How Long Should CCTV Footage Be Stored? What to Consider

Many facility managers only ask how long CCTV footage should be stored after an incident, when they open the system and find that the recording from that day has already been overwritten. It's a fair question, but it is best answered before anything happens: retention time is a system design decision, not just a default number on the device.

There is no single figure that fits every site. How long CCTV footage is kept depends on the number of cameras, resolution, frame rate, recording mode and hard drive capacity. That result is then adjusted to your evidentiary needs, your internal policy and the principles of personal data protection. Calculate from what you need, not from whatever capacity happens to be installed.

Why Is Seven Days Often Not Enough?

Seven days is not enough when an incident is only discovered more than a week after it happened. That pattern is common: a stock discrepancy only shows up at the monthly stocktake, a customer complaint arrives after a long weekend, or an internal report is filed several weeks later.

Say a warehouse does its stocktake on the 1st of every month. A discrepancy is found on the 2nd, and the loss could have happened at any point in the previous 30 days. If footage is kept for only 7 days, three quarters of the period you need to review is already gone.

The better question is: how long is the gap between an incident happening and someone finding out about it? Your retention time should be longer than the longest realistic gap at your site, plus the time needed to secure the footage.

What Determines How Many Days a CCTV System Can Store?

Retention time is the result of four technical variables that multiply together, plus the hard drive capacity available. Changing any one of them immediately changes the number of days you can keep.

• Number of cameras: storage needs grow linearly. 32 cameras need twice the capacity of 16 cameras at the same settings.

• Resolution: higher-resolution cameras produce more detailed images and generally a higher bitrate.

• Frame rate: the more frames per second, the more data is written. Fast-moving areas (gates, loading docks) have different needs from a relatively static corridor.

• Recording mode: continuous recording writes data 24 hours a day. Motion-based recording only writes when there is activity, so it saves space in quiet areas, but the saving is small in areas that stay busy all day.

• Compression: standards such as H.265 are generally more efficient than H.264 at similar quality. Check the specifications of your cameras and recorder.

That is why the answer to "how many days does CCTV store footage?" is always "it depends on the configuration." The calculation can be done, and it isn't complicated.

How Do You Calculate CCTV Storage?

Storage needs are calculated from each camera's bitrate multiplied by the recording time. For continuous recording, one camera at a bitrate of 4 Mbps produces about 43 GB per day.

Basic formula:

1. Take the actual bitrate of each camera (Mbps) from the camera or recorder settings menu, not from the brochure.

2. Bitrate (Mbps) × 86,400 seconds ÷ 8 ÷ 1,000 = GB per camera per day (for 24-hour recording).

3. Multiply by the number of cameras and the number of days you want to keep.

4. Add a 15–20% buffer for bitrate variation, file system overhead and the capacity lost in a RAID configuration.

Example calculations

Look at the jump from the third row to the fourth. Extending retention from 30 to 90 days triples the capacity you need. That is why CCTV hard drive capacity should be settled at the start of a project, not added after the system is running.

One practical note: if you already have a system, work backward. Divide the total hard drive capacity by the combined daily consumption of all cameras, and you'll know how many days are actually kept before footage is overwritten.

Legal and Insurance Considerations When Setting Retention Time

As far as we can verify, there is no single national regulation that sets a CCTV retention period for all types of private sites. Still, several frameworks remain relevant when you set your policy.

Personal data protection. Footage that shows faces or other identifying details can count as personal data. Indonesia's Law No. 27 of 2022 on Personal Data Protection (the PDP Law) includes a storage limitation principle: personal data is deleted once the retention period ends or at the data subject's request, unless other legislation provides otherwise. In other words, keeping footage indefinitely and without a reason is not a safe position either. Where processing is based on consent, the data controller must tell the data subject the retention period (Article 21).

Evidence. Electronic information is recognized as evidence under the Electronic Information and Transactions (ITE) Law, and Constitutional Court Decision No. 20/PUU-XIV/2016 addresses how the standing of electronic evidence relates to the way it was obtained. In practice, the integrity and authenticity of footage are often disputed. Footage stored with a clear access log is easier to defend.

Insurance and contracts. Policy clauses or client contracts sometimes set requirements for proving a loss. Check your documents and ask your insurer or contract partner directly.

Sector regulations. Some sectors, such as banking, may have extra rules from their regulators. Make sure you check the rules that apply to your industry.

This section is a general explanation, not legal advice. SECOM is not a legal consultant; retention policy decisions should be discussed with your company's legal counsel.

Local, Network or Cloud Storage: Which Fits?

All three can be used, and the best choice is often a combination. What decides it is the retention time you need, your bandwidth and how much device failure you can tolerate.

A hybrid approach is a common choice: primary recording on a local recorder for the full retention period, with copies of important incident clips or critical cameras kept at a separate location. For large facilities such as factories or warehouses, capacity and redundancy are usually designed as part of an integrated system.

What Should You Do Before Footage Is Overwritten?

If you suspect an incident that needs to be investigated, secure the footage the same day. Footage that has been overwritten cannot be reliably recovered. Here is a practical sequence:

1. Stop the overwriting. Determine the date and time of the incident, then export the footage for that period right away (with a margin of a few hours before and after), before the next cycle overwrites it.

2. Copy to separate media. Use a flash drive or an external hard drive. Don't rely on a single copy on the recorder.

3. Record the metadata. Write down who exported the footage, when, from which camera and with what device. This record helps preserve the integrity of the footage if the authorities need it later.

4. Don't edit or trim the original files. Keep the original version exactly as it is, and make a working copy if you need one.

5. Restrict access to the footage to the people who need it.

6. Review afterwards. Ask: does our retention time match the gap between incidents and their discovery at this site?

That review shouldn't be done once and forgotten. At SECOM, we see CCTV as one part of a system that includes devices, procedures and people. In our Man-Machine approach, the technology records and stores, while a trained team makes sure the equipment stays healthy, export procedures are carried out correctly and the footage is usable when it is needed.

Choosing the Right Retention Time for Your Site

The right retention time comes from three questions: how long the gap is between an incident and its discovery at your site, what you need to prove, and what limits apply to the personal data in the footage. Once you have those answers, the storage calculation simply follows.

If you want to review a system that is already running or design a new one, the SECOM team can help through a site survey and needs assessment.

Request a site survey consultation and discuss your number of cameras, retention time and system requirements with SECOM Indonesia today.