Reading time: 6 minutes

CCTV can be a useful tool for protecting your physical business premises and can aid in discouraging illegal behaviour and preventing theft. However, if you want to install CCTV at your business, there are privacy laws surrounding your use of this technology that your business must follow. You need to be aware of your obligations under this law, and ensure that you comply with them. If not, your business could face significant legal repercussions. This article will explain:

  • what kinds of CCTV these privacy laws apply to;
  • your obligations under privacy law;
  • the penalties for non-compliance; and
  • how you can use CCTV appropriately.

What Does CCTV Mean?

CCTV stands for “Closed-Circuit Television”, which refers to video cameras that record video surveillance, which you can then view on other devices. Some kinds of CCTV only stream video that you cannot play back, while others record video that you can replay as needed. You may decide you want to set up CCTV at your business for a variety of reasons, including to:

  • monitor what your staff and customers in your store are doing;
  • surveil and gather information if a crime were to occur; or
  • act as a deterrent for crime.

In New Zealand, you can only install CCTV cameras in the workplace if you comply with your privacy obligations. These rules apply to non-covert CCTV in public or semi-public places.

If you want to use hidden CCTV, or use it in your home rather than your business, there may be different legal requirements that apply.

Your Privacy Obligations

If your business deals with personal information, it is an “agency” and is liable under privacy law. Personal information is anything that can identify a person, which can range from your customers’ full names to their physical addresses. Video footage of people recorded by your CCTV cameras falls under that definition.

As such, there are rules you need to follow that govern how you:



Collect Information

You need to have a clear purpose for collecting this information. Here, you need to let people know about this purpose and the fact that you are collecting this information directly from them.

You can only gather what personal data is necessary for your purpose. 

Do not collect this personal information in an intrusive or unlawful way.

Store Information

You have to make sure that you have a safe method for storing personal data, and that the person involved can access that information and correct it if they wish.

Further, check that this personal data is accurate and do not store it for longer than necessary.

Use Information

You can only use the personal data you collect for its original intended purpose. 

For instance, you likely would not be able to use video footage you recorded for health and safety purposes in an employee disciplinary process.

Disclose Information

You generally cannot share the personal information you have collected with others unless that was the purpose you collected that information for. 

For example, if you recorded footage to establish evidence of theft occurring, you could give this information to the police.

Penalties for Non-Compliance

If someone thinks that your business has breached their privacy or that you have been recording them without heeding your privacy obligations, then they can make a complaint to the Privacy Commission. This would launch an investigation into your business, and how you manage your CCTV. Depending on the severity of the breach, and how co-operative you are, penalties can range from compliance notices to hefty fines.

For example, if you do not comply with an investigation within the Commission’s given timeframe, you could be fined $10,000 just for the added delay.

Develop a CCTV Plan

To ensure that you best comply with your privacy obligations as a business, you should draw up three documents surrounding your CCTV. These are:

  1. an evaluation of why you need CCTV, and what your CCTV system will look like;
  2. a business plan that outlines your CCTV strategy; and
  3. a CCTV policy that details how you will operate your system and provide rules for staff using it.

Once you have drafted these documents, you will have a clear system for CCTV usage in your workplace, which can be useful to refer back to if there are privacy concerns. Be sure to get expert advice if there is anything you are unsure about, and update these documents as you need. Some other things to keep in mind regarding CCTV:

  • only record during necessary hours of operation;
  • have clear signage alerting customers and employees that CCTV cameras are operating;
  • use the cameras for legitimate business purposes, like health and safety maintenance or surveillance. Do not go outside of these purposes, unless you have the permission of the people you are recording;
  • include information about your CCTV operations in your privacy policy on your website, or in a privacy notice at the main desk;
  • only keep the recorded footage for as long as you reasonably need it, delete it once you do not;
  • make sure your usage of CCTV cameras is lawful and not intrusive. For example, you would not put CCTV cameras in changing rooms; and
  • ensure that only authorised staff have access to CCTV footage.

Key Takeaways

If you decide that you need CCTV cameras for your business, make sure that you comply with your privacy obligations when you do so. You could face legal penalties if you do not comply with those obligations. If you would like more information or guidance regarding your CCTV and privacy, contact LegalVision’s New Zealand IT lawyers on 0800 005 570 or fill out the form on this page.


What does CCTV stand for?

CCTV stands for “Closed-Circuit Television”. These are security cameras that are used for surveillance, that record video and stream it to another device.

Is it illegal to have security cameras with signs?

If you have CCTV set up in your workplace, then you should indicate that fact with appropriate signage. This is so that your customers and employees know that you are recording them. If you do not, then you run the risk of breaching your privacy obligations.

What is the NZ Privacy Act?

The NZ Privacy Act sets out NZ privacy law. It operates on principles about how you should handle privacy, that outline how you should collect, store, and use personal data.

What is personal information for privacy purposes?

Personal information is information about an identifiable individual. This means that if you can identify someone using this information, such as a full name or a photo, then it is personal information. Privacy law protects this kind of information.

About LegalVision: LegalVision is a commercial law firm that provides businesses with affordable and ongoing legal assistance through our industry-first membership.

By becoming a member, you'll have an experienced legal team ready to answer your questions, draft and review your contracts, and resolve your disputes. All the legal assistance your business needs, for a low monthly fee.

Learn more about our membership

Need Legal Help? Submit an Enquiry

If you would like to get in touch with our team and learn more about how our membership can help your business, fill out the form below.

Our Awards

  • 2019 Top 25 Startups - LinkedIn
  • 2020 Innovation Award 2020 Excellence in Technology & Innovation Finalist – Australasian Law Awards
  • 2020 Employer of Choice Award 2020 Employer of Choice Winner – Australasian Lawyer
  • 2020 Financial Times Award 2021 Fastest Growing Law Firm - Financial Times APAC 500
  • 2021 Law Firm of the Year Award 2021 Law Firm of the Year - Australasian Law Awards
  • 2022 Law Firm of the Year Winner 2022 Law Firm of the Year - Australasian Law Awards