Under the PDPA, an organisation in Singapore that records people on CCTV is collecting personal data. It needs either consent or an exception that lets it collect without consent. For public areas, the publicly available data exception usually applies. For private areas, organisations can rely on the legitimate interests or employment exceptions, if they meet the conditions. If you rely on consent or the employment exception, you must tell people the purpose. If you rely on legitimate interests, you must tell people you are relying on it. For public areas, the PDPC encourages a CCTV notice as good practice.

This guide summarises what the Personal Data Protection Commission (PDPC) says about CCTV in its Advisory Guidelines on the PDPA for Selected Topics (revised 23 May 2024). It covers notices and signage, workplaces, requests for footage, masking and how long to keep recordings.

Does the PDPA apply to CCTV in Singapore?

Yes, for organisations. CCTV footage of identifiable people is personal data, so a business that records customers, visitors or staff must meet the PDPA’s obligations: notification, consent (or an exception), protection, retention limits and access. The PDPC’s guidance applies whether a camera records video only or video and audio (PDPC Selected Topics guidelines, para 4.33).

Individuals are treated differently. Section 4(1)(a) of the PDPA says the main data protection obligations do not apply to an individual acting in a personal or domestic capacity (PDPA 2012, s 4). So a family’s indoor camera at home is not a PDPA matter, though other rules still apply. For flats, see our guide to HDB doorbell camera rules.

Do businesses need consent to use CCTV?

Not always. The PDPC says consent is not required when an exception in the First or Second Schedule of the PDPA applies (para 4.34). Which exception fits depends on where the camera is.

Where the camera is	Basis the PDPC describes	What the organisation should do
Areas open to the public where people expect CCTV (shopfront, lift lobby, mall entrance)	Publicly available data exception	Consent not needed. Putting up notices is good practice.
Private areas not open to the public (storeroom, back office, restricted corridor)	Legitimate interests exception	Assess and reduce the risks, conclude that your legitimate interests outweigh any adverse effect on individuals, and tell people you rely on the exception, for example in your data protection policy. Notices are good practice.
Workplace, for managing employment (safety, security)	Employment exception	Tell employees the purpose of the CCTV, for example in the employee handbook or HR policies.
Purposes no exception covers (the PDPC’s example: a karaoke venue showing footage of private rooms in its open areas)	Consent	Notify people and obtain consent, for example in terms and conditions and notices.

Source: PDPC, Advisory Guidelines on the PDPA for Selected Topics, paras 4.34 to 4.40 (revised 23 May 2024).

The PDPC also notes that the publicly available data exception does not cover restricted areas, such as private offices inside a shopping mall (para 4.36).

Are CCTV signs compulsory in Singapore?

It depends on the basis you rely on. When you need consent, or rely on the employment exception, you must notify people of the purpose. When you rely on legitimate interests, you must take reasonable steps to tell people you are relying on it (para 4.37). When the publicly available data exception applies, notification is not strictly required, but the PDPC encourages it as good practice (paras 4.34 and 4.41). In practice, a clear CCTV notice is the simplest way to show you have informed people.

The PDPC’s guidance on notices is practical:

• Placement: notices should be placed so people have sufficient awareness that CCTV is in use (para 4.41). The Government’s reply to a parliamentary question in April 2019 gives examples: placing notices at points of entry to a building or prominent locations in a venue, where people can read them before their data is collected (MCI reply to PQ on regulation of CCTVs).
• Content: the PDPA does not prescribe the content of notifications (para 4.41).
• Camera locations: the PDPC does not require a notice to reveal the exact location of each camera. A notice can cover the general area (para 4.41).

The notice wording we usually suggest to clients reads: “CCTV in operation. This area is monitored for security and safety purposes. For enquiries, contact [company] at [email].” Adding a contact point makes it easy for people to ask about their data. The wording is a suggestion; the PDPA does not require these exact words.

Can my CCTV capture areas outside my premises?

Yes, if it is incidental. The PDPC says the PDPA does not prohibit CCTV that incidentally captures footage beyond your premises. You should consider how much coverage is reasonable for your purpose. If you intend to film public areas beyond your boundary, you may rely on the publicly available data exception, and the PDPC encourages notices as good practice (para 4.42).

When we plan camera angles for a shop or office, we aim the field of view at your entrances, counters and stock, and keep neighbouring units and private spaces out of frame. Our CCTV installation guide explains how we survey a site.

What are the PDPA rules for CCTV in the workplace?

Employers can use CCTV for workplace safety and security under the employment exception, as long as the purpose is to manage the employment relationship and employees are told why the cameras are there (para 4.39). The PDPC’s worked example is a worksite that explains its CCTV purpose in the employee handbook (para 4.40).

The Ministry of Manpower gave similar guidance in Parliament in September 2023. It said organisations should set clear rules on how and where monitoring devices are used, should use them only where there are safety or security concerns (not in places such as restrooms), must tell workers the purpose, and must put safeguards on how recordings are stored and used (MOM, oral answer on guidelines for CCTVs at workplaces, 18 September 2023).

If you are choosing cameras for an office, our office CCTV guide covers camera types. Cameras that also record sound fall under the same PDPC guidance, so consider whether audio is necessary; see our page on CCTV cameras with voice recording.

What happens when someone asks for CCTV footage?

Under the PDPA’s access obligation, an organisation generally must give a person access to their personal data, including CCTV footage of them. This does not apply if an exception in the Fifth Schedule applies or a prohibition in section 21 applies (para 4.43). The PDPC’s guidance says organisations can:

• Ask for details: ask the purpose of the request and the date, time and location, so the right footage can be found (para 4.44).
• Choose an efficient format: provide a printout, still frames, an extract, or a chance to view the footage in person (paras 4.44 and 4.58).
• Charge a reasonable fee for a copy of the footage (para 4.45).
• Point to other channels. For example, if the footage is for a police report, the police can obtain it directly from the organisation once investigations start (paras 4.46 and 4.47).
• Resolution: no minimum required. There is no minimum resolution. Provide the footage in the form and resolution you hold it, or offer a lower-resolution extract if that meets the person’s purpose (para 4.57).

Do you need to blur other people in the footage?

Usually, yes. Under section 21(3)(c), organisations must mask other individuals in the footage unless one of three things applies (para 4.48):

1. An exception lets the organisation disclose the other people’s data without consent, such as the publicly available data exception or the legitimate interests exception.
2. Another law permits or requires it, such as police investigations, discovery in civil cases, or strata management law.
3. The other individuals have consented.

The PDPC’s examples show how this works. A shopping mall entrance is open to the public, so the mall can provide footage without masking other shoppers (para 4.49). In a condominium, Section 47 of the Building Maintenance and Strata Management Act lets a subsidiary proprietor (owner) request footage without redaction (para 4.51). Masking can use solid blocks, blur or pixelation. The PDPC notes that blurred or pixelated faces may still be identifiable (para 4.59).

Before you buy a recorder, check that its software can export clips and still frames easily. Most recorders we install can do both. For background, see our article on how CCTV footage is stored.

Do you have to delete CCTV footage on request?

No. The PDPA does not require an organisation to delete personal data because someone asks. Under section 25, though, you must stop keeping footage, or remove the means of linking it to particular individuals, once its purpose is no longer served and you no longer need it for legal or business reasons (para 4.55).

The PDPA does not set a fixed number of days for keeping CCTV footage. Set a retention period that matches your purpose and document it. The recorders we install overwrite the oldest footage automatically when the drive is full, so drive size often sets the real retention period. Our CCTV hard disk calculator helps you size storage for the period you choose.

What security does the PDPA expect for CCTV systems?

Section 24 of the PDPA, the protection obligation, requires organisations to make reasonable security arrangements to protect personal data in their possession or control (PDPA 2012, s 24). Organisations must also designate at least one person, usually called a data protection officer, to be responsible for compliance (s 11(3)).

For a CCTV system, reasonable arrangements usually include:

• Changing default passwords on the recorder, cameras and mobile app, and giving each user their own account.
• Limiting who can view, play back and export footage, and keeping the recorder in a locked room or cabinet.
• Keeping recorder firmware up to date and not exposing it directly to the internet. For remote viewing we suggest a VPN, or the manufacturer’s app after checking where it stores or relays footage.
• Keeping a simple log of footage requests and exports.

If footage is leaked or accessed without authorisation, Part 6A of the PDPA applies. You must assess whether the data breach is notifiable. If it is, you must notify the PDPC as soon as practicable and no later than 3 calendar days after that assessment (PDPA 2012, s 26D).

Breaches can be costly. Under section 48J of the PDPA, the PDPC can impose a financial penalty of up to S$1 million or 10% of the organisation’s annual turnover in Singapore, whichever is higher. The 10% limit applies to organisations with Singapore turnover above S$10 million (PDPC Advisory Guidelines on Enforcement, revised 1 October 2022, para 27.1).

PDPA CCTV checklist for Singapore businesses

Step	What to do
1. Purpose	Write down why each camera is installed (security, safety, theft prevention).
2. Basis	Match each area to its basis: publicly available, legitimate interests (with a risk assessment), employment, or consent.
3. Notices	Put CCTV notices at entrances and prominent spots, with a contact point.
4. Staff	Explain CCTV use in the employee handbook or HR policy. Keep cameras out of restrooms and similar areas.
5. Access	Decide who handles footage requests, how to mask others, and whether you charge a fee.
6. Retention	Set and document how long footage is kept; size storage to match.
7. Security	Use unique passwords, restricted accounts, current firmware, and a locked recorder location.
8. Policy	Mention CCTV in your data protection policy and name your data protection officer.

Frequently Asked Questions

Is CCTV signage required by law in Singapore?

The PDPA requires notification where consent is needed or where you rely on the employment exception, and you must disclose reliance on legitimate interests. For public areas covered by the publicly available data exception, the PDPC encourages notices as good practice. The PDPA does not prescribe the wording of CCTV signs.

Does a CCTV notice have to show where the cameras are?

No. The PDPC does not require notices to reveal the exact location of each camera. A notice can state that CCTV is in use in the general area.

Can a customer ask a shop for CCTV footage of themselves?

Yes. The shop must generally provide access to footage of that person unless an exception applies. It can ask for the date, time and purpose, charge a reasonable fee, and mask other people where required.

Can I refuse a request to delete CCTV footage?

Yes. The PDPA does not require deletion on request. You must still stop retaining footage, or anonymise it, once it no longer serves its purpose or any legal or business need.

Does the PDPA apply to my home CCTV?

The PDPA’s main obligations do not apply to individuals acting in a personal or domestic capacity. Other laws and housing rules can still apply. HDB, for example, says standalone cameras must not face another flat’s door or windows (HDB).

Get your CCTV set up with PDPA in mind

The PDPA does not ban CCTV. It asks organisations to have a clear purpose, a legal basis, sensible notices, secure systems and a way to handle footage requests. Most of this is decided when the system is designed: where cameras point, how long the recorder keeps footage, and who can export clips.

We install and maintain CCTV systems for shops, offices, condos and warehouses across Singapore. Request a quote and tell us about your premises, or read more about security cameras and privacy. This article is general information, not legal advice. For your specific situation, check the PDPC’s guidance or ask a lawyer.

Sources

This guide was checked against the official sources below on 31 October 2026. Questions? Contact us or read about CCTVSG.

• PDPC, Advisory Guidelines on the PDPA for Selected Topics (issued 24 September 2013, revised 23 May 2024), Chapter 4, paras 4.33 to 4.59: https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-selected-topics/advisory-guidelines-on-the-pdpa-for-selected-topics-(revised-may-2024).pdf
• Personal Data Protection Act 2012, sections 4, 11, 24, 25 and 26D, Singapore Statutes Online: https://sso.agc.gov.sg/Act/PDPA2012
• HDB, “Installing Smart Door Devices and CCTV Cameras”: https://www.hdb.gov.sg/managing-my-home/home-ownership/installing-smart-door-devices-and-cctv-cameras
• MCI (now MDDI), response to PQ on regulation of CCTVs (1 April 2019): https://www.mddi.gov.sg/newsroom/pq-on-regulation-of-cctvs/
• MOM, oral answer to PQ on guidelines for CCTVs at workplaces, 18 September 2023: https://www.mom.gov.sg/newsroom/parliament-questions-and-replies/2023/0918-oral-answer-to-pq-on-guidelines-for-cctvs-at-workplaces
• PDPC, Advisory Guidelines on Enforcement of the Data Protection Provisions (revised 1 October 2022), para 27.1: https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Advisory-Guidelines/Advisory-Guidelines-on-Enforcement-of-DP-Provisions_1oct2022.pdf