Quick answer
In the Philippines, a business, employer, condominium, or other organization may use CCTV for a lawful and clearly stated purpose, such as protecting people or property. Individual consent is not always required. The organization must identify an appropriate legal basis under the Data Privacy Act, give a clear and visible CCTV notice, limit surveillance to what is necessary, secure the footage, and respect people’s rights to request access. Putting up a sign does not, by itself, make every camera placement or use lawful. :chatgpt-content-reference{index="0"}
The main CCTV-specific rule is National Privacy Commission (NPC) Circular No. 2024-02, effective 27 August 2024. It replaced the NPC’s 2020 CCTV advisory. :chatgpt-content-reference{index="1"}
Does a CCTV operator need your consent?
Usually, the operator should first determine whether a legal basis other than consent fits the particular use of CCTV. Consent can be unsuitable for open surveillance in places people enter or pass through. Depending on the facts, a lawful basis under Section 12 of the Data Privacy Act of 2012 may include a legal obligation, a public authority’s necessary function, or a legitimate interest that is not overridden by the individual’s fundamental rights and freedoms. If the footage processes sensitive personal information, the operator must identify an applicable basis under the Act’s stricter Section 13. No single basis automatically covers every camera or later use of its recordings. :chatgpt-content-reference{index="2"}
A CCTV notice is therefore information, not a substitute for consent where consent is legally required. It should be prominently displayed, such as at an entrance, and explain the surveillance in clear language, including its purpose, nature, scope, extent, and capabilities. The operator must also apply transparency, legitimate purpose, proportionality, fairness, and accountability throughout the footage’s use. :chatgpt-content-reference{index="3"}
Where may cameras be placed?
Camera angles should cover only the spaces needed for the stated purpose. Zoom or rotating cameras must not be used to look into private spaces, such as through a home’s windows or into a private backyard. Under the NPC circular, CCTV use in places where people have a heightened expectation of privacy—including fitting rooms, rest rooms, toilets, and lactation or breastfeeding rooms—is strictly prohibited. An employer or property owner cannot cure an intrusive placement merely by posting a notice. :chatgpt-content-reference{index="4"}
The circular generally applies to organizations processing personal data through fixed CCTV systems. It excludes CCTV used purely for personal, family, or household affairs. That exception can cease to apply when a home camera captures people beyond the boundaries of the private residence, particularly by monitoring a public space. The circular also excludes government agencies conducting lawful surveillance under their mandates; those activities remain subject to applicable constitutional and other legal requirements. :chatgpt-content-reference{index="5"}
Who may watch, keep, or share footage?
Only authorized personnel should monitor live feeds or access stored recordings. Operators need a CCTV policy covering access requests, security, retention, disposal, and incident handling. Recorded footage must be stored securely, with access and transfers logged; the circular also requires encryption in accordance with applicable NPC issuances. These duties matter when a security guard, manager, vendor, or employee handles the system on the operator’s behalf. :chatgpt-content-reference{index="6"}
There is no universal number of days for keeping CCTV footage. The operator must document a retention period tied to its stated purpose, keep footage only as long as necessary, and destroy it when it is no longer needed. Storage capacity alone is not a lawful reason to set the period. If an incident may be relevant to a complaint or case, ask for preservation promptly, before routine deletion occurs. :chatgpt-content-reference{index="7"}
Footage is not automatically public simply because an incident occurred. An operator must assess a request to disclose it under the Data Privacy Act and the NPC circular. Appropriate disclosure may be made for a lawful police investigation, a court order, or a supported administrative investigation, subject to the applicable requirements. A law enforcement officer requesting footage for an investigation must provide a written statement, affirmative declaration, or equivalent establishing the lawfulness of the request. Other third-party requests require case-specific scrutiny. The operator is not obliged to give footage to the media merely because it is newsworthy. :chatgpt-content-reference{index="8"}
How to request footage of yourself
If your personal data appears in a recording, you have a right to reasonable access, which can include viewing the footage or obtaining a copy. The presence of other people in the same clip does not automatically turn your request into a third-party request. The operator may verify your identity and, if someone acts for you, ask for proof of authorization. It may also consider the rights of others shown in the recording and the purpose of the request. :chatgpt-content-reference{index="9"}
Send the operator or its data protection officer a written request as soon as possible. Include:
- The specific date, approximate time, location, and camera area, if known.
- Whether you want to view the footage or obtain a copy, and why.
- Enough information to identify yourself in the footage, with only the identity documents reasonably needed for verification.
- An express request to preserve the relevant footage while your access request is assessed.
Keep a copy of the request and proof that it was received. Once you inform the operator in writing that you intend to view or obtain a particular recording, the circular requires it to preserve the pertinent footage outside its usual retention cycle while the request is pending, subject to the circular’s conditions. If you do not complete the request requirements within 30 days of that initial notice, it may be treated as abandoned. :chatgpt-content-reference{index="10"}
After you fulfill the request requirements, the operator must act without undue delay: within five working days for viewing or 15 working days for a copy. A complex request or one involving numerous recordings may be extended by up to 15 additional working days, with written notice explaining the reason and intended compliance date. A reasonable administrative fee may be charged for providing a copy; it must not be excessive. :chatgpt-content-reference{index="11"}
Access may be denied on grounds specified in the circular, including a request that remains insufficiently detailed after an opportunity to amend it, a disproportionate demand for a copy, or footage already deleted under a documented retention policy before the request was received. A denial must be assessed on its facts. The operator must provide its reason within five working days of receiving the completed request; a denial does not prevent a properly detailed later request. :chatgpt-content-reference{index="12"}
If CCTV use appears improper
First, record the camera’s location and angle, photograph the notice or its absence where lawful, and keep relevant messages, requests, replies, and screenshots of any disclosed footage. Note dates and times. Avoid reposting a clip containing other identifiable people while you seek help.
Raise the concern with the organization or its data protection officer in writing. Ask about the camera’s purpose, coverage, access controls, retention period, or the basis for a particular disclosure. If your access request is denied or the issue remains unresolved, you may bring the matter to the National Privacy Commission under its applicable complaint rules. Seek prompt legal or law enforcement help if surveillance intrudes into a private area, footage is being used to threaten or harass someone, or an incident needs urgent investigation. The appropriate remedy depends on the camera setup, the recording, and what happened to the footage. :chatgpt-content-reference{index="13"}
Common mistakes include assuming that every CCTV system needs signed consent, treating a warning sign as permission to film anywhere, sharing an incident clip in a group chat or online without assessing others’ privacy, and waiting until footage has been overwritten before requesting preservation.
FAQ
Can my employer use CCTV at work?
Yes, if the use has an appropriate legal basis and meets the rules on notice, purpose, necessity, placement, security, and access. Workplace ownership does not permit cameras in the heightened-privacy areas prohibited by the NPC circular. :chatgpt-content-reference{index="14"}
Can I demand the entire recording after an accident or theft?
You may request footage containing your personal data and explain what segment you need. Access is reasonable rather than unlimited; a request for a copy may be denied if it is disproportionate to its stated purpose. Give a narrow date, time, and location, and request preservation immediately. :chatgpt-content-reference{index="15"}
Can a homeowner point a security camera at the street?
The purely household exception does not cover a camera that monitors a public space beyond the boundaries of the private home. Its owner may then have duties as a personal information controller under the Data Privacy Act and relevant NPC rules. The camera’s actual view and use matter. :chatgpt-content-reference{index="16"}
Is posting CCTV footage on social media allowed?
Do not assume that ownership of the camera gives you unrestricted permission to publish identifiable people’s images. Disclosure is another use of personal data and needs a lawful basis and a proportionate purpose; the circumstances, including whose images appear and why publication is proposed, matter. A safer immediate step after an incident is to preserve the original footage and approach the appropriate authorities or seek legal advice. :chatgpt-content-reference{index="17"}
Official sources: Data Privacy Act of 2012; NPC Circular No. 2024-02 on CCTV Systems; Data Privacy Act implementing rules; NPC contact information.
This is general Philippine legal information, not advice for a particular dispute. The applicable rights and duties depend on the footage, its purpose, the people involved, and relevant documents. Sources checked: 29 September 2026.