Personal Data in Video Surveillance: Notice, Retention and Data Subject Rights

What Constitutes Personal Information in Video Surveillance

Personal information in video surveillance refers to any data collected, stored, or processed by surveillance systems that relates to an identified or identifiable natural person. When camera footage can, alone or combined with other data, confirm the identity of a specific individual, that footage constitutes personal information subject to applicable data protection regulations.

---

Background: Why Overseas Enterprises Must Prioritize Surveillance Compliance

Chinese enterprises operating in Southeast Asia increasingly rely on video surveillance across diverse scenarios—factory production line monitoring, park perimeter protection, warehouse and logistics management, mining site safety, and office building visitor management. However, the continuous collection of facial features, behavioral patterns, and license plate data by surveillance cameras in these scenarios may constitute personal information.

Major Southeast Asian markets have progressively strengthened data protection legislation in recent years. Thailand's Personal Data Protection Act (PDPA) officially took effect in 2022; Vietnam's Cybersecurity Law combined with the pending Personal Data Protection Decree creates dual regulation; Indonesia's Personal Data Protection Law draft has passed parliament; Malaysia's Personal Data Protection Act 2010 has been enforced for years; and Singapore's Personal Data Protection Act is known for strict enforcement.

For Chinese enterprises expanding overseas, video surveillance compliance has shifted from an "optional optimization" to a "mandatory compliance obligation." Failure to properly handle personal information collection notice, retention period, and data subject rights response may result in administrative penalties, damaged customer trust, or even business disruption.

---

Core Analysis: Implementation Framework for Three General Compliance Actions

1. Collection Notice: Informing Subjects They Are Being Filmed

1.1 Legal Logic of Notice Obligations

Collection notice is a core principle of personal information protection—the foundation for processing bases such as "informed consent" or "legitimate interest" rests on data subjects being aware of and understanding that their data is being collected. In video surveillance scenarios, notice obligations are typically fulfilled through two mechanisms: signage (Notice) and Privacy Policy.

1.2 Practical Points for Signage Design

Clear and visible notice signs should be installed at surveillance area entrances or prominent locations, containing the following core information:

Signage design should balance readability and visibility: font size should ensure legibility for persons with normal vision at 1-2 meters distance; color contrast should meet basic accessibility requirements; signs should be installed at primary pedestrian pathways or entrances without obstruction.

Among mainstream manufacturers' product lines such as Hikvision and Dahua, certain models support OSD (On-Screen Display) character overlay for showing surveillance zone names and recording status, providing technical options for digital notice implementation.

1.3 Privacy Policy Integration Design

Beyond on-site signage, enterprises typically need to develop standalone privacy policies or privacy notices as complete carriers of notice obligations. Policies should cover:

• Identity information of data controllers and processors
• Types and methods of personal information collected
• Processing purposes and legal basis
• Storage period and cross-border transfer explanations (if applicable)
• Data subject rights and exercise methods
• Contact information

Privacy policies should be provided to relevant parties through enterprise websites, employee handbooks, onboarding training, and visitor registration processes. For factory scenarios, it is recommended to add video surveillance privacy notice modules to onboarding training and retain employee signature confirmation records.

1.4 Multi-Language Adaptation

The multi-language characteristics of Southeast Asian markets require enterprises to consider language coverage in signage and policy design. In Thailand, for example, signage should include at least Thai and English; Vietnam markets should provide Vietnamese versions. Language versions should maintain content consistency to avoid compliance risks from translation discrepancies.

---

2. Retention Period: Balancing Legal Requirements and Business Needs

2.1 Dual Logic of Retention Period

Video surveillance data retention periods face dual constraints: statutory minimum retention requirements and reasonable business needs. Enterprises need to find a compliant and practical balance between the two.

Statutory retention requirements typically exist in specific industry regulations or data protection legislation—for example, certain countries require longer retention periods for surveillance footage in specific industries (finance, healthcare). However, such requirements vary by country, and universal retention period regulations for general commercial enterprises are not widespread.

Reasonable business needs depend on surveillance purposes: factory safety monitoring may require 30-90 days to cover incident investigation cycles; perimeter protection may require 7-30 days; office areas may only need 7-14 days. Extending retention beyond reasonable business needs lacks justification and may be deemed excessive collection.

2.2 Methods for Determining Retention Period

Enterprises may follow these steps to determine reasonable retention periods:

Step 1: Map surveillance scenarios and purposes. List all surveillance points and annotate their primary uses (perimeter protection, production safety, visitor management, vehicle management, etc.).

Step 2: Assess investigation cycle requirements. Based on business characteristics, determine the average cycle from incident occurrence to discovery, investigation, and closure for various incident types. For example, factory workplace injury investigations may require 30-60 days; warehouse theft investigations may require 15-30 days.

Step 3: Add safety buffer period. Add 10-15 days of buffer on top of investigation cycles to account for process delays or supplementary investigation needs.

Step 4: Take the maximum value as baseline. The same area may serve multiple purposes—use the longest cycle as the retention period for that area.

Step 5: Conduct regular review and adjustment. Review whether retention periods remain reasonable every six months or annually, documenting review results and adjustment rationale.

2.3 Storage Capacity Planning

Retention period directly impacts storage system capacity planning. For a 1080P, 4Mbps IPC camera, daily storage per channel is approximately 43GB; 30-day retention requires approximately 1.29TB of storage space (excluding RAID redundancy). With efficient codecs such as H.265+ or Smart265, storage requirements can be significantly reduced—Smart265 encoding supported by certain Hikvision models can save approximately 50% storage space compared to H.265 (subject to actual project specifications).

Storage system design should consider:

2.4 Auto-Overwrite and Manual Preservation

Video surveillance systems should support both auto-overwrite (loop recording) and manual preservation (mark protection) mechanisms. Under normal circumstances, footage auto-overwrites according to the preset period; when security incidents occur, administrators can manually mark the relevant time period as protected status to prevent overwriting.

It is recommended to clearly define the following operational procedures:

• Trigger conditions for manual preservation (security incidents, complaint investigations)
• Approval levels for manual preservation (department head approval minimum recommended)
• Maximum duration for manual preservation (manual preservation exceeding statutory retention periods requires sufficient justification and documentation)
• Handling procedures after manual preservation expires

---

3. Data Subject Rights Response: Establishing Executable Processing Procedures

3.1 Scope of Data Subject Rights

In video surveillance scenarios, data subjects (those filmed) typically enjoy the following rights:

• Right to be informed: Understanding the existence, scope, and purpose of video surveillance
• Right of access: Requesting to view footage related to themselves (if applicable)
• Right to rectification: Requesting correction of inaccurate personal information (limited applicability in footage scenarios)
• Right to erasure: Requesting deletion of personal information under specific conditions
• Right to restriction of processing: Requesting restriction of processing under specific conditions
• Right to data portability: Obtaining a structured copy of their data under specific conditions (limited applicability in footage scenarios)

3.2 Handling Access Requests

Exercising access rights in video surveillance faces technical challenges: surveillance footage typically cannot precisely locate specific individuals, and retrieving large volumes of footage may affect the privacy of uninvolved persons.

Recommended process for handling access requests:

Step 1: Identity verification. Confirm the requester's identity matches their claimed data subject identity.

Step 2: Confirm request scope. Clarify the time range, surveillance area, and purpose of the request. If the request scope is overly broad, request further clarification (e.g., specific dates and time periods).

Step 3: Technical search. Search the footage system for relevant time periods and areas based on the request scope.

Step 4: De-identification processing. Before providing access, other identifiable persons in the footage should be de-identified (e.g., blurred), unless impossible or cost-prohibitive.

Step 5: Secure transmission. Provide footage to the requester through secure channels (e.g., encrypted storage media handed over in person, password-protected file transfer), and document the provision time and method.

Step 6: Response timeline. Complete the response within a reasonable period and inform the requester of the expected timeline within legal limits. Thailand's PDPA specifies a response period of 30 days from receipt (extendable to 60 days).

3.3 Handling Deletion Requests

The right to erasure has limited applicability in video surveillance scenarios because:

• Surveillance footage typically cannot individually identify specific data subjects
• Footage may simultaneously contain multiple uninvolved persons; deleting specific person's data may affect others' rights
• Enterprises may need to retain footage due to legal obligations or legitimate interests

Recommended principles for handling deletion requests:

Legality defense. If retaining footage has legitimate basis (e.g., pending legal proceedings, security incident investigation), relevant defenses may be invoked to temporarily postpone deletion, with written notice to the requester.

Partial deletion. If technically feasible, specific individuals in footage can be de-identified (e.g., facial blurring) rather than deleting entire footage segments.

Time limitation. Footage exceeding the retention period should be handled according to established procedures when deletion requests are received.

3.4 Response Records and Document Management

Enterprises should establish data subject request handling records, including:

• Request receipt time and channel
• Requester identity information
• Request type and scope
• Processing process and results
• Response time
• If delayed, explanation of reasons

Complete documentation serves as both compliance evidence and basis for responding to regulatory inspections.

---

Actionable Recommendations: Key Action Checklist for Implementation

Recommendation 1: Conduct Surveillance Point Compliance Review

Before deploying or upgrading surveillance systems, it is recommended to conduct a comprehensive review of existing surveillance points, evaluating each point's:

• Surveillance area and coverage scope
• Types of personal information collected (faces, license plates, behaviors, etc.)
• Surveillance purpose and legal basis
• Current signage setup
• Current retention period settings

Review results should be documented as baseline data for compliance management.

Recommendation 2: Standardize Signage Standards and Installation Specifications

Develop enterprise-level surveillance signage standards, including:

• Signage content templates (Chinese, local language, English versions)
• Signage size and installation location specifications
• Material requirements (different needs for indoor/outdoor)
• Regular inspection and maintenance mechanisms

Signage installation locations should cover all surveillance area entrances and prominent locations, ensuring persons are informed before entering surveillance areas.

Recommendation 3: Establish Tiered Storage and Differentiated Retention Strategy

Based on surveillance scenario sensitivity levels and data types, establish tiered storage strategies:

NVR/VMS systems can configure different recording retention periods per channel for refined management.

Recommendation 4: Develop Data Subject Rights Response SOP

Establish Standard Operating Procedures (SOP) clearly defining:

• Request receipt channels (email, online forms, in-person windows)
• Internal routing paths and responsible persons
• Identity verification standards
• Processing timelines for each request type
• Response templates and language
• Record archiving requirements

It is recommended to designate specific personnel or team responsible for rights response matters, with regular training updates.

Recommendation 5: Incorporate Supplier Compliance Management

When selecting surveillance equipment suppliers and installation service providers, incorporate compliance capability into evaluation criteria:

• Whether devices support independent recording period settings per channel
• Whether devices support OSD character overlay
• Whether platforms support footage de-identification functionality
• Whether suppliers provide compliance deployment guidance
• Whether suppliers have local compliance experience

---

Conclusion and Outlook

Personal information compliance in video surveillance is not a one-time project but a continuously operated management system. The three core actions of collection notice, retention period, and data subject rights response constitute the foundational pillars of a compliance framework.

For Chinese enterprises expanding into Southeast Asia, it is recommended to use the framework provided in this article as a starting point, combining target market-specific regulatory requirements with their own business characteristics to establish a surveillance compliance management system suitable for the enterprise. This system should include clear signage specifications, reasonable retention strategies, smooth rights response processes, and regular compliance review and optimization.

As Southeast Asian countries strengthen data protection enforcement, enterprises that proactively establish compliance systems will gain competitive advantages in risk prevention and brand reputation.

---

FAQ

Q: Does the absence of signage in surveillance areas necessarily constitute a violation?

A: Missing signage typically constitutes incomplete fulfillment of notice obligations and may result in regulatory investigation or penalties. Specific legal liability depends on local regulations and enforcement practices. It is recommended to supplement signage promptly and evaluate whether relevant parties whose data has been collected need to be notified.

Q: If footage has already been auto-overwritten, can deletion requests still be handled?

A: If footage has been overwritten and cannot be technically recovered, this situation can be documented and the requester informed that original footage cannot be provided. Explaining system settings and overwrite timestamps in the response serves as proof of fulfilled obligations.

Q: Can employees refuse to be monitored on privacy grounds?

A: Video surveillance as a legitimate means of enterprise safety management, after fulfilling notice obligations, employees typically cannot refuse. However, enterprises should ensure surveillance scope and intensity are proportionate to legitimate purposes, avoiding excessive intrusion into employee privacy. It is recommended to clearly explain surveillance policies in employee handbooks and onboarding training.

Q: Do visitors and contractors also need to be informed?

A: Yes. Surveillance notice should cover all persons entering surveillance areas, including employees, visitors, contractors, suppliers, etc. It is recommended to add privacy notice confirmation steps to visitor registration processes or print surveillance statements on the back of visitor badges.

Q: Different countries have different retention period requirements—how can multinational enterprises manage uniformly?

A: It is recommended to establish unified standards based on the most stringent market requirements, or configure recording retention periods separately by country/region. Modern NVR/storage systems typically support independent period settings per channel, enabling differentiated configuration under a unified cross-national platform.