In an era where security and surveillance are increasingly prioritized, Closed-Circuit Television (CCTV) cameras have become ubiquitous fixtures in Philippine establishments, residential communities, and public spaces. However, the convenience of 24/7 monitoring often collides directly with the fundamental right to privacy.

Under Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), video footage that can identify an individual is classified as personal data. Consequently, the National Privacy Commission (NPC) monitors, regulates, and issues strict guidelines on how CCTVs must be deployed, operated, and managed.

Here is a comprehensive legal breakdown of what Personal Information Controllers (PICs)—such as businesses, employers, and condo corporations—need to know to ensure their surveillance systems remain lawful.

1. The Core Legal Foundations

The NPC evaluates the lawfulness of CCTV use based on three pillars of data privacy: Transparency, Legitimate Purpose, and Proportionality.

Transparency: Data subjects (the people being recorded) must be aware that they are being monitored. Hidden or clandestine cameras are generally prohibited unless under specific, legally authorized law enforcement exceptions.
Legitimate Purpose: Surveillance cannot be installed "just because." The purpose must be specific, explicit, and lawful—such as crime prevention, public safety, or property protection.
Proportionality: The processing of data must be adequate, relevant, and not excessive. If a less intrusive measure can achieve the same security goal, it should be used instead.

2. Mandatory Compliance Requirements

To avoid hefty fines and criminal liability under the DPA, any entity operating a CCTV system must implement the following measures:

A. Prominent CCTV Notices

You cannot record individuals stealthily. Establishments must post clear, visible, and easily readable warning signs at all entry points and within the monitored areas.

What the notice should include: A statement that CCTV monitoring is in effect, the purpose of the recording, and contact details where data subjects can voice inquiries or exercise their rights.

B. Defining the CCTV Policy

Organizations must formalize a written CCTV Policy. This document outlines:

Who has access to the footage.
How long the footage is retained.
The protocol for releasing footage to third parties (e.g., law enforcement).
The security measures protecting the storage devices.

C. Restricted Access and Security

CCTV monitors and storage feeds must not be on display for the general public or unauthorized staff to see. They must be kept in a secure location, and access to live feeds and recorded logs must be strictly restricted to designated personnel (e.g., security officers or data protection officers).

3. The "No-Go" Zones: Where CCTVs are Prohibited

The right to privacy is at its highest in spaces where individuals have a reasonable expectation of privacy. The NPC strictly prohibits the installation of CCTVs in areas such as:

Restrooms and changing rooms
Locker spoons and shower areas
Breastfeeding or lactation rooms
Private offices (unless justified by extreme security risks)

Note on Workplace Monitoring: While employers have a right to protect their property and monitor employee productivity, continuous, close-up monitoring of an employee’s desk or workstation without a compelling security threat violates the principle of proportionality.

4. Data Retention and Disposal

Footage cannot be stored indefinitely. The NPC mandates that personal data must only be retained as long as necessary to fulfill the declared purpose.

Standard Retention: Most commercial establishments retain footage for 15 to 30 days, after which the system automatically overwrites the old data.
Extended Retention: Footage may only be kept longer if it captures a specific incident (e.g., theft, accident, or physical altercation) that is currently under investigation or subject to a legal claim. Once the investigation or legal proceedings conclude, the footage must be securely and permanently deleted.

5. Rights of the Data Subjects (The Recorded Individuals)

Under the DPA, individuals caught on camera retain specific rights:

Right to Access: A person has the right to request a copy of the CCTV footage featuring them, provided they can prove their identity and specify the exact date and time. However, the establishment must mask or blur the faces of other individuals in the footage to protect third-party privacy.
Right to Rectification/Erasure: If the footage was taken unlawfully, the data subject can demand its deletion.

6. Requests from Law Enforcement

Can an establishment hand over CCTV footage to the police upon request? Yes, but not unconditionally.

To protect themselves from privacy violations, PICs should require law enforcement authorities to present a formal written request, a subpoena, or a court order detailing the specific investigation. Random, undocumented "fishing expeditions" by authorities should not be accommodated.

Summary of Obligations for CCTV Operators

Action Item	Legal Status	NPC Requirement
CCTV Signs	Mandatory	Must be visible before entering the camera's range.
Privacy Policy	Mandatory	Written protocol detailing retention and access limits.
Audio Recording	Highly Restricted	Generally prohibited unless separate consent or explicit legal grounds exist.
Public Uploads	Prohibited	Posting CCTV clips on social media to "shame" suspects violates the DPA.

Failure to comply with these guidelines can expose business owners and management to severe penalties under the Data Privacy Act, including imprisonment ranging from one to six years and fines scaling from ₱500,000 to ₱5,000,000. Balancing security with privacy is no longer just good practice—it is a strict statutory mandate in the Philippines.