CCTV footage retention in Kenya is becoming an important consideration for businesses, landlords, schools, warehouses, factories and institutions using modern video surveillance systems.
Many CCTV users begin with a simple technical question:
How many days can my DVR or NVR store?
But that is not really the best question.
A better question is:
How long does your organisation genuinely need CCTV footage, and can your surveillance system reliably provide that retention period?
Modern CCTV systems can retain weeks or even months of recordings. Larger hard drives, H.265 video compression, event-based recording and network video recorders have made longer retention much easier.
However, storing footage simply because hard-drive space is available is not necessarily good CCTV management.
Effective CCTV footage retention in Kenya should balance:
- security requirements;
- investigation needs;
- storage capacity;
- privacy;
- data-protection obligations.
Below are seven essential rules that can help organisations plan CCTV retention, storage and access more effectively.
Why CCTV Footage Retention in Kenya Matters
Installing cameras is only one part of an effective CCTV system.
Imagine that stock disappears from a warehouse.
Management discovers the shortage three weeks later.
The CCTV cameras were working correctly, but the NVR had been configured to retain only seven days of recordings.
By the time the loss is discovered, the relevant footage has already been overwritten.
Now consider the opposite problem.
A business keeps every ordinary CCTV recording for twelve months even though most incidents are identified within a few days and there is no documented reason for storing routine footage for an entire year.
Both examples reveal the same weakness:
The CCTV retention period was never properly planned.
A properly designed surveillance system should therefore answer three questions:
- How far back might we reasonably need to investigate?
- How much CCTV storage is required to cover that period?
- When should routine recordings be automatically deleted or overwritten?
Rule 1: Treat CCTV Footage as Potential Personal Data
CCTV footage is not simply a collection of video files.
Where people can be identified, CCTV recordings can constitute personal data.
Kenya’s Office of the Data Protection Commissioner, or ODPC, has found in a CCTV-related determination that collecting, transmitting and retaining identifiable CCTV images can amount to the processing of personal data.
This means CCTV management is not only a physical-security issue.
It can also become a data-protection and privacy issue.
Section 25 of Kenya’s Data Protection Act, 2019 requires personal data to be kept in a form that identifies data subjects for no longer than is necessary for the purpose for which it was collected.
For organisations considering CCTV footage retention in Kenya, the practical lesson is important:
Do not select a retention period merely because your hard drive can accommodate it.
Select it because there is a legitimate and documented operational reason for retaining the recordings for that period.
Recommended authoritative external source
Link the phrase Data Protection Act, 2019 above to the official Kenya Law version of the Act.
Rule 2: Do Not Assume Every Business Must Keep CCTV for 30 Days
One of the most important questions about CCTV footage retention in Kenya is whether there is a compulsory 30-day rule.
There is no single universal CCTV retention period that should automatically be applied to every CCTV installation.
The ODPC’s 2026 Guidance Note for the Transport Sector provides an example in which CCTV footage is retained for 30 days and then automatically overwritten.
That makes 30 days a useful benchmark for consideration.
However, it should not be interpreted as meaning that every:
- shop;
- office;
- school;
- apartment;
- warehouse;
- factory;
- institution
must always retain exactly 30 days of CCTV recordings.
The appropriate period depends on:
- why the cameras were installed;
- the security risks involved;
- how quickly incidents are usually detected;
- whether investigations are likely to start later;
- relevant legal or regulatory requirements.
A better principle is:
Keep CCTV footage for the shortest period that still allows the organisation to achieve its legitimate security and investigation requirements.
Recommended authoritative external source
Link the phrase ODPC Guidance Note for the Transport Sector to the official ODPC guidance document.
Rule 3: Match CCTV Retention to How Quickly Incidents Are Discovered
For many ordinary commercial installations, 14 to 30 days may be a useful starting point for assessment.
It should not, however, simply become an automatic setting.
Good CCTV footage retention in Kenya should consider an organisation’s actual incident-discovery cycle.
Retail shops
Cash discrepancies, customer complaints, shoplifting and security incidents may normally be identified quickly.
A comparatively short retention period may therefore be adequate.
Apartment buildings
A landlord or property manager may discover:
- vehicle damage;
- unauthorised access;
- theft;
- gate incidents;
- common-area disputes
several days after they occur.
The CCTV retention requirement may therefore need to be longer.
Warehouses
Warehouse losses may only become visible during weekly or monthly stock reconciliation.
If stock is reconciled every month, keeping only seven days of footage could leave the business without evidence when a discrepancy is finally discovered.
Factories
Factories may use CCTV to monitor:
- loading and offloading;
- stores;
- production areas;
- gate movements;
- dispatch operations;
- vehicles entering and leaving;
- restricted areas.
Where incidents only become apparent through operational reports or periodic reconciliation, a longer retention period may be justified.
Schools and colleges
Educational institutions must balance security requirements with privacy, particularly where students or children may be recorded.
The ODPC’s guidance on recorded media gives an example involving CCTV recordings used during university examinations.
The guidance recommends establishing a clear retention period based on the time needed for matters such as:
- examination marking;
- appeals;
- investigations;
- relevant regulatory requirements.
The important question should therefore not be:
“What retention period does everyone else use?”
Instead ask:
“How long could reasonably pass before we discover an incident that requires investigation?”
Rule 4: Design the Retention Period Before Buying CCTV Storage
A practical CCTV footage retention in Kenya policy can follow five steps.
1. Define the purpose of every camera
Each CCTV camera should serve a clear operational purpose.
Examples include:
- monitoring entrances and exits;
- protecting stock;
- monitoring loading and dispatch;
- monitoring parking areas;
- controlling access to restricted locations;
- investigating security incidents;
- protecting staff and visitors.
Understanding the purpose helps determine how long the footage remains useful.
2. Determine the incident-discovery period
Ask:
How long after an incident could we realistically discover it?
If stock reconciliation is performed every 30 days, seven days of recordings may be insufficient.
If security incidents are normally reported on the same day, retaining many months of routine footage may be unnecessary.
3. Add a reasonable investigation margin
Do not size CCTV storage to end exactly at the average discovery period.
Allow some margin for:
- weekends;
- public holidays;
- staff leave;
- delayed reporting;
- management review;
- internal investigations.
4. Document the retention period
The organisation should record why its chosen retention period is appropriate.
ODPC guidance recommends clear retention policies, regular review of recorded information and deletion or anonymisation when personal data is no longer required.
5. Configure automatic overwrite
Most modern DVRs and NVRs can automatically overwrite the oldest recordings.
Automatic overwrite can help ensure routine footage does not remain stored indefinitely.
Rule 5: Calculate the NVR Storage Required
CCTV retention and storage capacity are directly connected.
A simplified calculation is:
Storage = Number of cameras × Average bitrate × Recording duration
Consider a business with:
- 8 IP cameras;
- average bitrate of 4 Mbps per camera;
- continuous 24-hour recording;
- 30-day retention.
The approximate raw storage requirement is:
8 cameras × 4 Mbps × 30 days ≈ 10.4 TB
This is before making allowances for:
- recorder overhead;
- reserved disk capacity;
- RAID configuration;
- backup requirements;
- bitrate variation.
If those same eight cameras average 2 Mbps, the approximate storage requirement falls to around:
5.2 TB for 30 days.
For sixteen cameras averaging 4 Mbps continuously, 30-day retention may require approximately:
20.7 TB.
This is why CCTV storage should be calculated rather than guessed.
What affects CCTV storage consumption?
Several factors determine how quickly an NVR or DVR fills up.
Camera resolution
Higher-resolution cameras normally generate more video data.
A 4K camera will generally require more storage than a lower-resolution camera when other settings are similar.
Frame rate
Recording at 25 or 30 frames per second normally creates more data than recording at a lower frame rate.
Video compression
Modern compression technologies such as H.265 can reduce storage and bandwidth requirements.
Actual savings vary depending on:
- camera model;
- scene activity;
- resolution;
- recording configuration.
Continuous versus event recording
Continuous recording captures video throughout the day.
Event-based recording stores footage when configured events occur, such as motion detection.
Event recording can significantly reduce storage requirements, but poorly configured motion detection could also cause important events to be missed.
Scene activity
A camera watching a busy gate or road will normally process far more changing image information than a camera watching a largely static corridor.
That can influence bitrate and storage consumption.
Audio recording
Where audio is enabled, additional data is created.
Audio recording can also raise additional privacy considerations and should therefore serve a clear purpose.
Do Not Let Hard-Drive Size Decide Your CCTV Policy
One of the easiest CCTV design mistakes is allowing the installed hard drive to determine the retention period.
Suppose your NVR happens to retain 97 days of footage before overwriting old recordings.
That does not automatically mean your organisation should adopt a 97-day retention policy.
For effective CCTV footage retention in Kenya, the design sequence should be:
Purpose → Risk → Required retention → Camera settings → Storage calculation
Not:
Hard-drive size → Whatever retention happens to result
The storage-limitation principle under Kenya’s Data Protection Act supports this approach because identifiable personal data should not be retained longer than necessary for its purpose.
Rule 6: Preserve Incident Footage Separately
Automatic overwrite is appropriate for routine recordings.
Footage connected to a known incident should be handled differently.
Examples include:
- theft;
- stock loss;
- property damage;
- workplace investigations;
- police inquiries;
- insurance claims;
- accidents;
- access-control incidents;
- formal complaints.
Relevant footage should be exported before the normal recording cycle overwrites it.
A good footage-export process should document:
- who exported the recording;
- date and time;
- reason for export;
- cameras involved;
- recording period;
- where the copy is stored;
- who is authorised to access it.
This creates a useful audit trail.
Keep retained evidence separate from routine footage
Suppose a company’s normal retention period is 30 days.
If footage from Day 20 becomes evidence in a theft investigation, that particular recording may need to be preserved separately even after the ordinary 30-day cycle expires.
The preservation should have a documented reason.
This distinction enables an organisation to maintain a reasonable routine retention policy while still preserving evidence needed for legitimate investigations.
Rule 7: Secure CCTV Recordings and Control Access
Good CCTV footage retention in Kenya involves more than deciding how many days of video should be available.
The footage itself must also be protected.
Access should normally be granted according to responsibility.
For example:
Security guard:
Live viewing of authorised cameras.
Supervisor:
Live viewing and authorised playback.
Manager or investigator:
Retrieval and review of relevant recordings.
System administrator:
Camera, network and recorder configuration.
Not every person who can view a CCTV monitor should automatically be authorised to:
- export recordings;
- delete footage;
- create users;
- change camera configurations;
- alter retention periods.
ODPC guidance stresses the importance of technical and organisational safeguards to protect CCTV footage from unauthorised access.
Should CCTV Footage Be Encrypted?
Where the CCTV platform supports encryption, it can provide another important layer of protection.
Encryption becomes especially valuable where:
- CCTV is stored on network servers;
- video is transferred between branches;
- remote monitoring is enabled;
- footage is stored in the cloud;
- recordings are downloaded onto laptops or portable drives.
Good CCTV cybersecurity practices should also include:
- strong passwords;
- unique user accounts;
- restricted administrator privileges;
- secure remote access;
- protected NVR locations;
- firmware updates;
- separation of CCTV networks where appropriate.
CCTV today is increasingly part of an organisation’s wider IT infrastructure rather than simply a standalone physical-security installation.
What About Cloud CCTV Storage?
Cloud CCTV storage can provide advantages such as:
- off-site backup;
- multi-site monitoring;
- centralised access;
- protection if the local recorder is stolen;
- easier remote management.
However, businesses should ask important questions before adopting cloud CCTV.
Where is the footage stored?
The physical location of cloud infrastructure can matter where personal data is involved.
Who operates the cloud platform?
The organisation should understand which third party is processing or storing the recordings.
Who can access the recordings?
Administrator, installer and user privileges should be controlled.
Is the footage encrypted?
Consider encryption both when data is transferred and when it is stored.
How long is cloud footage retained?
Cloud storage should also operate according to the organisation’s documented retention policy.
Can deletion be automated?
Routine recordings should not remain indefinitely just because cloud storage is available.
What happens when the subscription ends?
Businesses should understand whether footage can be retrieved, transferred or securely deleted.
Is personal data being transferred outside Kenya?
Kenya’s Data Protection Act includes requirements relating to transfers of personal data outside Kenya.
Cloud CCTV should therefore be treated as a data-management decision, not merely as a convenient remote-viewing feature.
CCTV Footage Retention in Kenya: Business Checklist
Before approving a CCTV system, ask:
- What is the purpose of each camera?
- How quickly are incidents normally discovered?
- What retention period is genuinely required?
- Has the retention period been documented?
- Does the NVR have sufficient storage?
- Is automatic overwrite enabled?
- Can important incident footage be preserved?
- Who can view recordings?
- Who can export footage?
- Are user permissions restricted?
- Is the recorder physically secure?
- Are old recordings automatically deleted or overwritten?
- Is the retention policy periodically reviewed?
If these questions cannot be answered, the organisation may be recording video without properly managing the resulting information.
A Better Way to Request a CCTV Quotation
Many customers ask:
“How much is an eight-camera CCTV system?”
That does not provide enough information for good system design.
A better CCTV specification should include:
- number of cameras;
- areas to be monitored;
- required image resolution;
- night-vision requirements;
- required recording method;
- required retention period;
- remote viewing requirements;
- storage requirements;
- backup requirements;
- number of system users;
- required access levels.
The required retention period directly affects the hard-drive capacity and therefore the overall cost of the CCTV system.
Dotmobi CCTV Solutions in Kenya
Dotmobi provides CCTV solutions suitable for:
- homes;
- offices;
- shops;
- schools;
- apartments;
- warehouses;
- factories;
- institutions;
- commercial premises.
Our CCTV solutions can incorporate:
- high-definition surveillance;
- 4K camera options;
- night vision;
- motion detection;
- alerts;
- remote viewing;
- weather-resistant outdoor cameras;
- properly sized recording storage.
A well-designed CCTV installation should therefore consider much more than the number of cameras.
It should consider:
- camera positioning;
- required image quality;
- lighting conditions;
- CCTV storage capacity;
- recording retention;
- network security;
- remote monitoring;
- user privileges;
- reliable incident retrieval.
Learn more about Dotmobi CCTV:
https://dotmobi.co.ke/product/cctv/
Frequently Asked Questions About CCTV Footage Retention in Kenya
How long should CCTV footage be kept in Kenya?
There is no single universal period suitable for every CCTV installation.
The retention period should depend on why the footage is collected, how quickly incidents are normally discovered and whether there are legitimate operational or regulatory reasons for keeping the recordings.
Is 30 days the legal CCTV retention period in Kenya?
Not as a universal rule.
The ODPC’s 2026 transport-sector guidance gives an example where CCTV footage is retained for 30 days and then automatically overwritten.
That makes 30 days a useful benchmark for assessment but not an automatic legal requirement for every CCTV operator.
Is 30 days enough for a business CCTV system?
It may be sufficient for many businesses.
However, a warehouse that only discovers discrepancies during monthly stock reconciliation may have different operational needs from a shop where incidents are normally identified immediately.
How much storage do eight CCTV cameras need for 30 days?
Eight cameras averaging 4 Mbps and recording continuously require approximately 10.4 TB of raw storage for 30 days.
Actual storage requirements depend on:
- bitrate;
- resolution;
- compression;
- frame rate;
- scene activity;
- recording schedule.
Does CCTV automatically delete old footage?
Most modern DVRs and NVRs can be configured to automatically overwrite the oldest recordings when the allocated storage is full or the required retention period has elapsed.
Should CCTV footage be stored forever?
Routine recordings should generally not be stored indefinitely merely because storage space is available.
A clear retention policy should establish how long footage is required.
Recordings connected to a legitimate investigation can be preserved separately where necessary.
Is CCTV footage personal data?
Where individuals can be identified, CCTV footage can constitute personal data.
The ODPC has previously found that the collection, transmission and retention of identifiable CCTV images amounts to the processing of personal data.
Conclusion: Better CCTV Footage Retention in Kenya
CCTV footage retention in Kenya should be deliberately designed rather than left to chance.
The objective should not be to build the largest possible video archive.
A better objective is to:
- retain useful recordings for a justified period;
- provide sufficient NVR storage;
- protect CCTV footage from unauthorised access;
- preserve important incident evidence;
- control who can export or delete footage;
- automatically overwrite routine recordings when they are no longer required.
A strong CCTV planning formula is:
Purpose + Risk + Retention + Storage + Security + Privacy
When these elements are considered together, CCTV becomes more than a collection of cameras.
It becomes a properly managed security and evidence system.
For CCTV system design, installation, NVR storage sizing, remote monitoring and retention planning, contact Dotmobi LLP.
Learn more about Dotmobi CCTV:
https://dotmobi.co.ke/product/cctv/
