POPIA & CCTV: Recording Legally in South Africa

Introduction: CCTV and the Law in South Africa

Closed-circuit television (CCTV) cameras are one of the most effective security tools available to South African homeowners and businesses. But with the full commencement of the Protection of Personal Information Act (POPIA) on 1 July 2021, operating a CCTV system now comes with legal obligations that every property owner needs to understand.

Failing to comply with POPIA when operating CCTV cameras isn't just a technicality — it can expose you to complaints, investigations by the Information Regulator, and potentially significant penalties. This guide explains what POPIA requires, what it means for your CCTV system, and how to stay on the right side of the law.

What Is POPIA?

The Protection of Personal Information Act 4 of 2013 (POPIA) is South Africa's primary data protection legislation. It regulates how "responsible parties" (anyone who determines the purpose and means of processing personal information) collect, store, use, and share personal information about identifiable individuals.

CCTV footage that captures identifiable people — their faces, vehicles, movements, or behaviour — constitutes personal information under POPIA. This means that operating a CCTV system makes you a responsible party with obligations under the Act.

Does POPIA Apply to Home CCTV Systems?

This is the question most Johannesburg homeowners ask first. The answer is nuanced.

POPIA contains a "household exemption" in Section 6(1)(a), which excludes processing of personal information "in the course of a purely personal or household activity." If your CCTV cameras are pointed exclusively at your own property — your driveway, garden, and interior — and the footage is used only for your personal security, you are likely exempt from most POPIA obligations.

However, the exemption falls away the moment your cameras capture footage beyond your property boundary. If your cameras record:

• The public pavement or street outside your property
• Your neighbour's property or driveway
• Shared access areas in a complex or estate
• Any area where members of the public are present

...then POPIA applies, and you have compliance obligations.

For businesses — retail stores, offices, warehouses, and commercial properties — POPIA applies fully to all CCTV systems, regardless of what areas are captured.

Key POPIA Obligations for CCTV Operators

1. Lawful Purpose (Section 9)

You must have a legitimate, specific, and clearly defined purpose for operating your CCTV system. "Security" is a valid purpose, but you should be able to articulate it: "To deter crime, detect unauthorised access, and provide evidence in the event of a security incident on the property."

You cannot use CCTV footage collected for security purposes for other purposes — such as monitoring employee productivity or tracking customer behaviour for marketing — without separate justification.

2. Notification (Section 18)

Data subjects (people being recorded) must be notified that they are being recorded. For CCTV, this is typically achieved through visible signage. Your signage should:

• Clearly indicate that CCTV recording is in operation
• Identify who is responsible for the system (your name or business name)
• Provide contact details for the responsible party
• State the purpose of the recording

Signage must be placed at all entry points to areas under surveillance and must be clearly visible before a person enters the monitored area.

3. Security Safeguards (Section 19)

You must take reasonable technical and organisational measures to protect CCTV footage from unauthorised access, loss, or damage. This includes:

• Password-protecting your DVR/NVR system with a strong, unique password
• Restricting access to footage to authorised personnel only
• Securing the physical location of your recording equipment
• Using encrypted storage where possible
• Ensuring remote access to your system (via app or web browser) is secured with two-factor authentication

4. Retention Limitation (Section 14)

You may not keep CCTV footage for longer than necessary for the purpose for which it was collected. For most security applications, a retention period of 30–90 days is considered reasonable. Footage relating to a specific incident (a break-in, an insurance claim, a disciplinary matter) may be retained for longer while the matter is being resolved.

Once footage is no longer needed, it should be securely deleted — not simply overwritten by the system, but actively purged if it has been copied or exported.

5. Access to Personal Information (Section 23)

Individuals have the right to request access to footage in which they appear. If someone asks to see footage of themselves, you must respond within a reasonable time. You may redact footage showing other individuals before providing access.

Note that this right is separate from — and in addition to — the right of access under the Promotion of Access to Information Act (PAIA), which may also apply to businesses.

6. Sharing Footage with Third Parties

Sharing CCTV footage with third parties — including your armed response company, a neighbour, or on social media — is subject to POPIA's rules on sharing personal information. Key points:

• Law enforcement: You may share footage with SAPS in response to a lawful request or in the course of reporting a crime.
• Armed response / security companies: Ensure your contract with your security provider addresses how they handle footage they access.
• Social media: Posting footage of identifiable individuals on social media (including community WhatsApp groups and Facebook) without their consent is a POPIA violation and can expose you to complaints and liability. This applies even if the footage shows criminal activity.
• Neighbours: Sharing footage showing identifiable individuals with neighbours requires careful consideration — limit sharing to what is necessary and relevant.

CCTV in Sectional Title Schemes and Estates

Body corporates and homeowners' associations (HOAs) that operate CCTV systems in common areas have full POPIA obligations as responsible parties. This includes:

• Adopting a CCTV policy approved by the body corporate or HOA
• Ensuring adequate signage throughout common areas
• Appointing an information officer (the body corporate or HOA itself, or a designated trustee/director)
• Registering the information officer with the Information Regulator
• Implementing a process for handling access requests and complaints

Practical Compliance Checklist for CCTV Operators

• ✓ Define and document the purpose of your CCTV system
• ✓ Install visible, compliant signage at all entry points to monitored areas
• ✓ Password-protect your DVR/NVR with a strong, unique password
• ✓ Restrict access to footage to authorised personnel only
• ✓ Set your system's retention period to 30–90 days (or document your justification for longer retention)
• ✓ Secure remote access with two-factor authentication
• ✓ Document your CCTV policy in writing
• ✓ Register your information officer with the Information Regulator (businesses)
• ✓ Establish a process for responding to access requests
• ✓ Review your security company's data processing agreement

Penalties for Non-Compliance

The Information Regulator has the power to investigate complaints, issue enforcement notices, and refer matters for prosecution. Offences under POPIA can attract fines of up to R10 million and/or imprisonment of up to 10 years for the most serious violations.

While enforcement against individual homeowners for minor technical non-compliance is unlikely to be a priority, businesses and body corporates face real regulatory risk — particularly if a data breach or misuse of footage leads to a formal complaint.

Conclusion

CCTV remains one of the most valuable security investments you can make for your Johannesburg property. POPIA doesn't prevent you from using it — it simply requires that you use it responsibly, transparently, and with appropriate safeguards in place.

The compliance steps are straightforward for most residential and small business operators: install proper signage, secure your system, set a reasonable retention period, and be thoughtful about sharing footage.

Need help designing a CCTV system that's both effective and POPIA-compliant? Contact the Simplified Security team — we'll help you get the coverage you need while keeping you on the right side of the law.