CCTV at work in New Zealand: what the Privacy Act lets you record, and what it doesn’t

Be Watch installs cameras and access control for businesses across New Zealand, and the question we are asked most often is not about resolution or storage. It is “are we allowed to?” Yes — within rules the Office of the Privacy Commissioner spells out in its CCTV guidance. This is the practical version.

Why the Privacy Act applies to cameras

A recording of an identifiable person is personal information. That means collecting it (Principles 1–4), storing it securely (Principle 5), letting people access it (Principle 6), using it only for the purpose collected (Principle 10) and not keeping it longer than needed (Principle 9) all apply, exactly as they do to a customer database.

The seven rules in practice

1. Have a purpose, and write it down

“Security of staff, customers, stock and premises” is a purpose. “To see what staff are doing” is not one that will survive a complaint. One paragraph in the staff policy and the camera plan.

2. Point cameras at the risk

Entrances, exits, tills, stock areas, the yard, the car park. Not the office floor “just in case”, not the lunchroom, never toilets or changing rooms. A camera covering a workstation all day is surveillance of a person, not of a risk, and it is where complaints come from.

3. Tell people

Signs at every entrance that cameras operate and who to contact. A line in employment agreements or the staff handbook. If customers’ images are kept beyond a few days, say so.

4. Keep footage only as long as needed

Set the recorder to overwrite — two to four weeks covers nearly every incident. Keep specific clips longer only when an incident is being investigated, and delete them when it is over.

5. Limit who can watch

Named people, individual logins, and a log. Not the default password on the recorder, not the app on everyone’s phone. Remote viewing from a phone is useful and fine — for the two people who need it.

6. Secure the system like any other computer

Cameras and recorders are computers on your network. Change default passwords, keep firmware updated, put them on their own network segment, and do not expose the recorder to the internet directly. We see breached cameras far more often than broken ones.

7. Handle requests

A staff member or customer can ask for footage of themselves. Decide who handles it, respond within 20 working days, and blur or withhold other people where you should.

Audio, number plates and faces

Audio recording is a bigger intrusion than video; most business cameras should have it off. Number-plate recognition at a gate is reasonable for access; keeping the plate list beyond the purpose is not. Facial recognition is a different category of risk under the Privacy Commissioner’s guidance and should not be switched on in a small business without specific advice.

Cameras that are lawful are also cameras that are useful: they cover the right places, the footage is there when you need it, and nobody has a reason to complain. If you are putting in or replacing a system, ask Be Watch for the camera plan — the privacy settings are part of the design, not an afterthought.

Questions people ask