CCTV already installed? Secure it in seven steps this week

Say a shop has had four cameras for two years. The installer made them viewable from a phone on day one, and nobody has touched the settings since. Three questions for today: was the recorder's factory password ever changed, is any camera reachable from the internet, and how many days of footage does the recorder keep?

If you cannot answer even one, there is work to do, and it needs neither a new installer nor new equipment. In September 2026 the National Cyber Security Agency (NCSA) issued a general CCTV guideline. Its item 3.1 holds a seven-point list for people who cannot do every measure at once.

This article reads item 3.1 and arranges it into a one-week plan. Notices, lawful basis and police requests are already covered in CCTV in offices, shops and condos: what the PDPA expects, so the focus here is the security of the system itself.

What is item 3.1 of the NCSA guideline, and does it suit a small shop?

It is a short starter list for organisations that want to cut the main risks first because they cannot yet do the whole chapter. The guideline calls it a Quick Start and says plainly that it does not replace a risk assessment. The Thai original is quoted, then explained.

The table in item 3.1 has three level columns: B (Baseline), E (Enhanced) and H (High-Assurance). A small shop with no IT staff will mostly read the B column. One caution: the guideline does not tie the level to shop size.

Item 1.5 says the level must come from context and the overall risk assessment, not from one factor such as type of organisation. Item 2.1.3 adds that a small CCTV system supporting a critical mission may need stricter measures than a large system with limited impact. A small gold shop with three cameras should not call itself level B just because it is small.

Two more terms to read precisely. Under item 1.5, 'should do' marks the main measure recommended for that level, and anyone choosing another way should be able to explain why. 'Consider' marks an additional measure to adopt according to context. Neither is the language of a legal order.

Below the table is a note for homes and small businesses without technical staff: the installer or service provider should make the necessary security settings before handover, and hand the accounts, rights and information needed to manage the system to the owner. In plain terms, a small shop is entitled to ask the installer for these things.

In what order can all seven steps be done in one week?

The numbering in the guideline is not a work order. The author has re-sequenced it on a simple principle: close the riskiest gaps first and leave anything that needs other people for later. The table below is the author's own proposal, not part of the guideline, and the times are estimates for a shop with ten cameras or fewer. Larger systems need more time.

That adds up to roughly 8-14 working hours. If your original installer is still reachable, book one visit for days 2-4 together; that is cheaper than calling for each task. If not, steps 2 and 4 are the hardest for an owner to do alone, so bring in a network administrator for those two only.

Steps 1 and 2: how do you handle default passwords and internet exposure?

Start with passwords, which the guideline raises as early as the preface. It lists, among risks, the use of default credentials such as factory passwords. Step 1 in item 3.1 then comes first in the list and also addresses the manufacturer.

In a real shop, go device by device: cameras, the recorder (NVR/DVR), the router's admin page and any app tied to a manufacturer account. Each needs a new password, and the same one should not be reused across several devices without a reason, which item 3.4.4 lists as a 'should do' even at level B.

On storage, item 3.4.4 asks for credentials to be kept in a protected way. The author suggests a password manager, or a sealed envelope in a lockable cabinet with a note of who holds it. Do not put the password on a sticky note beside the recorder, because anyone who reaches the machine sees it.

Step 2 follows immediately, because even a good password helps little if the camera's login page is visible to the whole internet. The guideline says to avoid exposing cameras or management interfaces directly unless necessary, and to use an approved channel when remote viewing is required. Three quick checks:

1. Open the router's admin page and read the Port Forwarding or Virtual Server list. If a rule points at a camera or recorder, ask the installer why.
2. Check whether UPnP is on. The table in item 3.3.4.1 advises turning it off when not needed, because it can open connections to the internet automatically.
3. Ask the installer whether a P2P or manufacturer cloud service is enabled. The guideline wants it enabled only when approved and governed like any other remote access channel. See factory passwords and viewing cameras from outside.

Steps 3 and 4: how far should MFA and firmware updates go?

Step 3 is the only step where level B says 'consider' instead of 'should do', because MFA depends on the system supporting it. The table says to use it for privileged accounts and remote access where supported. If your viewing app offers two-step verification, turn it on for the owner account first, and for the email used to recover the account. There is no need to wait for level E.

Step 4 sounds easy and is harder than it looks. Item 3.5.1 explains that cameras stay in service for years while vulnerabilities keep changing, so a device that still works can become riskier if it is not updated or the maker stops supporting it. At level B three things are 'should do': name someone to track updates, judge urgency by severity and exposure, and verify the source of firmware before installing it.

In practice, write the model and firmware version of every camera and recorder into one table, and check against the manufacturer's own website only. Never install firmware from a link someone sends you. A register of versions and a review of end-of-life or end-of-support status are 'consider' at level B and 'should do' at level E, so doing them early costs little.

If you find a very old camera whose maker no longer issues updates, the introduction to chapter 3 says an organisation does not have to replace the whole system at once. It should assess the risk, set priorities and consider compensating measures or a replacement plan in proportion to risk. That topic deserves its own article.

Steps 5 and 6: what must you settle on purpose, signs and retention?

These two steps are where cybersecurity meets the PDPA. Step 5 asks for the purpose of the cameras. Item 2.3.1 suggests thinking in order: purpose, necessity, areas that need recording, data needed, retention needed, and who needs access. That is data minimisation in practice.

The guideline also warns against installing cameras merely because technology allows it. In a shop, open each camera's live view and ask what that angle protects. If you cannot answer, or it shows places customers and staff would expect to be private, change the angle or remove it. Item 3.2.1.7 covers areas where cameras should not be installed or need special care.

On signs, item 2.3.2 proposes a basic notice saying CCTV is in use, the main purpose, who is responsible, and where to read more, backed by a fuller privacy notice. The more detailed TDPG 4.0 sign design is in the PDPA article linked above. The key caution in item 2.3.2 is quoted here in Thai and explained after.

Step 6 is where shops go wrong easily, because most recorders are set to overwrite when the disk fills. That lets disk size decide the real retention period. The guideline rules this out directly in item 3.2.3.

Day 6 of the plan therefore has two parts. First decide how many days to keep and write a short reason, for example that the shop learns of theft or disputes within a few days. Second, check at the recorder that the footage really kept matches that number. Checking the live setting against policy is 'consider' at level B; the author recommends doing it anyway.

The guideline also asks you to count copies elsewhere, such as cloud storage, backups and exported files, and to have a way to pause deletion when an incident needs footage kept, for example after a police report. Both are 'consider' at level B. On the legal side, the PDPA has a matching duty in Section 37 (3).

Step 7: who is responsible when something goes wrong in a shop with a few staff?

Step 7 asks for three things: someone responsible for the system, a way to report incidents, and someone with authority to decide when something abnormal happens. A small shop does not need a department. Item 2.1.5 accepts that one person can hold several roles, provided five questions can be answered.

One sheet of paper that answers those five questions is enough for day one. Put on it the phone numbers of the installer, the internet provider and the camera maker or reseller, because people lose time hunting for numbers once an incident is under way.

Item 3.6.3 sets out six response stages: contain, assess, remediate, recover, report and improve. At level B four measures are 'should do': name a responsible person and reporting channel, be able to isolate or limit a device suspected of attack, revoke related passwords or access, and make any report the law or other rules require. For a small shop that means unplugging the network cable of the odd device, then changing passwords from another clean machine.

The guideline also says to preserve logs and evidence before resetting a device where possible. If personal data has leaked, the controller must look at Section 37 (4) of the PDPA: notify the Office of the PDPC without delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights and freedoms. The full steps are in our guide to the 72-hour breach notice.

How do guideline advice and PDPA duties differ?

They differ in what happens if you do not follow them. The NCSA guideline has no binding force, whereas the PDPA is law and binds a data controller once cameras record identifiable people. The table sets both sides against each of the seven steps so you can see which have a statute behind them and which are simply good practice.

A caution: the PDPA does not list security measures item by item. Section 37 (1) requires 'appropriate' measures, in line with the minimum standard the PDPC announces. It would be wrong to say the law orders you to enable MFA or update firmware. If a camera leak ever has to be explained to the PDPC Office, following the NCSA guideline with records helps show what measures you had, though the legal outcome is decided case by case.

Matters the PDPA raises beyond the seven steps, such as giving footage to police, answering a request to see one's own footage, and the Section 39 record, are in CCTV in offices, shops and condos. For the minimum security standard the PDPC announced, see our minimum security standard checklist.

After the first week, what comes next and what mistakes should you avoid?

Next comes routine. The guideline says how often to review access should follow risk and staff turnover, with no single interval for every system. The author suggests a small shop schedule a review every three months and go through the tables built in week one: device list, firmware versions, who can view footage and the retention setting. Review immediately when the installer changes or when a member of staff who knew the passwords leaves, which matches the measure in item 3.4.3 on revoking access when duties end.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)