Viewing CCTV on your phone: fix factory passwords and P2P first

The installer finishes, scans a QR code and says, 'You can watch it on your phone now.' The owner is pleased, because there is no need to go in to see whether customers have arrived. But that one sentence hides several questions. How does the picture reach the phone? Who else can use the same route? And is the camera's password still the one it shipped with?

Thailand's National Cyber Security Agency (NCSA) issued a CCTV security guideline on 29 September 2026 and touches this topic in several places: factory passwords in item 3.1, network segmentation and P2P services in item 3.3.3, and apps and mobile devices in item 5.1.1.

This article pulls those items together to answer one question: if you want to watch cameras from outside the house or shop, what should you set up first, and which route should you choose? For the whole starter list see seven starter steps for cameras already installed. The PDPA side, such as signs and giving footage to police, is in CCTV and the PDPA.

Why is a camera exposed directly to the internet the riskiest?

Because anyone, from anywhere, can try its login page. All of the protection then rests on two things, the password and the software inside the camera, and cameras are often devices that nobody updates after installation.

The guideline lists the risk factors for CCTV in its preface and picks out three that chain together: default credentials, no software updates, and remote access without suitable measures. The Thai original is quoted below, with the meaning in the note.

Item 3.1 turns those three risks into starter measures. Step 1 says to deal with default credentials before use. Step 2 says not to expose cameras, recorders or management interfaces directly to the internet unless necessary, and to use approved channels. Step 3 says to use MFA for privileged accounts and remote access where the system supports it. These three are the core of this article.

Steps 1 and 2 are 'should do' from level B, the most basic level in the guideline. Step 3 is 'consider' at level B and 'should do' at levels E and H. Under item 1.5, 'should do' marks the main recommended measure; anyone choosing another way should be able to explain why.

How should factory passwords be handled, and what counts as a good enough password?

Change them before real use, on every device with a login, not just the cameras. Item 3.1 covers the defaults of cameras, recorders, management systems and apps, and item 3.4.4 gives a detailed set of measures.

As for what a good password looks like, the guideline answers without a number, because devices support different limits. Item 3.4.4 closes with a principle buyers should keep in mind. The Thai original is quoted.

On user accounts, item 3.4.3 asks you to separate viewer and administrator roles, use accounts that identify the person, avoid shared administrator accounts, close guest and unused accounts, and revoke access when duties end. All are 'should do' from level B. In a small business that means each person who watches the cameras has a view-only account, and the whole shop does not share one admin login.

If you want to watch cameras from outside, which route should you choose?

It depends on how often you need to watch, whether anyone looks after your network, and whether you accept footage passing through a manufacturer's servers. The guideline does not say one route is right. It sets a principle that every route must be governed like remote access, which item 5.1.1 applies to phones.

The table below arranges the options as a decision table. The author did the sequencing and wrote the 'author's note' column. The 'source in the guideline' column shows which item supports each row. The guideline does not name VPNs; it speaks of 'approved channels', and the author reads a VPN set up by an administrator as fitting that wording.

One caution about the table: no row works without changing the factory password, because every route ends at a login that needs a good password and ideally MFA. And do not pick row four or five just because an installer says it is quick to set up.

Is P2P safe, and what should you ask the vendor before turning it on?

Item 3.3.3.4 says you cannot tell from the name. The guideline accepts that P2P makes remote viewing convenient. In general such apps connect to the camera through a manufacturer's central server, with no port opened on your router. It warns that the service must be governed to the same standard as other remote channels.

The guideline lists eight points to settle before use. The table turns them into questions an owner can put to a seller or check personally, in the author's wording.

If the seller cannot answer more than half, the author's view is that this is a signal to use a route you control more directly, or to change models. If footage is kept on a cloud outside Thailand, a further PDPA layer on transfers abroad also arises; see our guide to cross-border transfers.

How should the phone and app used to watch cameras be set up?

Control them like any other remote channel, looking at the account, the app, the device and any footage left on the device. Item 5.1.1 sets out the points in a table, which the author turns into practical actions for an owner.

The 'saving footage to the device' row is the one most often overlooked. Footage showing customers and staff, once saved on a personal phone, sits outside the system the shop controls, including deletion at the end of the retention period and limits on who can view it. If clips must go to police or another party, export them from the camera system through an approved and logged process.

For higher-risk systems, item 5.1.1 says a mobile device management (MDM) system or an equivalent measure may be considered. Most small shops need not go that far, but should start with the easy items: a screen lock, and cancelling sessions when a phone is lost.

How should the network be split so a compromised camera does not spread?

Keep cameras apart from the computers and phones used for everyday work. Item 3.3.3 asks for defence in depth and for devices not to be trusted merely because they sit on the same network. Its reasoning is straightforward.

Item 3.3.3.1 gives four example zones, which the author summarises in the table below. The guideline says the number of zones can be adapted to the real system, and the measure 'separate the CCTV network from the general user network as appropriate' is a 'should do' from level B.

For a shop without advanced network gear, the author suggests two shortcuts: a second router used only for cameras and recorder, or a separate IoT network if the router supports one. Both are the author's suggestions; the guideline says to separate as appropriate and does not prescribe a method.

If cameras or the recorder connect to a building control system, automatic doors or other operational technology (OT), item 3.3.3.3 adds a specific caution, quoted in Thai and explained below.

Ports and services are the other matter. Item 3.3.4 says to enable only necessary services. The example table in item 3.3.4.1 says to avoid Telnet where a safer option exists, to turn off or restrict unencrypted HTTP where an encrypted channel is available, to turn UPnP off when not needed, and to enable P2P or cloud connectivity only when approved, since it is an outbound channel that must be governed. Ask the installer for the list of ports and services actually open, with the reason for each.

How does PDPA Section 37 (1) connect to a camera exposed to the internet?

Once a camera records identifiable people, the footage is personal data, and the data controller has a duty under Section 37 (1) of the Personal Data Protection Act B.E. 2562 (2019) to provide appropriate security measures. A camera left on the internet with a factory password is something to weigh against these words.

What the statute does not contain is a list of measures. The PDPA does not say you must change factory passwords, enable MFA or avoid P2P, so it cannot be said that the law bans or requires them. What you can do is use the NCSA guideline as a yardstick for what 'appropriate' measures for a camera might include, and keep records that you did them. The legal outcome is decided case by case, and the author does not claim that following the guideline guarantees compliance with Section 37.

A second point is Section 37 (2). When footage is given to another provider that is not the controller, such as a camera maker's cloud, the controller must act to prevent that party from using or disclosing the data without authority or unlawfully. The author considers the eight-point table from item 3.3.3.4 a reasonable starting point for checking this, and where the provider processes on the shop's instructions a data processing agreement is advisable. See our guide to processor agreements.

Third, if a camera is accessed without authority and footage leaks, Section 37 (4) requires the controller to notify the Office without delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights and freedoms. The steps are in our 72-hour breach guide, and the minimum standard the Committee announced is covered in the minimum security standard checklist.

How long does a check of your own cameras take, and what should you look at?

The author estimates half an hour to an hour for ten cameras or fewer. That is the author's estimate and not a figure from the guideline. The list runs from the quickest risk reducers onward.

1. Log in to every device with the credentials the installer gave you. If they are still the defaults or something others can guess, change them now and note who holds the new ones.
2. Open the router's admin page and read Port Forwarding and UPnP. Delete rules pointing at cameras or the recorder unless there is a reason for them.
3. Ask the installer, or check the app, whether P2P or the manufacturer's cloud is used, then work through the eight-point table.
4. Turn on MFA for the owner account and the recovery email where the service supports it.
5. Review who has accounts that can view the cameras. Close guest accounts, unused accounts and those of people who have left.
6. Check the phones that have the viewing app. They need a screen lock, a supported operating system and no footage left in the gallery.
7. Look for public share links still active. If there is no reason to keep one, close it.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)