DPDP Insights › Questions › What about CCTV, visitor registers and biometric attendance?

Question

What about CCTV, visitor registers and biometric attendance?

Short answer: Yes, with notice, limits and a deletion period

All three are personal data. Put a clear notice where people are recorded, collect only what you need at reception, keep footage and registers for a set period, and protect biometric templates carefully. Do not keep copies of ID documents unless you must.

What the law says

Section 5 needs notice. Section 8(5) needs safeguards. Section 8(7) needs erasure after the purpose. For staff, Section 7(i) can cover security and attendance.

Section 5 · Rule 3: When you ask for consent, give a clear notice that stands on its own: what data, for what purpose, how to withdraw consent, how to use the rights and how to complain to the Data Protection Board. For data collected before the Act, a notice is due as soon as reasonably practicable.
Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.
Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.
Section 7: Some uses need no consent: data a person gave voluntarily for a specified purpose, duties under law, medical emergencies involving a threat to life, health services during an epidemic, safety during a disaster, and purposes of employment.

Steps

Put notices at CCTV points and reception, in the local language.
Ask visitors only for name, phone and whom they are meeting, unless security needs more.
Set a period for footage and registers, then delete.
Restrict who can view footage, and log viewing.
Check the vendor contracts for CCTV, guards and attendance systems.

Evidence to keep

Notices in place
Retention settings on the recorder
Viewing log

Common mistakes

Photocopying visitor IDs as routine
Footage kept until the disk fills
Biometric systems with vendor default passwords

How it plays out by sector

Banking, financial services and insurance: Branch and ATM CCTV needs notices and limited retention.
IT, ITeS, BPO and GCC: Offices, cafeterias and cab pick-up points.
Central government: ministries and departments: Office CCTV and visitor passes need notices and limits.
Public sector undertakings and utilities: Stations, plants, townships and offices.
Healthcare and hospitals: CCTV must not cover examination or changing areas; put notices at entrances.
Manufacturing: Plant gates, canteens and hostels have CCTV and biometrics.

From each seat

HR head: Biometric attendance is the item to watch: who can see templates, how long they are kept, and what happens when someone leaves.
Operations head: Check notices at entrances and recording areas, and who on site can view footage.
Branch / business head: Recording on your floor needs notices and limited viewing.
Administration department: Admin runs the cameras and the reception desk. Notices, retention and viewing rights are yours to fix.
HR department: Biometric attendance data needs limited access and a deletion date after exit.

What a good answer from management sounds like

“Notices are up, footage is kept for a fixed period, and only security can view it, with a log.” Effort and time: Light · 2 to 4 weeks.