Quick answer

CCTV use in the Philippines is generally lawful even without each person’s consent, but only when the operator has another valid legal basis, a specific legitimate purpose, proportionate camera coverage, proper notice, adequate security, and a lawful policy for access, disclosure, retention, and deletion.

Consent is not the default legal basis for CCTV in malls, offices, condominiums, schools, stores, and other public or semi-public places because people cannot realistically negotiate whether they will be recorded. A CCTV sign provides notice; it does not by itself cure excessive, secret, or unlawful surveillance.

Cameras must not monitor places where people have a heightened expectation of privacy. CCTV is strictly prohibited in fitting rooms, restrooms, toilets, and lactation or breastfeeding rooms. Cameras should not be aimed through a neighbor’s windows, into a private backyard, or across more property than the security purpose reasonably requires.

The principal rules are the Data Privacy Act of 2012 and NPC Circular No. 2024-02 on CCTV Systems, effective since August 27, 2024.

When the CCTV rules apply

NPC Circular No. 2024-02 covers personal information controllers and processors that use fixed or stationary camera-surveillance systems to capture identifiable people or other information relating to individuals.

This normally includes CCTV operated by:

Employers and business establishments
Malls, restaurants, hotels, resorts, and hospitals
Schools and universities
Condominium corporations, homeowners’ associations, and property managers
Government offices, subject to applicable public-sector rules
Transport operators and establishments open to the public
Landlords or residential operators monitoring common areas
Security agencies acting for an organization

A person or organization deciding why, where, and how CCTV is used is generally the personal information controller. A security company or cloud-storage provider processing footage on its instructions may be a personal information processor. Outsourcing does not remove the controller’s responsibility.

The household exception is limited

CCTV used purely for personal, family, or household affairs within the premises and boundaries of a private, noncommercial residence is outside the CCTV Circular.

That exception may be lost when the system:

Captures people beyond the residence’s boundaries, particularly in a public space;
Regularly monitors neighbors, passersby, workers, customers, or other people with no household relationship;
Is connected with a business or professional activity;
Is used in a way that adversely affects other people’s rights; or
Is disseminated to an indefinite audience, such as through public livestreaming or social-media posting.

Even where the household exception applies, it does not cancel the Civil Code right to privacy, the Anti-Wiretapping Law, the Anti-Photo and Video Voyeurism Act, or other applicable laws.

Lawful government surveillance

The CCTV Circular does not govern law enforcement, intelligence, investigative, and other government agencies when they conduct lawful surveillance under their statutory mandates. Such surveillance remains subject to the Constitution and the laws and rules authorizing or restricting it. This is not a general exception for private security personnel, employers, or private investigators.

Is consent required?

Not always. Section 12 of the Data Privacy Act permits processing when at least one lawful basis applies. Depending on the facts, CCTV may be justified by:

Compliance with a legal obligation;
Protection of life, health, or other vital interests;
Public order, public safety, or the lawful functions of a public authority;
A contract, when the recording is genuinely necessary for that contract; or
A legitimate interest that is necessary, proportionate, and not overridden by the individual’s fundamental rights.

Security, crime prevention, access control, protection of property, and investigation of specific incidents may support a legitimate-interest assessment. Merely calling a purpose “security,” however, does not make unlimited surveillance lawful. The operator must be able to show that the surveillance is necessary, that less intrusive measures are insufficient, and that its effect on people is proportionate.

If footage reveals sensitive personal information—such as health information, sexual life, or information about an alleged offense—the stricter lawful bases in Section 13 of the Data Privacy Act apply.

A CCTV sign is notice, not blanket consent

A visible notice informs people that surveillance is taking place. It does not mean they agreed to every possible use of the footage. Recording for building security does not automatically authorize posting the clip online, using it for entertainment, facial recognition, employee productivity scoring, or an unrelated marketing campaign.

If an operator chooses consent as its legal basis, consent must be freely given, specific, informed, and evidenced in written, electronic, or recorded form. Consent may be invalid where a person has no realistic choice, particularly in an employment relationship or a place the public must enter to obtain an essential service.

Where cameras may and may not be placed

Camera location, angle, zoom, rotation, and audio capability must match the declared purpose.

An operator should:

Monitor only the intended area;
Use the least intrusive angle that still achieves the security purpose;
Avoid recording through windows or over fences into private premises;
Limit zoom and pan functions so they cannot be used to inspect private spaces;
Avoid unnecessary close-ups or continuous tracking of particular individuals;
Consider privacy masking for portions of the frame that do not need to be seen; and
Review camera placement whenever the premises or purpose changes.

NPC Circular No. 2024-02 strictly prohibits CCTV in fitting rooms, restrooms, toilets, and lactation or breastfeeding rooms. Other places—such as changing areas, bedrooms, treatment rooms, prayer rooms, and private offices closed to the public—may also carry a strong expectation of privacy. Legality will depend on the precise circumstances, but covert or continuous monitoring in such areas presents a serious legal risk.

Cameras facing a neighbor’s property

Owning the camera or the wall where it is mounted does not create a right to monitor someone else’s private activities.

In Spouses Hing v. Choachuy, the Supreme Court upheld injunctive relief where surveillance cameras covered a significant part of adjacent private property. The Court explained that privacy extends to places where a person has a socially recognized reasonable expectation of privacy, including certain business premises closed to the public. Camera surveillance should not pry into another residence or private office. The result remains fact-specific, including the camera angle, the area captured, the security need, and the extent of intrusion. See the Supreme Court decision in G.R. No. 179736.

For a residential security camera, a safer setup is to frame the owner’s gate, doorway, driveway, or boundary and exclude neighboring windows, private yards, and other unnecessary areas. Keep screenshots showing the configured field of view and document why each camera is needed.

What a proper CCTV notice should say

Notices must be clear, readily visible, and prominently displayed at entrances or other conspicuous points before people enter the monitored area.

The notice should explain, directly or through an accessible layered privacy notice:

That CCTV is operating;
The purpose of the surveillance;
The nature, scope, and extent of recording;
Whether audio, zoom, facial recognition, or other analytics are used;
The identity and contact details of the operator or its representative;
Likely recipients or categories of recipients;
The retention period or how it is determined;
How a person may request access or raise a complaint; and
The person’s relevant data-subject rights.

A generic “CCTV in operation” sticker may be insufficient if it omits material features such as audio recording or facial recognition.

Audio recording requires separate caution

A CCTV microphone creates a risk beyond ordinary video surveillance. Under the Anti-Wiretapping Law, Republic Act No. 4200, secretly recording a private communication or spoken word without authorization from all parties may be criminal.

The Supreme Court has held that even a participant in a private conversation may fall within the law if the participant secretly records it without the other party’s authorization. See Ramirez v. Court of Appeals, G.R. No. 93833.

An operator should therefore disable audio unless it is genuinely necessary and supported by specific legal advice. A general video-surveillance notice should not be assumed to authorize secret recording of private conversations.

Duties of businesses, employers, schools, and property managers

A covered operator should maintain a written CCTV policy that addresses:

The legitimate purpose and lawful basis;
Camera procurement, placement, operation, monitoring, and maintenance;
Regular privacy impact assessments and reviews;
CCTV notices;
Personnel authorized to view live feeds or stored footage;
Access and third-party disclosure requests;
Complaints and inquiries;
Security incidents and personal data breaches;
The retention and secure-destruction schedule;
Access logging, copying, transfer, and audit controls; and
Regular review and revision of the policy.

Stored footage must be protected against unauthorized viewing, copying, alteration, destruction, and disclosure. The NPC requires secure storage and encryption under applicable standards. Only authorized personnel should monitor live feeds or access stored footage, and access, reproduction, and transfer logs should be maintained.

These duties apply as well to footage processed through video analytics, including facial recognition and artificial-intelligence systems. Analytics should undergo a privacy impact assessment because they can create additional data and higher risks than ordinary recording.

Workplace CCTV

An employer may use proportionate CCTV for a legitimate security or operational purpose without relying on employee consent. Employees must still be properly informed, and monitoring must not be oppressive, discriminatory, or excessive.

Using security footage for discipline also engages labor-law requirements. CCTV does not eliminate the employer’s duty to investigate fairly, authenticate the evidence, consider the employee’s explanation, and observe substantive and procedural due process.

How long may footage be retained?

There is no single nationwide retention period for all CCTV footage.

The operator must set and document a period based on the declared purpose—not merely on how much storage is available. Footage must be destroyed securely when no longer needed, unless continued preservation is justified by:

A pending access or preservation request;
An incident, complaint, investigation, or legal claim;
A lawful request from a public authority;
A court order or subpoena; or
A special law, regulation, contract, or valid local ordinance.

A business should not claim that footage was automatically overwritten if it had already received a written preservation request concerning that footage.

How to request CCTV footage

A person whose personal data appears in the footage has a right to reasonable access. This may include viewing the recording or obtaining a copy, subject to lawful limitations and safeguards for other people.

Send the request in writing as soon as possible. Include:

Your full name and contact details;
Proof of identity limited to what is necessary for verification;
The exact location and camera area;
The specific date and approximate time;
A short description of yourself, clothing, vehicle, or incident;
Whether you seek viewing, a copy, or both;
The lawful purpose of the request; and
Authority documents if acting for another person.

A parent, guardian, heir, or authorized representative may be required to provide proof of relationship or authority.

Send a preservation request immediately

Once the operator receives written notice that a person intends to view or obtain particular footage, it must remove the relevant footage from ordinary deletion or overwriting until:

The request is fulfilled;
The request is abandoned; or
A challenged denial is ultimately affirmed by the NPC.

A request is deemed abandoned if the requester does not complete the applicable requirements within 30 days after first informing the operator of the intention to view or obtain the footage.

Keep proof of delivery, such as a received copy, email delivery record, ticket number, or courier receipt.

Response deadlines

The period begins when the requester has completed the applicable requirements:

Viewing only: not more than five working days;
Obtaining a copy: not more than 15 working days; and
Complex requests or numerous recordings: an extension of up to 15 additional working days.

The operator must give written notice of an extension, the reason for it, and the intended compliance date.

Viewing may be conducted in a secure area under appropriate confidentiality controls. Copies must be produced securely while preserving the footage’s integrity and associated metadata. If providing video is technically difficult, sufficient still images covering the requested period may be supplied. A reasonable administrative fee may be charged, but it cannot be excessive or designed to discourage requests.

When access may be denied

A request may be denied after proper evaluation when, for example:

The requester does not provide enough information to locate the footage;
The request is frivolous or vexatious;
The proposed purpose or use is contrary to law, morals, or public policy;
Providing a copy would be disproportionate to the stated purpose;
Access would impose an unreasonable burden or disproportionate expense;
The footage was lawfully deleted before the request was received; or
An appropriate public authority determines, in writing, that disclosure could endanger an ongoing criminal investigation.

Before denying access, the operator must give the requester a reasonable opportunity to correct or narrow the request. A written reason for denial must be provided within five working days from receipt. A denial does not prevent a later, properly detailed request.

The mere appearance of another person in footage requested by a data subject does not automatically turn it into a third-party request. The operator may use controlled viewing, masking, limited extracts, or other safeguards where appropriate.

Requests by police, courts, media, and other third parties

A person requesting footage in which they do not appear generally makes a third-party request. The operator must evaluate it with greater scrutiny and identify a lawful basis for disclosure.

Law enforcement

Authorized law-enforcement agencies may obtain appropriate footage for criminal investigation and case build-up. Officers should provide a written statement, affirmative declaration, or equivalent showing the lawfulness of the request and comply with applicable investigative procedures.

A request from someone merely claiming to be a police officer should be verified through official credentials and channels. Record what was disclosed, to whom, when, and under what authority.

Court and administrative proceedings

Disclosure pursuant to a lawful order of a competent court is allowed, subject to subpoena rules. Footage may also be used in an administrative investigation when the requester provides sufficient proof of the pending complaint or investigation.

Media requests

A CCTV operator is not automatically required to release footage to the media. Disclosure still requires a lawful basis and must respect data-subject rights and journalistic standards. Identifiable footage must not be released for amusement or entertainment without the subjects’ consent. Where a report seeks to identify a particular person, images of unrelated individuals should be masked before publication.

Private requests after an accident or crime

A victim, vehicle owner, insurer, lawyer, or other third party may request footage to protect lawful rights, establish a legal claim, or identify a suspected offender. Approval is not automatic. The operator must balance the requester’s legitimate need against the rights of everyone recorded.

If the footage concerns a crime, ask the police or investigating authority to make its own prompt preservation and disclosure request.

Do not post CCTV footage casually

Uploading a recording to Facebook, TikTok, a group chat, or a “wall of shame” is a new act of processing and disclosure. A security purpose for recording does not automatically justify public posting.

Before sharing footage, consider:

Whether publication is genuinely necessary;
Whether the person’s identity has been reliably established;
Whether innocent bystanders, minors, victims, or witnesses appear;
Whether masking or a still image would be sufficient;
Whether publication may prejudice an investigation;
Whether it exposes private or sensitive information; and
Whether a police report or controlled disclosure is the safer course.

The person who receives a CCTV copy becomes responsible for how that copy is stored, used, and disclosed.

Sexual or intimate footage carries especially serious consequences. The Anti-Photo and Video Voyeurism Act of 2009 prohibits specified recording and disclosure of sexual acts or private areas where a person has a reasonable expectation of privacy. Consent to being recorded does not, by itself, authorize later copying, distribution, or publication. The Safe Spaces Act may also apply to gender-based online sexual harassment and unauthorized sharing in the circumstances covered by that law.

Preserving CCTV as possible evidence

CCTV footage is not automatically conclusive or admissible merely because it exists. Relevance, lawful acquisition, authenticity, integrity, and proper presentation still matter under the Rules of Court and the Rules on Electronic Evidence.

To preserve evidentiary value:

Request preservation before the ordinary retention period expires;
Obtain the original exported file where possible, not only a phone recording of a monitor;
Preserve the full relevant time segment, including reasonable time before and after the incident;
Keep the file in its original format with available date, time, camera, and location metadata;
Do not crop, enhance, annotate, or convert the only copy;
Make a working copy for viewing and keep the original unchanged;
Record who extracted, received, copied, transferred, and stored the file;
Preserve the operator’s certification, transmittal email, access logs, and request correspondence;
Note any clock error, missing segment, poor image quality, or system malfunction; and
Give investigators or counsel an accurate account of how the footage was obtained.

Editing a copy for presentation may sometimes be useful, but the unedited source should remain available for authentication and comparison.

If footage is leaked, stolen, or accessed without authority

The operator should immediately contain the incident, preserve logs, determine what footage and personal data were affected, and involve its data protection officer or breach-response team.

Mandatory notification to the NPC and affected individuals generally arises only when all three conditions are present:

Sensitive personal information or other information usable for identity fraud is involved;
An unauthorized person is reasonably believed to have acquired it; and
The breach is likely to create a real risk of serious harm.

A mandatory notification must be submitted through the NPC’s Data Breach Notification Management System within 72 hours from knowledge or reasonable belief that the breach occurred. Current guidance requires the full report within five days from discovery unless the NPC grants additional time. Incidents that do not meet the mandatory-notification test must still be documented and handled appropriately. See the NPC breach-reporting guidance and NPC Advisory No. 2026-02.

Common mistakes

Treating a CCTV sign as consent to any later use;
Installing cameras first and inventing the purpose afterward;
Recording a wider area than necessary;
Enabling audio without a separate legal assessment;
Placing cameras in private or prohibited areas;
Allowing all guards, employees, or residents unrestricted live access;
Sharing administrator passwords or using personal laptops for monitoring;
Sending footage through unsecured personal messaging accounts;
Keeping footage indefinitely “just in case”;
Deleting footage after receiving a written preservation request;
Refusing every request merely because another person appears in the frame;
Releasing clips to media or social media without a lawful basis;
Using facial recognition without a privacy impact assessment; and
Assuming illegally obtained footage is automatically admissible because it shows misconduct.

How to complain

Start by writing to the CCTV operator, its management, or its data protection officer. Identify the violation, request specific corrective action, and preserve proof that the letter was received.

Under the 2021 NPC Rules of Procedure, as amended, an NPC complaint ordinarily requires proof that:

The complainant first informed the operator in writing; and
The operator failed to take timely or appropriate action, or did not respond within 15 calendar days from receipt.

The NPC may waive exhaustion for good cause or a serious violation, including grave and irreparable harm that only NPC action can prevent, the absence of an adequate remedy from the respondent, or patently illegal action.

A formal complaint must follow the prescribed form, be verified and notarized, and include the relevant correspondence and evidence. The NPC currently accepts complaints in person, by courier, or by sending a scanned complaint to complaints@privacy.gov.ph. Check the NPC filing page for the current form, fees, address, and submission instructions before filing.

When legal or police help is urgent

Seek immediate assistance when:

A camera is found in a restroom, fitting room, bedroom, or similar private area;
Intimate, sexual, or child-related footage has been recorded or threatened with publication;
Footage is being used for blackmail, stalking, harassment, or threats;
A suspect is actively accessing or deleting recordings;
The ordinary retention period is about to expire and the footage is essential to a serious case;
A leak creates an immediate safety or identity-fraud risk;
Police, media, an employer, or another party demands disclosure without clear authority; or
An injunction, subpoena, search warrant, or other time-sensitive court remedy may be necessary.

For an immediate threat to life or safety, contact emergency or law-enforcement services first. A privacy complaint does not replace a criminal complaint, protective order, civil action, labor case, or other remedy required by the circumstances.

Possible liability

A violation is not automatically a crime; the prosecution must prove the elements of the particular offense. Depending on the conduct, consequences may include NPC orders, administrative fines, damages, injunctions, and criminal prosecution.

Under the Data Privacy Act:

Unauthorized processing of ordinary personal information may carry one to three years’ imprisonment and a ₱500,000 to ₱2 million fine.
Unauthorized processing of sensitive personal information may carry three to six years’ imprisonment and a ₱500,000 to ₱4 million fine.
Unauthorized or malicious disclosure, negligent access, intentional breach, improper disposal, and concealment of a notifiable breach have separate penalties.
When at least 100 persons are harmed, affected, or involved, the Act directs application of the maximum penalty in the applicable scale.

Under NPC Circular No. 2022-01, major infractions may attract fines of 0.25% to 2% of the preceding year’s annual gross income, while grave infractions may attract 0.5% to 3%. The total administrative fine for a single act, whether it produces one or several infractions, cannot exceed ₱5 million. Administrative fines require notice and hearing.

Other laws may impose different or additional penalties. For example, the Anti-Wiretapping Law provides imprisonment of six months to six years, while the Anti-Photo and Video Voyeurism Act provides imprisonment of three to seven years, a ₱100,000 to ₱500,000 fine, or both.

Frequently asked questions

Can a store record me without asking permission?

Yes, if it has a valid lawful basis and follows the requirements on notice, purpose, proportionality, placement, security, retention, and access. The store cannot use the recording for unrelated purposes merely because a sign was displayed.

Can my neighbor point a CCTV camera toward my house?

A camera may protect the neighbor’s own property, but it should not unnecessarily monitor your windows, private yard, or activities. Surveillance extending beyond the operator’s boundary may also remove the household exception. The camera angle, coverage, purpose, and your reasonable expectation of privacy are important.

Can I demand footage of an accident or theft?

You may request reasonable access if you appear in it. If you do not appear, you may make a third-party request based on a lawful interest, but disclosure is not automatic. Send an immediate written preservation request and consider asking the investigating police officer to request the footage officially.

Must an operator give me an unblurred copy?

Not necessarily. Access must be balanced against other people’s rights and the stated purpose. Viewing, masking, extracts, still images, or other safeguards may be appropriate. The presence of other people, however, is not by itself a valid reason to reject every request.

Is there a mandatory 30-day retention period?

No. NPC Circular No. 2024-02 sets no universal number of days. Each operator must adopt a justified, documented period and comply with any special law or valid sectoral or local requirement.

Can an employer secretly monitor employees?

Covert workplace monitoring is legally risky. Employers generally must provide appropriate CCTV notice and must demonstrate a legitimate, necessary, and proportionate purpose. Monitoring private areas is prohibited or may violate a strong expectation of privacy.

Can CCTV footage be used in court?

It can be, if relevant, legally admissible, properly authenticated, and shown to be reliable. Preserve the original file, metadata, system information, and evidence of how the footage was extracted and handled.

Can I post a CCTV clip to identify a suspected thief?

Not automatically. Public posting may expose an innocent person, bystanders, minors, or victims and may constitute unauthorized processing or disclosure. Give the footage to investigators or seek legal advice before publishing identifiable images.

Official sources

This article provides general legal information, not advice for a particular dispute. Camera placement, lawful basis, access rights, and liability depend on the actual footage, notices, policies, purpose, location, and surrounding circumstances. Official sources and procedures were checked as of August 7, 2026.