How Many Days of CCTV Footage to Keep, and How Much Disk It Takes

Most shops, condominium offices and small companies let the recorder decide how long footage lasts. They buy a disk of some size, the machine overwrites the oldest video, and the number of days is whatever falls out. Nobody ever chose it.

The new CCTV security guideline from the NCSA, Thailand's National Cyber Security Agency, says this is the wrong order. Choose the number of days first, give a reason, and only then work out how much storage that many days requires.

For the wider PDPA picture on CCTV, such as signage, lawful basis and who may view footage, see CCTV in the workplace. This article is about one narrow thing: the number of days and the number of terabytes.

A note on the quotations. The guideline has no official English translation yet, so the quotes below are the Thai original, and each one is explained in English straight after it. PDPA quotes are the unofficial English translation in our law library.

What does the NCSA guideline say should decide how many days to keep?

Your own reasons decide it, not a standard figure. Clause 3.2.3 has no day count to pick from. What it gives is a list of things to weigh and two things to avoid.

That gives six factors: purpose, necessity, risk, the time needed to detect and investigate an incident, law or sector rules, and contracts.

The factor most owners skip is the fourth, the gap between an incident happening and someone asking to see the footage. A restaurant that learns about a fight the same night and a residential building that learns about a missing parcel weeks later should end up with different numbers.

A way to find the number without guessing

List every incident from the past year where someone asked to see footage, and note how many days passed before the request. This is the author's suggestion, not a step in the guideline. If almost every request came within 10 days but one came after 25, ask whether that kind of incident could happen again and how bad it would be if the video were gone.

Write the answer with a one-line reason, for example: 'Keep 21 days, because lost-property reports from guest rooms normally arrive within two weeks of check-out, plus one week of margin' (a made-up example). Clause 3.2.3 lists 'set a retention period with supporting reasons' as a should-do measure at all three levels, B, E and H.

What does PDPA say about how long to keep footage?

PDPA also has no day count for CCTV. It has three linked duties: collect only what is necessary, tell people the retention period, and run a system to erase data once the period ends. Footage in which a face is visible is personal data, so all three apply directly.

Read together, the Act and the guideline point the same way. The duties are in sections 22, 23 (3) and 37 (3). The guideline adds method, for example checking that the setting in the recorder really matches the policy.

One consequence of reading them side by side: the figure you publish on a sign or privacy notice under section 23 (3) has to match what the machine really does. If the sign says 30 days and the disk only holds 11, what you told people and what you do no longer agree.

Which factor sets the retention days for which purpose?

The table below is the author's thinking aid. It is not from the guideline or the Act, and it deliberately has no day counts, because the numbers must come from your own data. The right-hand column is the question to answer with real records before you configure the recorder.

The last row reflects clause 3.2.3, which makes reviewing retention when the purpose or requirements change a should-do measure at every level, and clause 2.3.1 of the same guideline, which asks for a fresh look at lawfulness, necessity and proportionality when the purpose changes significantly.

If you have never written down a reason for how long you keep any category of data, a retention schedule you can defend shows how to build one across the whole organisation.

How do you keep a clip longer than the normal cycle?

You need a step that pulls the clip out of the overwrite cycle before the cycle reaches it. The guideline lists two separate measures for this: separate and protect incident data that must be kept beyond the normal cycle, and have a process for a temporary deletion hold with a reason and an approver.

For a small shop this can be simple. Name two people who may export clips, export to a separate location, record the date, the reason and who approved it, and set a date to review when the copy will be deleted. If the clip is going to the police or another party, see when the police ask for customer data.

A summary of the clause 3.2.3 measures by level, condensed from its table:

Look closely at row 4. One camera can leave footage in many places: the recorder, the camera's memory card, a vendor's cloud, a backup file, and clips someone exported to a phone. If you set the cycle only on the recorder, the video lives on elsewhere, which contradicts the figure you published.

B, E and H are intensity levels chosen by the guideline. Being at B does not necessarily mean a small business, and being at H does not make you critical information infrastructure under cyber law. Clause 2.1.3 says to assess the impact of the system, not the name or size of the premises.

How much disk is enough under clause 3.2.4?

Use the basic estimation formula in clause 3.2.4.1, and calculate before you buy. Clause 3.2.4 opens by saying when and why.

The 10.8 is a unit conversion (the author's arithmetic, not a quote). One megabit per second is 0.125 megabytes per second, and a day has 86,400 seconds, which gives about 10,800 MB or 10.8 GB. A camera recording continuously at 1 Mbps therefore uses roughly 10.8 GB a day.

The guideline works one example of its own: 16 cameras at an average of 6 Mbps kept for 30 days gives 6 x 10.8 x 16 x 30, about 31,104 GB or roughly 31 TB. It immediately adds a caveat.

Three hypothetical cases (every input below is the author's assumption)

This table applies the clause 3.2.4.1 formula exactly as written. The cameras, bitrates and days are invented to show the method. They are not from any real shop or building and are not recommendations. The result is approximate data capacity before RAID and spare space.

Rows 2 and 3 are the lesson. Same restaurant, same cameras, but retention goes from 15 to 30 days and the disk you need exactly doubles. Settle the number of days on reasons before you talk price with a vendor, rather than waiting for the vendor to suggest one.

The next table keeps the guideline's own scenario (16 cameras, 30 days) and changes only the bitrate, to show how sensitive the answer is. The 6 Mbps row matches the guideline's example. The other rows are the author's calculation.

Bitrate is where vendor and buyer most often talk past each other. A vendor may size disks from a default setting, while the real figure depends on resolution, frame rate and what the camera sees. Ask for the bitrate used in the calculation to be written into the quotation.

What makes the real figure differ from the calculated one

Clause 3.2.4.2 lists further factors in a table. In summary:

• Resolution: higher resolution generally raises bitrate.
• Frame rate: a higher rate may add data.
• Codec: compression efficiency differs between codecs.
• CBR or VBR: actual volume can differ from the estimate.
• Scene complexity: busy scenes with more motion or detail use a higher bitrate.
• Recording mode: continuous and event-based recording produce different volumes.
• Audio and metadata: both add storage.
• RAID and redundancy: usable capacity ends up below raw capacity.
• Growth margin: allow some room to expand, as appropriate.

Notice that the guideline gives no percentage to allow for RAID or growth. So when you ask for a quotation, ask the vendor to state the usable capacity under the RAID layout they propose, not just the sum of the disks.

Event-only recording can save space, but at the risk of missing footage before and after an event. Decide it camera by camera against the purpose of each point, not because the disk is too small.

After installation, how do you know it really keeps what you intended?

Measure it on the real machine. Clause 3.2.4 asks for a check after go-live, and clause 3.2.4.1 repeats the point at its end.

The simplest method is to open playback on your busiest camera, scroll to the oldest footage that still plays, and count the days. Compare that with the figure you published. Repeat whenever you change resolution, add cameras or switch recording mode.

Suppose the restaurant above ends up with 4 TB of usable capacity (about 4,000 GB). At 345.6 GB a day (8 cameras x 43.2 GB) it replays about 11.6 days, short of the intended 15. If the sign or notice already says 15, you must add disk, shorten the period or lower the bitrate, and correct the published text to match what really happens.

1. Before purchase
   Set the number of days with a reason, calculate disk with the formula, and have the vendor state bitrate and usable capacity in the quotation.Clauses 3.2.3 and 3.2.4
2. After go-live
   Measure how many days you can really replay, and keep the calculation and the measurement as evidence.Clauses 3.2.4.1 and 3.2.4.3
3. When cameras, resolution or recording mode change
   Recalculate and measure again, because a new bitrate changes the number of days.Clause 3.2.4.2
4. When the purpose or requirements change
   Review the retention period and update the sign or notice if needed.Clause 3.2.3 and PDPA section 23 (3)
5. When a clip must outlive the cycle
   Place a temporary hold on that clip only, record the approver and reason, and set a review date.Clause 3.2.3

Is RAID a backup, and should logs sit on a separate disk?

RAID is not a backup, and logs should be kept apart from the video disk. Both points are written plainly in clause 3.2.4.3, which opens with the principle that storage must be managed over time, not judged only on installation day.

This touches a different law on logs. Section 26 of the Computer Crime Act puts a duty to keep computer traffic data for not less than 90 days on a 'service provider', and leaves it to the Minister to announce which kinds of provider the duty applies to.

Whether your camera system produces logs that fall under it depends on whether you are a service provider under that Act. This article does not answer that. Read the clash between 90-day logs and erasure requests, which deals with it. What this article can confirm is only the guideline's principle: logs take little space but should outlive the video.

AIPDPA has retention rules and disposal logs for personal data in general, where you can record the reason behind a number of days. You can look at the real screens in the demo account. Configuring the recorder itself remains a job for the device or your video management software.

Which retention mistakes come up most often?

What can you do about it within a week?

1. Write down the purpose of each group of cameras (shopfront, entrance, car park, stockroom), following the order in clause 2.3.1: purpose, necessity, area, data, retention period, who needs access.
2. Review last year's incidents where someone asked for footage and note how many days after the event each request came.
3. Set a number of days per camera group, with a one-line reason.
4. Read the real bitrate from the recorder or the camera's web page and calculate with the clause 3.2.4.1 formula.
5. Ask the vendor to state usable capacity, after RAID and spares, in the quotation.
6. After go-live, measure the days you can really replay and keep the measurement and the calculation as evidence.
7. Make the sign and privacy notice match the measured figure, set up the deletion-hold procedure, and keep logs on a disk separate from the video.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)