CCTV

Commercial CCTV Requirements in NZ: Compliance, Privacy & Best Practice

Clyde

February 25, 2026
3:40 pm
No Comments

Introduction

Installing CCTV in your Auckland business seems straightforward—put cameras everywhere, monitor everything, protect your assets. But New Zealand’s Privacy Act and employment law create real legal requirements that many business owners don’t fully understand.

Install CCTV without proper compliance, and you could face:

At Garrison Alarms, we’ve worked with hundreds of Auckland businesses to design compliant systems. In this guide, we’ll walk through exactly what NZ law requires, where cameras can legally go, and how to protect your business while respecting privacy.

The Legal Framework

Key NZ Legislation

1. Privacy Act 2020

The primary law governing CCTV in NZ:

Core principle: Personal information collection must be:

For CCTV: You can collect video footage IF:

You have a legitimate business reason (security, asset protection, safety)
You've informed employees and visitors that recording occurs
You store footage securely
You limit access to authorized personnel
You have documented retention schedules

What you can't do:

Record in bathrooms, changing rooms, or private areas
Record audio without explicit consent (extremely restricted)
Retain footage longer than necessary
Collect CCTV without informing stakeholders
Use CCTV for employee surveillance (very restricted)

2. Health and Safety at Work Act 2015

Requires employers to:

CCTV as safety tool: Legal if used appropriately CCTV as oppressive monitoring: Illegal and creates liability

3. Employment Relations Authority Act 2000

Governs employer-employee relationships:

4. Crimes Act 1961 (Audio Recording)

Recording audio in private conversations:

Practical implication: Most commercial CCTV systems disable audio recording or operate video-only to avoid legal issues.

Privacy Act Compliance: The Key Principles

Principle 1: Legitimate Purpose

You need a documented business reason for CCTV:

Legitimate purposes:

Security against theft/burglary
Asset protection (stock, equipment, vehicles)
Workplace safety monitoring (hazardous areas, emergency exits)
Reception area monitoring (track visitors, identify unauthorized entry)
Perimeter monitoring (deter criminal activity)

Questionable purposes:

Best practice: Document specific security risks CCTV addresses (e.g., "Retail theft $50,000 annually; office break-ins targeting equipment")

Principle 2: Transparency

Employees and visitors must know they're being recorded:

Required notification:

Visible signage: "CCTV in operation" or "24/7 monitoring"
Information provided to employees in writing
Employee handbook inclusion
Staff training on monitoring policies
Visitor signage at entry points

Best practice:

Principle 3: Proportionality

The surveillance level must match the actual risk:

Example 1: Retail shop

Example 2: Office building

Principle 4: Data Security

Footage must be protected as personal information:

Requirements:

Secure storage (not accessible to random staff)
Limited access (only authorized personnel)
Encryption (if cloud storage used)
Backup procedures (if data critical)
Secure deletion (when retention period expires)

Best practice:

Principle 5: Retention Limits

You can't keep footage indefinitely:

Typical retention periods:

General security: 30–90 days (enough for incident investigation)
Incident-specific: Keep only if incident documented
Regulatory requirements: Longer if legally mandated (e.g., retail/hospitality)
Maximum: Most legal advice suggests 12 months maximum

Never record "just in case"—retain only what's necessary.

Where You CAN Install Commercial CCTV

Entry Points: Always Appropriate

Examples:

Why: Protects against external criminal activity, not employee surveillance

Best practice: Angle cameras to capture people approaching, not interior hallways immediately inside

Perimeter Areas: Generally Appropriate

Examples:

Why: Protects assets and deters criminal approach; not employee surveillance

Compliance note: Ensure perimeter cameras don't inadvertently capture neighboring properties or public areas unnecessarily

Common Work Areas: Carefully Regulated

Examples:

Can install: Yes, if:

Cannot install: Video that:

High-Risk Areas: Generally Appropriate

Examples:

Why: Legitimate safety and security purpose

Compliance: Still requires notification and appropriate access controls

Where You CANNOT Install Commercial CCTV

Private Areas: Absolutely Prohibited

Examples:

Bathrooms and toilets
Changing/locker rooms
Shower facilities
Private offices (with expectation of privacy)
Medical/first aid rooms
Staff break rooms (generally—some exceptions for security-critical break rooms)

Legal consequence: Criminal and civil liability; significant penalties

Audio Recording: Extremely Restricted

General rule: Audio recording without all parties' consent is illegal

Exceptions:

Practical application: Commercial CCTV should disable audio or use video-only to avoid legal issues

Employee Monitoring: Special Considerations

Legal Limits on Employee CCTV

Employment law restricts using CCTV to monitor employee performance:

Prohibited uses:

"Making sure employees are working" (oppressive surveillance)
Tracking bathroom/break room visits
Monitoring productivity (time-based surveillance)
Recording private conversations
Creating intimidating workplace through constant monitoring

Legal uses:

The "Reasonable Expectation of Privacy" Test

NZ law recognizes employees have reasonable expectation of privacy even at work:

Employees CAN expect privacy:

Employees CANNOT expect privacy:

Best Practice: Employee Engagement

Rather than covert monitoring:

Discuss plans with employees before installation
Explain security purpose (“Protect company assets, not monitor work pace”)
Include in employment contracts (“CCTV operates in common areas for security”)
Get consent where possible
Review policies with employees regularly

Advantage: Transparency reduces legal risk and builds employee trust

Retail-Specific CCTV Compliance

Retail Is Different

Retail businesses have specific compliance considerations:

Customers present: Can’t be monitored with same restrictions as employees Stock theft: Legitimate CCTV purpose Financial transactions: May need higher-quality cameras for evidence

Retail CCTV Best Practices

Entry/exit: Clear signage required Sales floor: Monitor stock areas; minimize employee-specific monitoring Change rooms/fitting areas: Prohibited—only entrance/exit monitoring Checkout: Can monitor transactions; inform customers Staff areas: Restricted; only for security purposes, not productivity Audio: Disable; video-only recommended

Retention for Retail

Retail often needs longer retention:

Hospitality & Venue-Specific CCTV Compliance

Bars, Restaurants, Hotels

Higher CCTV justification:

Appropriate monitoring:

Prohibited areas:

Venue-Specific Compliance

Document Your CCTV Compliance

Maintain a CCTV policy document including:

1. Purpose statement

2. Scope

3. Notification plan

4. Access controls

5. Retention schedule

6. Data security

7. Incident procedures

Template Availability

Privacy Commission provides guidance; Garrison Alarms can help develop compliant policies

CCTV and Police/Legal Proceedings

Evidence Admissibility

CCTV footage is admissible as evidence IF:

Implication: Maintain detailed records of CCTV system operation, not just the footage itself

Police Requests

NZ Police can request footage:

Best practice:

FAQ: Commercial CCTV Compliance

Can I record audio in my retail store to catch shoplifters?

Not legally. Audio recording in areas where customers expect privacy is problematic. Video-only is fully acceptable for theft prevention.

Do I need Privacy Commission approval for my CCTV system?

No. But the Privacy Commission expects businesses to self-regulate. If complaint filed, Commission can investigate. Compliance reduces investigation risk.

What if an employee doesn't like the monitoring?

Provided monitoring is transparent, proportionate, and disclosed in employment contract, it’s generally legal. If employee claims oppressive monitoring, they may file personal grievance claim. Documentation of legitimate business purpose is your defense.

Can I use CCTV to monitor suspected employee theft?

Yes, IF you:

Have reasonable suspicion
Document the suspicion
Conduct monitoring transparently
Limit monitoring to relevant areas
Don’t conduct covert monitoring Better approach: Direct investigation through HR/management rather than secret surveillance.

How long must I keep footage if there's a criminal complaint?

Once criminal complaint filed, retain footage indefinitely until case resolved (could be 1–3 years). Communicate with police about their retention requirements.

Can CCTV be networked to my phone for remote access?

Yes, technically. But ensure:

What if someone complains to the Privacy Commission?

Commission investigates. If they find non-compliance, they may:

Do I need to inform customers that footage is cloud-backed up?

Yes. Any footage storage method must be disclosed. If using cloud, state “CCTV footage stored in cloud” on signage or privacy notice.

Can I share CCTV footage with my insurance company?

Yes, if necessary for claim. Inform employees/customers: “Footage may be shared with insurers and police for security purposes.”

Garrison Alarms' Commercial Compliance Approach

When installing commercial CCTV, we help you:

Assess compliance requirements specific to your business type
Design system that meets security needs AND legal requirements
Create documentation (policy, signage, employee notifications)
Install professionally with proper security and access controls
Provide staff training on CCTV policies and procedures
Support incident response with proper chain of custody

Our approach: Security AND compliance—not one or the other.

Internal Linking Notes

Link to these related Garrison Alarms resources:

"CCTV Installation Cost Auckland: Complete 2026 Pricing Guide" (system costs)
"How Many CCTV Cameras Do I Need?" (system design)
"Best CCTV Cameras for Homes in New Zealand 2026" (camera selection)
"Home Security Checklist NZ" (residential version for comparison)
"Access Control Systems Auckland: A Complete Guide for Homes & Businesses" (integrated security)

Summary

Commercial CCTV in New Zealand must comply with Privacy Act 2020, employment law, and health and safety regulations. Key requirements:

Legitimate purpose—document why CCTV is necessary
Transparency—employees and customers must be informed
Proportionality—monitoring level matches actual risk
Data security—footage protected as personal information
Retention limits—keep only as long as necessary

You CAN monitor entry points, perimeter areas, and common work areas. You CANNOT monitor bathrooms, private areas, or record audio without consent.

Proper documentation protects your business legally while ensuring legitimate security needs are met.

For compliant commercial CCTV systems, contact Garrison Alarms—0800-427747.

About Garrison Alarms

Since 1989, Garrison Alarms has installed compliant commercial CCTV and security systems for Auckland businesses. We specialize in systems that meet both security needs and legal requirements. Our COC-certified installers help design systems with proper documentation, signage, and employee procedures. We represent Hikvision, Bosch, DSC, Paradox, Micron, Risco, and Panasonic.

Last updated: February 2026