Office CCTV in Singapore protects you when it has a clear purpose, people are told about it, footage is kept only as long as needed and the recorder is locked down. It starts to look like spying when cameras watch staff without telling them why, footage sits forever on a recorder with a factory password, or anyone in the office can scroll through it. The Personal Data Protection Act (PDPA) treats CCTV footage of identifiable people as personal data, and the PDPC's advisory guidelines spell out what that means for notices, access requests and retention.
Below: both sides, what the PDPC says, and hardware that makes a privacy-respecting system easier to run, such as the TP-Link VIGI NVR2016H-16MP, VIGI C440, VIGI C540 and Tapo C520WS.
Office CCTV and the PDPA at a glance
| Question | What the PDPC guidelines say | Practical step |
|---|---|---|
| Do employees need to be told? | The employment exception can cover workplace CCTV, but staff must be informed of the purpose (4.39) | State the purpose in the employee handbook or IT policy |
| Do we need CCTV signs? | Notices are generally good practice; they need not reveal exact camera locations (4.34, 4.41) | Place notices at entrances and in covered areas |
| Can someone ask for their footage? | Individuals generally have a right of access; you may ask for date, time and purpose and charge a reasonable fee (4.43 to 4.45) | Write a short access-request procedure |
| Must other people be hidden? | Other individuals must be masked unless an exception applies or they consent (4.48) | Check your NVR or software can export and mask clips |
| How long can we keep it? | Stop retaining it once the purpose is served and there is no legal or business need (4.55); no fixed period is set | Set an overwrite period on the recorder and document why |
| Who protects the recorder? | Organisations must make reasonable security arrangements for personal data they hold | Unique passwords, firmware updates, limited admin accounts |
The case for office CCTV
Cameras deter theft at reception and in stores, give you evidence after an incident, show who entered a server room and let a manager check a site after hours. The PDPC itself recognises that workplace CCTV can be used for managing the employment relationship, which its guidelines describe as including safety and security.
The case against: when cameras feel like surveillance
The same camera can damage trust. A lens pointed at desks or screens, with no explanation, tells staff they are suspects. Footage collected for theft and then used for timekeeping feels like a bait and switch, and cameras that also record audio go further than many people expect. In our view, the "spying" problem comes from these choices, not from having cameras at all. Meeting-room cameras raise similar questions: Are Smart Meeting Room Cameras a Privacy Nightmare?
Do you need to tell employees about office CCTV?
Yes. The PDPC's Advisory Guidelines on the PDPA for Selected Topics say organisations may rely on the employment exception for workplace CCTV "provided it is for the purpose of managing the employment relationship", and that "the organisation must inform the individual of the purpose of the CCTV". The guidelines give the employee handbook as one way to do it. For visitors in restricted areas, the guidelines note that the publicly available data exception "will not apply to restricted areas" such as private offices, and that an organisation relying on the legitimate interests exception "must conduct a risk assessment". If no exception applies, the guidelines say organisations should seek consent and inform individuals.
The PDPC says it is "good practice for organisations to inform individuals that the area is under CCTV surveillance", that notices should be placed so people have sufficient awareness, and that it "does not require the placement or content of notifications to reveal the exact location of the CCTVs". Coverage beyond your premises should be reasonable for the purpose: point the camera at your door, not the neighbour's.
What happens when someone asks for their footage?
Under the PDPC guidelines, organisations are generally required to give individuals access to their personal data in CCTV footage, subject to the PDPA's exceptions. You can ask the requester for the purpose and for details such as date and time, provide a printout, an extract or an in-person viewing, and charge a reasonable fee for a copy. Other people in the frame must be masked unless an exception applies, another law permits it or they consent. The PDPC also notes that blurred and pixelated masking may still leave people identifiable, so check the result before you hand it over.
How long should office CCTV footage be kept?
The PDPA does not set a fixed number of days for CCTV. The PDPC guidelines point to the Retention Limitation Obligation: an organisation must cease to retain personal data once the purpose for collecting it is no longer served and retention is no longer necessary for legal or business purposes. The guidelines also state that "the PDPA does not require an organisation to delete personal data upon request from an individual". Pick a retention period that matches your purpose, set the recorder to overwrite after it, and write the reason down.
Cameras are not the privacy problem. Unexplained cameras, endless retention and a recorder with a factory password are.
NVR security: default passwords and firmware
The PDPA's protection obligation applies to footage like any other personal data; Singapore's Ministry of Digital Development and Information has noted that organisations must make reasonable security arrangements and that the PDPC can issue directions and financial penalties for breaches. For cameras and recorders, the basics are well known. The Cyber Security Agency of Singapore's Cybersecurity Labelling Scheme for IoT has four levels, and Level 1 covers "basic security requirements such as ensuring unique default passwords and providing software updates". In a January 2026 parliamentary reply, the ministry said the scheme is voluntary except for routers, that IP cameras are under review, and advised updating software promptly and not using universal default passwords.
Our checklist: unique admin password at install, one account per viewer, current firmware, a separate network segment and no direct internet exposure. See firewall fit for small businesses and preventing ransomware in Singapore. Recorders are one of the forgotten boxes we describe in The Most Dangerous Device in Your Office Might Be the One Nobody Manages, alongside office printers and meeting-room smart TVs. When staff leave, remove their CCTV app access too, as part of the checklist in Your Ex-Employee Might Still Have Access to Company Data.
Cloud or local recording: which is better for privacy?
Local recording keeps footage on hardware you control, which makes retention and access easier to manage. The TP-Link VIGI NVR2016H-16MP records up to 16 cameras to two internal drive bays, supports HTTPS and SSL/TLS, raises login-exception and disk-exception alarms, and offers event playback and video clip backup. Its listing states a 5-year local warranty. Cameras such as the VIGI C440 4MP turret (4mm) add password protection, HTTPS, IP address filtering and up to four privacy masks, so you can black out a desk, a window or a neighbouring doorway at the camera; its listing states a 3-year local warranty. For outdoor coverage, the VIGI C540 4MP pan-tilt camera fits the same system. All three are price on request; send your camera count and we will quote the set.
Cloud recording suits small sites, but check where footage is stored and who can reach it. For a single entrance or shop front, the Tapo C520WS outdoor pan/tilt camera (S$72.90, in stock) records to a microSD card of up to 512 GB with no compulsory cloud plan, lists 128-bit AES encryption with SSL/TLS, and offers optional Tapo Care cloud storage. Tapo is a consumer range, not managed by VIGI recorders.
SourceIT's verdict
Install CCTV for a stated reason, tell people, keep footage only as long as that reason needs, and treat the recorder as a server. Done that way, cameras protect the business and its staff. Browse the VIGI security cameras and NVRs or the Tapo cameras. SourceIT supplies TP-Link with local warranty and a GST invoice. Prices and stock are as listed on 23 Oct 2026. Use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
Is CCTV footage personal data under the PDPA? Footage of identifiable people is personal data; the PDPC's guidelines have a dedicated CCTV section.
Do I need consent from employees for office CCTV? The PDPC says the employment exception can cover workplace CCTV used to manage the employment relationship, but employees must still be told the purpose, for example in the employee handbook.
Do CCTV signs have to show where each camera is? No. The PDPC does not require notices to reveal exact camera locations; a notice for the general area is acceptable if people have sufficient awareness.
How long can a company keep CCTV footage in Singapore? The PDPA sets no fixed period. Keep it only while the purpose is served and there is a legal or business need, then let the recorder overwrite it.
Can an employee ask for a copy of CCTV footage? Generally yes. You may ask for the date, time and purpose, charge a reasonable fee for a copy, and must mask other people unless an exception applies or they consent.
What is the first security step for a new CCTV recorder? Replace any default password with a unique one, create separate user accounts, update the firmware and keep the recorder off the open internet.
