CCTV protects your premises, staff and stock – but the moment a camera records identifiable people, it collects personal data, and Singapore's PDPA applies. Get it wrong and a sensible security measure becomes a compliance risk. Here is how to install CCTV legally Singapore-wide, step by step, in plain English.
Is CCTV legal in Singapore?
Yes. Businesses can install CCTV for legitimate purposes such as security and safety. What the law regulates is how you do it: because footage of identifiable individuals is personal data, your CCTV use must comply with the PDPA (and, for some situations, other rules). You do not generally need a permit to film your own premises, but you do need to meet the PDPA obligations below.
The PDPA basics for CCTV
Five PDPA principles shape legal CCTV. Each is set out in the PDPC’s advisory guidelines on key concepts in the PDPA. Everything else follows from these:
- Notification – you must tell people they are being recorded, usually through clear, visible signage.
- Purpose – you may only collect footage for reasonable, legitimate purposes such as security, and use it only for those.
- Protection – you must protect the recorded footage with reasonable security measures against unauthorised access.
- Retention – you must not keep footage longer than necessary for its purpose.
- Access – individuals have a right to request footage in which they are identifiable, subject to exceptions.
How to install CCTV legally: step by step
1. Define a legitimate purpose
Be clear on why you are recording – security, safety, deterrence, loss prevention. That purpose justifies the cameras and limits how you may use the footage. “Just in case” or monitoring staff productivity without notice is where businesses get into trouble.
2. Put up clear, visible signage
This is the most-missed requirement. Display CCTV notices at entrances and in areas under surveillance, so people know before they enter that recording is taking place. The PDPC and SAS guide on biometric data in security applications likewise puts camera notices at prominent locations. If your cameras also record audio, the signage must say so – audio recording carries extra sensitivity.
3. Position cameras responsibly
Point cameras at what you legitimately need to protect – entrances, tills, stockrooms, car parks. Avoid capturing areas where people expect privacy (toilets, changing rooms) and be careful not to overlook a neighbour's private space or the interior of adjacent units. Over-broad coverage is both a privacy issue and a common complaint trigger.
4. Secure the footage and the system
Recorded footage is personal data you are responsible for protecting. Restrict who can view it, protect the recorder and any cloud access with strong passwords and MFA, keep the system patched, and log access. A CCTV system on default passwords is both a security and a PDPA failure – our cyber security checklist covers the basics.
5. Set a retention policy
Keep footage only as long as you genuinely need it, then delete it securely. The PDPA does not fix a number, but 21 to 30 days is widely considered reasonable for general security footage. Retain a specific clip longer only if there is a live reason – an incident or investigation – and document why.
6. Be ready for access requests
Under the PDPA, an individual can request footage in which they are identifiable. Have a simple process to receive and assess such requests, honour them within the rules (protecting other people's data in the same footage), and know the limited exceptions that let you decline.
7. Assign responsibility and document it
Appoint someone (a Data Protection Officer, which can be an outsourced DPO service) accountable for your CCTV and data practices, and keep a short written policy: purpose, coverage, retention, who can access footage and how requests are handled. This is both good practice and what demonstrates compliance if you are ever asked.
Special situations to watch
- Homes (HDB / landed): residential CCTV has its own considerations and HDB rules for common-area-facing cameras – different from business premises.
- Workplace monitoring: recording staff areas is allowed for legitimate purposes, but notice and reasonableness still apply – covert monitoring is high-risk.
- Audio recording: capturing sound is more sensitive than video alone; only do it with clear need and clear notice.
- Shared or rented premises: check your tenancy and coordinate with building management on common areas.
Common CCTV compliance mistakes
- No signage – the single most common failure; recording without notifying people.
- Cameras pointed too widely – capturing neighbours, public areas or private spaces unnecessarily.
- Keeping footage forever – no retention policy, so old recordings pile up indefinitely.
- Insecure systems – default passwords, no MFA, unpatched recorders that can be hijacked.
- No process for requests – being unable to respond when someone asks for their footage.
CCTV as part of your wider security
CCTV does not sit in isolation – it is part of your building and data security. Tie it in with door access control for a complete record of who entered and when, keep the recorder on your protected internal network rather than exposed to the internet, and treat footage with the same care as any other personal data you hold. A camera system that is itself hacked is worse than no camera at all, so the PDPA duty to protect the footage is not a formality – it is core security.
Frequently asked questions
Is it legal to install CCTV for my business in Singapore?
Yes. Businesses can install CCTV for legitimate purposes such as security and safety. Because the footage records identifiable people, it is personal data governed by the PDPA, so you must notify people (usually via signage), use the footage only for its stated purpose, secure it, keep it no longer than necessary, and be able to handle access requests. You do not generally need a permit to film your own premises.
Do I need to put up a CCTV notice or sign?
Yes. The PDPA requires you to notify individuals that they are being recorded, and clear, visible signage at entrances and monitored areas is the standard way to do this. People should know before they enter that CCTV is in operation. If your cameras also capture audio, the signage must state that too, because audio recording is treated as more sensitive.
How long can a business keep CCTV footage in Singapore?
Only as long as necessary for the purpose it was collected. The PDPA does not set a fixed period, but 21 to 30 days is widely considered reasonable for general security footage. After that, it should be securely deleted unless there is a specific live reason to keep a clip – such as an incident or investigation – which you should document.
Can someone ask to see CCTV footage of themselves?
Yes. Under the PDPA, an individual generally has the right to request access to personal data about themselves, including CCTV footage in which they are identifiable, subject to certain exceptions. Businesses should have a process to receive and assess such requests, provide the footage where required while protecting other people captured in it, and know the limited grounds on which they can decline.
Where am I not allowed to point CCTV cameras?
Avoid areas where people have a reasonable expectation of privacy, such as toilets and changing rooms, and take care not to capture a neighbour's private property or the inside of adjacent units unnecessarily. Cameras should cover what you legitimately need to protect – entrances, tills, stockrooms, car parks – and no more. Over-broad coverage is both a privacy risk and a common source of complaints.
Do I need a permit to install CCTV in Singapore?
For filming your own business premises, you generally do not need a special permit, but you must comply with the PDPA – signage, legitimate purpose, footage security, retention limits and access requests. Different rules can apply to residential settings (for example HDB requirements for common-area-facing cameras) and to any cameras that overlook public or shared spaces, so check those cases specifically.
About the author
Written by the Rezolva IT team – we install and secure CCTV for Singapore businesses with compliance in mind, from camera placement and signage guidance to securing the recorder and setting sensible retention. This guide summarises the PDPA essentials we walk clients through; for specific legal questions, refer to the PDPC's guidelines.