the security ER cannot be sold. On the BIS "ER Certified CCTV" list (checked 16 Oct 2026), no Hikvision or Dahua model appears in the ER column, so their network cameras are out of legal sale; Hikvision's 376 analogue models remain listed under a Registered R-number, while Dahua's 64 analogue models sit on a Cancelled one. It is a certification rule, not a by-name ban, and it targets new sales, not cameras already installed on your wall. Check any model in the certificate checker.

Do I have to replace my existing factory cameras by any of these dates? No. None of these regimes forces removal of working, installed cameras. The certification rule binds manufacture, import and sale; DPDP governs how you handle footage, not what hardware you own. You are forced to buy certified only when you next purchase, expand or bid a tender that requires it.

What is the real DPDP deadline for a factory? The third phase, on 14 May 2027 (18 months after the Rules were published on 13 November 2025; G.S.R. 843(E) starts Sections 3 to 17 of the Act on the same date). That is when notice/consent, retention limits, security safeguards and breach reporting become fully enforceable on the worker footage you capture. There is no headcount threshold — every factory that films identifiable workers is covered.

Which states require CCTV to run women on the night shift, and for how long must I keep footage? Maharashtra names a 45-day retention window scoped to the women's shift, and Karnataka's conditions named at least 45 days. Haryana's factory notification and Uttar Pradesh's rule 76 require cameras and name no retention period — set your own and document it. The dated table above and our state tracker carry the detail.

Is CCTV required by the OSH Code or by FSSAI or fire rules? The OSH Code only requires CCTV inside the women's-night-shift package, not as a general safety rule. We found no blanket FSSAI CCTV mandate and no all-India Fire-NOC CCTV date. Anyone quoting one of those as a hard deadline is overclaiming.

Related reading: BIS/STQC 2026 for factory cameras · Do I have to replace my CCTV in 2026? · DPDP and worker CCTV · The OSH Code 2020 and factory CCTV · States requiring CCTV for women's night shifts · The India factory camera compliance playbook 2026.

Last verified 16 October 2026. Camera-certification dates checked against the BIS CRS CCTV implementation guidelines and MeitY Office Memorandum reporting; model counts against the BIS "ER Certified CCTV" list and the STQC scheme page on 16 Oct 2026; OSH Code and Central Rules against the India Code text and SCC Online; DPDP phasing against the PIB release and AZB Partners' phased-rollout note; women's night-shift entries against the cited state notifications and law-firm alerts; the public-procurement restriction against the 23 July 2020 PIB release. Several items are administered state by state and change frequently. This page is a reference, not legal advice — confirm each date against its primary source and with your own compliance advisor before relying on it.