CCTV Privacy Rules in NZ: What Homeowners and Businesses Need to Know

CCTV cameras are now a normal part of security for New Zealand homes, farms, shops, offices, schools, warehouses and commercial sites. A well-designed system can deter intruders, record incidents, support insurance claims and help business owners understand what is happening on their property. But because security cameras capture images of real people, they also raise privacy questions.

For homeowners, the questions are often practical. Can my camera look over the driveway? What if it catches part of the neighbour’s fence? Should I put up a sign? Can I post footage online if someone suspicious walks past my house?

For businesses, the responsibilities are wider. CCTV footage can be personal information, and the Office of the Privacy Commissioner says businesses and organisations need to understand what information they are collecting, why they are collecting it, how they will use it, who can access it, how long it will be kept and how they will respond if someone asks to see footage of themselves.

This article explains the main CCTV privacy rules in New Zealand in plain English, so you can protect your property without creating avoidable privacy risks.

CCTV Footage Can be Personal Information

The starting point is simple: if your CCTV system records identifiable people, that footage may be personal information. That does not mean CCTV is banned. It means the system needs to be installed and managed sensibly.

For businesses and organisations, the Privacy Act 2020 sets out privacy principles that govern how personal information is collected, stored, used and shared. The Office of the Privacy Commissioner explains that the Act is designed so people know when their information is being collected, that it is used and shared appropriately, that it is kept safe, and that people can access information about themselves.

In CCTV terms, this means a business should not install cameras simply because “more coverage is better”. It should have a clear reason. That reason might be preventing theft, protecting staff, managing access to a restricted area, monitoring a car park, or recording incidents at an entrance. The camera locations, recording settings and access permissions should all match that purpose.

If you are planning a new system, this is where professional design matters. A camera that is positioned well can capture useful security footage without over-recording neighbours, staff break areas, public footpaths or unrelated spaces. Arc’s CCTV security camera surveillance systems are ideal for anyone who wants a properly designed camera layout rather than a one-size-fits-all kit.

Home CCTV Is Treated Differently, but Privacy Still Matters

The Privacy Act may not apply in the same way to a person using CCTV at home for personal or household security. However, that does not mean homeowners can ignore privacy altogether. The Office of the Privacy Commissioner’s home CCTV guidance recommends talking to neighbours before setting up cameras, using signs where appropriate, not pointing cameras directly at a neighbour’s doors, windows or property, not keeping footage longer than necessary, and being careful before uploading footage to the internet.

A good rule for home security cameras is to record what you genuinely need to protect. Your front door, driveway, gate, garage, shed or side path may be reasonable areas to monitor. A neighbour’s lounge window, bedroom window, backyard or private outdoor area is not.

This is especially important in suburban areas of Hamilton, Cambridge, Te Awamutu and the wider Waikato, where homes are often close together. A small change in angle can make a big difference. The camera can still capture someone entering your driveway without unnecessarily recording next door’s private space.

Homeowners should also be careful with audio. Many modern cameras include microphones by default, but audio recording is more intrusive than video. The Office of the Privacy Commissioner says CCTV should not record sound if visuals are enough, and if audio is used, people need to be told.

Businesses Need a Clear CCTV Purpose

For a business, CCTV should begin with a clear purpose statement. This does not need to be complicated. It may be as simple as saying cameras are used to protect staff and customers, deter theft, monitor entry points, protect stock, assist with health and safety incidents, and support Police or insurance investigations where appropriate.

That purpose should shape the system. Cameras near tills, stock rooms, entrances, loading bays and car parks may be justified. Cameras in bathrooms, changing rooms or areas where people reasonably expect privacy are not appropriate. Cameras in staff areas need careful thought, because employees have privacy rights too.

Employment New Zealand says employers using cameras, software or equipment to monitor, record or film employees must act in line with the Privacy Act 2020 and privacy principles. Employers should also consider morale and productivity, develop a workplace policy, consult employees where relevant, and make sure staff know about the policy and why monitoring is needed.

CCTV is strongest when it is not doing everything alone. Access control can limit who enters sensitive areas, alarm monitoring can alert people when something happens, and CCTV can provide visual context after the event.

CCTV Signage Should be Clear

In most business settings, people should know they are being recorded. The Office of the Privacy Commissioner says businesses usually need to make sure people know they are being filmed, why they are being filmed, and how the footage will be used and stored. Many businesses do this with signage.

A good CCTV sign does not need to be intimidating. It should be visible before or as people enter the monitored area. It should say that CCTV is in operation and give a simple reason, such as safety and security. For businesses, it is also useful to include who operates the system or who people can contact with privacy questions.

Signage is especially important for shops, offices, schools, gyms, churches, warehouses and shared sites where staff, customers, contractors and visitors may all be recorded. If cameras are hidden or covert, the privacy threshold is much higher. Covert CCTV should only be considered in limited situations, and businesses should get proper advice before using it.

Do Not Collect More Than You Need

One of the most common CCTV mistakes is over-collection. This happens when cameras record too much, for too long, from too many angles, or with too many features turned on.

The Privacy Commissioner’s guidance says CCTV cannot be used in a way that is unlawful, unfair or unreasonably intrusive. Whether CCTV is unreasonably intrusive depends on the sensitivity of the information being collected and the seriousness of the reason for collecting it. The guidance also says that if a fixed view is enough, a moving camera may not be necessary, and if visuals are enough, audio should not be recorded.

In practice, this means camera design should be intentional. A camera at a gate might need to capture vehicles and visitors entering the site. A camera at a reception desk might need to show who entered the building, but not record private conversations. A camera in a warehouse might need to cover stock movement and loading areas, but not continuously monitor staff lunch spaces unless there is a strong reason.

This is where Arc can speak from a systems-design perspective. CCTV should be planned alongside lighting, alarms, intercoms, gates and access control. A camera should not be forced to compensate for poor lighting, weak access control or an unsecured entry point.

Store CCTV Footage Securely

Once footage is recorded, it needs to be protected. A CCTV system is only useful if the right people can access footage when needed and the wrong people cannot.

For businesses, access should be limited to people who genuinely need it. That might be a business owner, site manager, security manager, authorised administrator or monitoring provider. Shared passwords, unsecured apps and open access to live feeds all create privacy and security risks.

Storage matters too. Principle 9 of the Privacy Act says an organisation should not keep personal information longer than required for the purpose it may lawfully be used.

For CCTV, that usually means choosing a retention period that matches the site’s needs. Some businesses may only need footage for a short period unless an incident occurs. Others may need longer retention because incidents are discovered later, or because insurance, operational or safety requirements justify it. The important point is to make a deliberate decision and document it, rather than keeping footage indefinitely because the system allows it.

Cloud-connected cameras add another consideration. Businesses should know where footage is stored, who can access it, what security controls are in place, and whether any information is being disclosed outside New Zealand. If the system is connected to phones, tablets or remote browsers, those access points should also be protected.

People May Ask to See Footage of Themselves

Businesses should be ready for access requests. The Office of the Privacy Commissioner says individuals have a right to access information about themselves held by an agency, and this can include CCTV footage of themselves. A business should not have a blanket policy saying CCTV footage will never be released directly to a requester. It also should not automatically refuse a request just because other people appear in the footage.

This does not mean every request is simple. Footage may include other people, sensitive situations or security concerns. The business may need to weigh the requester’s access rights against other people’s privacy. In some cases, faces may need to be blurred or parts of footage withheld. But the request must be taken seriously.

One practical point is particularly important: if someone asks for footage, the business should take steps to preserve it before it is overwritten. The Privacy Commissioner warns that an agency must not deliberately delete or allow footage to be deleted after receiving a request, and doing so can be a criminal offence under the Privacy Act.

Be Careful Before Sharing CCTV Footage

CCTV footage should not be treated like ordinary video content. Posting clips on social media, sending footage widely, or using screenshots in public posts can create privacy problems, even when the original reason for recording was legitimate.

Homeowners should be especially careful with footage of neighbours, children, delivery drivers, visitors or people walking past. The Privacy Commissioner’s home guidance says people should stop and think before uploading footage to the internet, should give footage to Police if they suspect an offence, and should not share footage of neighbours on their property.

Businesses should also have rules for when footage can be shared. Sharing with Police, insurers or a legal adviser may be appropriate in the right circumstances. Sharing in a staff group chat, posting online to identify someone, or sending clips to people who do not need them may not be.

Good CCTV Protects Security and Privacy

The goal is not to make CCTV difficult. The goal is to make it effective, fair and defensible.

For homeowners, that means pointing cameras at the areas you need to protect, avoiding neighbours’ private spaces, keeping footage only as long as necessary, and being careful about online sharing.

For businesses, it means having a clear purpose, using visible signage, consulting staff where workplace monitoring is involved, limiting camera coverage to what is necessary, securing access to footage, setting a sensible retention period, and having a process for access requests.

A professionally installed CCTV system should help you feel more secure, not leave you wondering whether your cameras are creating new risks. Arc designs and installs security systems for homes, businesses, schools, commercial sites and organisations across Hamilton and the wider Waikato. If you are planning CCTV, upgrading an older system, or integrating cameras with alarms, access control, intercoms or automatic gates, talk to Arc about a system that protects your property while respecting privacy.

Looking for a CCTV security camera system for your home or business? Contact Arc to discuss a practical, well-designed security solution for your site.

07 849 0901