A CCTV policy is usually written once, when the cameras go in, and then filed. Under POPIA, footage of identifiable people is personal information, so the question that matters later is whether the policy still describes what happens at the cameras, the monitor and the recorder.
Schools, employers and small businesses rarely call this a policy problem. It tends to arrive as a plain question: "Who can see our cameras?", "How long do we keep the footage?" or "Is a sign at the gate enough?" Earlier this year a High Court in KwaZulu-Natal allowed cameras to remain in a school's classrooms on the condition that the school develop a policy balancing safety and privacy, with learners' interests paramount, as reported by GroundUp. The reports do not discuss how POPIA applied, and this article does not read the judgment. The practical point holds for any organisation with cameras: a policy is a set of claims, and claims can be checked.
What POPIA expects of CCTV in a school or workplace
POPIA does not contain a separate CCTV chapter in the Act itself. The general conditions for lawful processing apply to footage like any other personal information, and four of them bear directly on cameras:
- Openness (Section 18). The responsible party must take reasonably practicable steps to make people aware that information is being collected and why. A sign and a plain-language notice help only if they describe what really happens.
- Only what the purpose needs (Section 10). Personal information must be adequate, relevant and not excessive for the stated purpose, so camera positions and coverage should fit the reason given, such as theft or safety.
- Kept no longer than necessary (Section 14). Records must not be retained longer than needed for the purpose, and must be destroyed or deleted as soon as practicable once there is no authority to keep them. A stated retention period is really a claim about the recorder's setting.
- Secured (Section 19). Appropriate, reasonable technical and organisational measures are needed to prevent unauthorised access. In practice, the list of people with a login is the test.
Where a CCTV policy and daily practice drift apart
The mismatch is rarely deliberate. As a hypothetical illustration, a policy might say that footage is viewed only by the principal or the site manager, while in practice staff from the security company, an IT contractor and a shared login all have access, and the app sits on several personal phones. A policy might promise that recordings are overwritten after a set period, while the recorder was configured at installation and nobody has looked at it since, or exported clips have been saved to laptops and shared in messaging groups. A sign might mention the gate camera while others now cover reception and corridors. Nobody set out to make the policy wrong. It was simply never compared with practice.
How a CCTV policy is tested against practice
The working method at Kevin Bishop Consulting treats a CCTV policy as a list of claims to be tested rather than a document to be tidied. Each statement is set against evidence: the access list, the retention setting, what each camera can see, the sign at the entrance, and a short conversation with the person who operates the system. Each finding is scored before it is discussed, so the conversation starts from a ranked list of remediable starting points, not a verdict. It is the evidence-against-requirement discipline of an ISO 9001-style audit, applied to personal information, and it suits a Johannesburg school or a Gauteng employer as readily as a larger organisation.
A first CCTV check you can do this week
- List every camera, what it covers and what it is for.
- Ask whoever manages the system for the full list of people and companies who can view footage, including apps and contractors, and for the retention setting.
- Read the policy and the sign next to that evidence, and mark every line the evidence does not support.
- Ask the person who watches the footage what they do when someone asks for a copy, and whether that matches the policy. The post Is your POPIA privacy notice true? applies the same test to the notice itself, and the check is worth repeating whenever a camera, system or provider changes.
For organisations that want a starting point on where they stand across both Acts, the POPIA/PAIA Readiness Snapshot is a desktop, self-reported readiness rating.
Related reading: