Where Your Factory's CCTV Video Is Stored: NVR, Vendor Cloud or P2P Relay (India, DPDP)

Does Indian law require factory CCTV video to stay in India? As of 14 Oct 2026, no: India's DPDP Act uses a blacklist model, and section 16 and Rule 15 apply only from 14 May 2027, eighteen months after their 13 Nov 2025 Gazette publication. Your video sits wherever your recorder or app puts it; you answer for it.

Last checked: 14 Oct 2026

By the Mama Editorial Team. Legal quotes are from the Gazette of India text. Not legal advice.

Key takeaways

• Factory video lives in one of three places: the NVR's disks in your plant, a vendor's cloud storage, or (only while someone is watching) a vendor's P2P relay server. Most plants have the first and quietly also the third.
• DPDP section 16 does not require localisation. It lets the Central Government "restrict the transfer" to countries it notifies, which is a blacklist, not a whitelist (DPDP Act 2023, s.16).
• Section 16 commences "eighteen months from the date of publication" of G.S.R. 843(E), published in the Gazette of 13 Nov 2025 (e-Gazette 267647). The Gazette prints no end date; we count it as 14 May 2027 (basis below).
• The factory is the Data Fiduciary. Section 8(1) makes it responsible for processing done "on its behalf by a Data Processor", so a vendor's cloud is still your problem.
• We could not find a vendor document that states which country's servers handle Indian P2P or cloud accounts for Hik-Connect, Dahua DMSS or CP Plus apps (checked 14 Oct 2026). Ask in writing.

The three places your video can be

Each place has a different list of people who can reach it.

Assumption, not a measurement: 1 Mbps of continuous video is 10.8 GB a day (1 Mbit/s × 86,400 s ÷ 8), so 2 Mbps × 24 cameras × 30 days ≈ 15,552 GB. The P2P row assumes one person watches one 0.5 Mbps sub-stream for two hours a day. Your bitrates will differ.

NVR plus app viewing sends a trickle out of the gate. Cloud recording sends the whole floor out, all day.

How P2P actually moves your video

The NVR dials out to the vendor's server and keeps that line open. When you open the app, the server introduces your phone to the NVR. If the two can talk directly, video flows straight between them. If they can't (for example, both sit behind carrier-grade NAT), the vendor's server relays the video itself.

What vendors' own documents say:

• Hikvision. Its integration portal says that with Hik-Connect there is "no need to deploy streaming media server, video storage server" on your side, because the platform supplies them, and it cites "AWS cloud service" (Hikvision TPP, Hik-Connect integration). It names no AWS region.
• Hikvision firewall note. Hikvision USA support asks installers to make sure "the STUN ports are not closed by the firewall: 6002, 6800, 8555, 9010, and 9020" (Hikvision USA support). STUN is the step where the server helps two devices find each other.
• Dahua. The Dahua Wiki P2P checklist has the installer enable P2P and confirm the status reads "Online" (Dahua Wiki, NVR P2P troubleshoot).

What we could not find. We looked for a vendor-published statement of which country's servers serve Indian accounts for Hik-Connect, Dahua's DMSS app and CP Plus's gCMOB app. None found (checked 14 Oct 2026). So this page has no "brand → where P2P goes" table: one built from forum posts or DNS lookups would be a guess.

For the networking side of P2P, CGNAT and VPN alternatives, see remote viewing behind Jio/Airtel CGNAT.

What Indian law says about where video may go

CCTV footage of workers is personal data. The DPDP Act defines personal data as "any data about an individual who is identifiable by or in relation to such data", and "processing" expressly includes "recording", "storage" and "disclosure by transmission" (DPDP Act 2023, s.2(t) and 2(x)). A relay that carries your stream is processing.

Section 16 is a blacklist. Section 16(1) reads: "The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified" (DPDP Act 2023, s.16). Anything not on a notified list stays open under this Act.

Stricter laws survive. Section 16(2) says the section does not restrict any other Indian law "that provides for a higher degree of protection for or restriction on transfer" of personal data. A sector rule or a government buyer's contract can be stricter than DPDP.

Rule 15 adds a state-access condition. Rule 15 of the DPDP Rules 2025 allows transfer outside India "subject to the restriction that the Data Fiduciary shall meet such requirements as the Central Government may … specify in respect of making such personal data available to any foreign State" or its agencies (DPDP Rules 2025, G.S.R. 846(E), e-Gazette 267650). That clause is about foreign governments reaching your data, not about where a server sits.

No country is on the list yet. We found no notification under section 16(1) naming any country (checked 14 Oct 2026); section 16 itself has not commenced.

The CCTV security rules don't cover storage location. MeitY's Essential Requirements for Security of CCTV (S.O. 1119(E), 6 Mar 2024) deal with secure boot, signed firmware, TLS and server certificate checks. The appendix text (pp. 32–43) contains no clause on cloud storage or data leaving India (text search, checked 14 Oct 2026) (e-Gazette 252738). Our clause-by-clause guide to the Essential Requirements covers what they do require.

When each piece switches on

The date: 14 May 2027. Both notifications appeared in the Gazette Extraordinary of Thursday 13 Nov 2025, Nos. 757 and 760 (e-Gazette 267647; e-Gazette 267650). Neither prints an end date. Our basis: the publication day is excluded, the usual rule for a period running "from" a date (General Clauses Act, 1897, s.9), so eighteen months run out on 13 May 2027 and these provisions apply from 14 May 2027. Our DPDP and worker CCTV guide uses the same date. Some trackers say 13 May; finish the work before either.

Until then, IT Act section 43A stays in force; section 44(2) deletes it on the same date.

Who is answerable when the video sits with a vendor

You are. Section 8(1) says a Data Fiduciary is responsible "irrespective of any agreement to the contrary" for "any processing undertaken by it or on its behalf by a Data Processor" (DPDP Act 2023, s.8). A clause in the vendor's terms does not move that duty.

You need a contract. Section 8(2) allows a processor to be engaged "only under a valid contract". Rule 6(1)(f) requires "appropriate provision in the contract" for security safeguards (DPDP Rules 2025, Rule 6).

You need access logs. Rule 6(1)(c) asks for "visibility on the accessing of such personal data, through appropriate logs". Rule 6(1)(e) says to retain such logs "for a period of one year" unless another law requires otherwise. Ask a vendor app for a log of who viewed what.

The money at stake is a ceiling, not a fine schedule. The Act's Schedule sets penalties that "may extend to" these amounts (DPDP Act 2023, Schedule):

A worked ₹ example: two ways to watch the floor from home

Video usually leaves a plant because the owner wants to watch from home. Here are the routes for a 24-camera plant, with prices only where a provider publishes them.

The Airtel plan is an example, not a recommendation: a private VPN costs roughly a business broadband bill. Don't port-forward the NVR as a shortcut; our unsecured feeds audit checklist explains why.

Questions to ask your vendor, in writing

1. Is footage stored outside the plant at all? Cloud recording, event clips and snapshots each count.
2. Which country and which hosting provider hold it? Name the region, not "secure cloud".
3. Does live view ever relay through your servers? If yes, where are the relay servers?
4. Who on your side can view or download our footage? Support staff, partners, subcontractors.
5. Can we get a log of every remote view, and keep it a year? That maps to Rule 6(1)(c) and (e).
6. Will you sign a processor clause? Section 8(2) needs a valid contract; Rule 6(1)(f) needs security terms in it.
7. Can we switch P2P off and keep everything working locally? The answer tells you how dependent you are.

For the wider pre-signing list, see 17 questions to ask a CCTV/AI vendor. For how long to keep what you store, see CCTV footage retention for Indian factories.

What this page cannot tell you

• Your vendor's actual server region. Only the vendor can confirm it, in writing.
• Whether your sector is stricter. Section 16(2) keeps stricter laws alive. Check your sector regulator and your largest customer's contract.
• Whether a camera brand is allowed at all. That is a separate question; see is Hikvision banned in India.

Where Mama fits

Mama reads the cameras a plant already has and each morning sends the owner a short plain-language note on machine running and idle time, idle stations and where output slipped. It looks at machines and flows, and counts people only in aggregate. Leave an email or phone in the form below.

FAQ

Does Indian law require CCTV footage to be stored in India? Not under DPDP as of 14 Oct 2026. Section 16 is a blacklist: the Centre may restrict transfers to notified countries, none are notified, and it applies from 14 May 2027. Sector laws or contracts can be stricter.

Is P2P viewing the same as storing video in the cloud? No. P2P mostly carries live or playback video while someone watches, and the footage stays on your NVR. But when a direct link fails, the vendor's server relays the stream, so video does pass through it.

If my vendor stores footage abroad, who is liable? The factory. DPDP section 8(1) makes the Data Fiduciary responsible for processing done on its behalf by a Data Processor, "irrespective of any agreement to the contrary". Sign a processor contract with security terms.

When do DPDP Rule 6 and Rule 15 apply to my factory? From 14 May 2027. Rule 1(4) of the DPDP Rules 2025 says "eighteen months after the date of publication", and the Gazette is dated 13 Nov 2025; we exclude the publication day when counting.

Do the MeitY CCTV security rules say where video must be stored? No. The Essential Requirements for Security of CCTV (S.O. 1119(E), 6 Mar 2024) cover device security such as secure boot and signed firmware. We found no clause on cloud storage or data leaving India (checked 14 Oct 2026).