CCTV Surveillance Under DPDPA: Understanding The Legal Obligation Exception

Prepared by Shubhank Suman, AI, Privacy and IP Counsel

CCTV footage that captures identifiable individuals is personal data, and whoever decides why and how it is recorded is a Data Fiduciary, so the recording needs a lawful basis under the DPDPA. Consent under Section 6 cannot realistically be obtained from each and every Data Principal a camera captures, CCTV must therefore rest on a basis that does not depend on individual consent. Three feasible routes exist: namely the household exemption, signage with consent, and employee monitoring. This note states analyse fourth basis that is often missed yet fits most commercial CCTV in India: processing to comply with a legal obligation, under Section 7(d).

1. The Familiar Bases,

• Household exemption, Section 3(c)(i). A camera an individual runs for a purely personal or domestic purpose, such as watching her own doorway, falls outside the Act; this does not hold once it is trained on the public street or a neighbour's property.

• Employee monitoring, Section 7(i). An employer may run workplace cameras to safeguard itself from loss or liability, such as protecting premises, trade secrets, and confidential information, provided the monitoring is proportionate, notified to staff, and kept out of private spaces such as washrooms.

• Commercial CCTV, signage as notice, and when consent is mandatory (Section 7(a)). Where an individual voluntarily enters premises that display clear notice of surveillance, the processing may rest on Section 7(a), being data voluntarily provided for a specified purpose absent objection, with the signage serving as transparency.

2. The overlooked basis: CCTV as compliance with a legal obligation Section 7 of the Digital Personal Data Protection Act permits a Data Fiduciary to process personal data for certain legitimate uses without obtaining consent. Specifically, Section 7(d) allows processing where it is necessary to fulfil an obligation under any law in force in India that requires a person to disclose information to the State or its instrumentalities, provided the processing complies with the disclosure requirements of that law.

This provision is particularly relevant to CCTV surveillance. Several state laws require private establishments to install CCTV cameras, retain surveillance footage for a prescribed period, and provide it to the police or other designated authorities upon request. Where such a statutory obligation exists, the establishment may process CCTV footage without obtaining consent, as the processing is undertaken solely to comply with a legal duty to preserve and disclose information to the State. In such cases, the establishment is the person on whom the legal obligation is imposed.

The condition inside Section 7(d), and the limits that remain Section 7(d) carries a built-in condition: the processing must be in accordance with the disclosure provisions of the mandating law. In practice the establishment must record only what the law requires, retain footage for the period it prescribes (commonly 30 days, longer under some Acts), display the signage it mandates, and disclose to the authority in the manner and to the extent the law allows, and no further.

Relying on Section 7(d) removes the need for consent; it does not switch off the rest of the Act. The establishment remains a Data Fiduciary and must limit the cameras and their field of view to what the mandate requires, so a camera positioned for public safety cannot double as a tool to profile passers-by. It must apply reasonable security safeguards under Section 8(5), including access control and, where a state law so requires as in Assam, encryption and a bar on foreign-server storage. It must retain footage only for the prescribed period and then erase it, and use it only for the statutory purpose. Using footage collected under a public-safety mandate for marketing, employee scoring, or any unrelated end falls outside the legitimate use and needs a separate basis.

Practical Position

• Map each camera to the specific state mandate that justifies it, and record the mandate as the lawful basis (Section 7(d)).

• Set the field of view, camera locations, and retention strictly to what that mandate requires; do not exceed them.

• Display the signage the mandate prescribes, which also discharges transparency toward the public.

• Apply Section 8(5) safeguards, honour any encryption or localisation condition, and erase footage once the prescribed period ends.

• Treat any use beyond the statutory purpose, and any camera not covered by a mandate, as needing a separate basis, which for a public space will rarely be available.

Conclusion Because consent is not workable for CCTV, the lawful basis must be found among the routes that do not depend on it: the household exemption for home cameras, employee monitoring for the workplace, and, for the state-mandated cameras that now dominate commercial premises, compliance with a legal obligation under Section 7(d). The establishment records and retains footage to fulfil its statutory duty to preserve and produce it to the State, and so may do so without consent. It should tie each camera to its mandate, follow that law's retention, signage, and disclosure conditions, and keep the processing within the four corners of the statutory purpose.