CCTV and the Data Protection Act are closely linked in Kenya. Since the Data Protection Act, 2019 came into force, images of identifiable people captured by security cameras are treated as personal data. That means businesses, landlords, estates, schools and other organisations that run CCTV have responsibilities about why they record, how they tell people, how long they keep footage, who can see it and how they keep it secure. Homeowners recording only their own private property have fewer obligations, but good practice still matters, especially when cameras capture neighbours, the road or domestic workers.

This guide explains the practical side in plain language. It is general information, not legal advice. For your specific situation, consult a data protection professional or the Office of the Data Protection Commissioner (ODPC), which publishes guidance and handles registration.

Why CCTV footage is personal data

Personal data is information that relates to an identified or identifiable person. A clear image of a face, a number plate linked to an owner, or footage showing a known employee at their desk all identify people. When your cameras capture such images, you are processing personal data and the principles of the Act apply.

The key principles applied to CCTV

Step 1: Define and write down your purpose

Start with a short written statement of why you use CCTV, for example: “to protect staff, visitors and property, prevent and detect crime, and support investigations of incidents.” Keep it specific. This purpose shapes camera placement, retention and who may view footage.

Step 2: Place cameras proportionately

• Focus cameras on entrances, exits, tills, stores, parking and perimeters
• Avoid private spaces such as toilets, changing rooms and staff sleeping quarters
• Avoid pointing cameras into neighbours’ properties or beyond what you need on public roads
• Use privacy masking on the recorder to black out areas you should not capture
• Think carefully before recording audio, which is more intrusive

See CCTV camera placement for homes and CCTV for shops.

Step 3: Tell people with clear signs

Transparency is central. Put CCTV signs at entrances and in monitored areas. A good sign states:

• That CCTV is in operation
• The purpose (for example, security and crime prevention)
• Who operates it (your organisation’s name)
• How to contact you about footage

For employees, add CCTV to staff policies and contracts, and explain it during induction.

Step 4: Set a retention period

Decide how long you need footage and configure the recorder to overwrite or delete after that period. Many organisations choose between two and four weeks, keeping specific clips longer only when they relate to an incident or investigation. See how long CCTV footage is stored.

Step 5: Control access

• Limit viewing and export rights to a small number of named people
• Use individual user accounts, not a shared password
• Lock the recorder in a secure room or cabinet
• Keep a log of who viewed or exported footage and why
• Remove access immediately when staff leave

Step 6: Secure the system

Weak security can turn CCTV into a data breach. Change default passwords, update firmware, avoid exposing recorders directly to the internet without protection, and use reputable equipment. If the system is monitored by a security company, make sure the contract covers confidentiality and data handling.

Step 7: Handle requests for footage

People have the right to access personal data about them, and the police may request footage for investigations. Prepare a simple procedure:

1. Receive the request in writing and verify the person’s identity
2. Locate the relevant footage quickly before it is overwritten
3. Consider whether other people appear, and blur or edit if needed to protect their privacy
4. Provide a copy within a reasonable time
5. Record the request and your response

For police requests, record the officer’s details, the occurrence book (OB) number and what was provided.

Step 8: Check registration requirements

Many data controllers and processors must register with the ODPC, and some sectors and activities are specifically covered. Organisations using CCTV for security should check the current registration requirements and thresholds on the ODPC website, as these are set by regulations and may change.

Special situations

Landlords and apartment blocks

Cameras in common areas such as gates, lobbies, stairwells and parking are common. Tell tenants, display signs, avoid pointing cameras into units, and set clear rules about who can view footage. See apartment security tips.

Estates and residents’ associations

Estate committees that run gate cameras should agree a written policy on access, retention and requests from residents. See gated estate security in Nairobi.

Schools

Cameras in schools capture children. Be especially careful with placement, access and sharing, and involve parents in the policy. See school security in Kenya.

Homes with domestic workers

Tell domestic workers where cameras are. Avoid their private quarters and bathrooms. Hidden cameras in private spaces are both unfair and risky.

Workplaces

Monitoring employees at work should be proportionate and explained. Use cameras for security and safety, not constant surveillance of every action, and consult staff where possible.

A simple CCTV compliance checklist

Common mistakes

• No signs, or signs without contact details
• Cameras pointed into neighbours’ homes or staff quarters
• Keeping footage indefinitely “just in case”
• Everyone in the office knowing the recorder password
• Sharing clips on WhatsApp groups without thought for the people shown
• Recorders with default passwords reachable from the internet

Sharing footage on social media

It is tempting to post footage of a suspected thief on social media. Doing so can identify innocent people, prejudice an investigation and create legal risk. Share footage with the police instead, and if you must alert neighbours, do it carefully through the proper channels.

Worked example: an office in Upper Hill

An office in Upper Hill had cameras installed years ago with no signs, a shared password and no set retention. A review of CCTV and the Data Protection Act requirements led to a written purpose statement, signs at the entrances with a contact email, privacy masking over a neighbouring building’s windows, a 30-day retention setting, individual accounts for the facilities manager and security supervisor, and a simple request procedure. When a visitor later asked for footage of an incident in the lobby, the office handled the request quickly and consistently.

How Bestcare Security can help

We install and monitor CCTV systems designed with privacy in mind: proportionate camera placement, privacy masking, secure recorders, sensible retention settings and clear signage. We also help you prepare simple procedures for handling footage requests. Learn more about our CCTV monitoring services and corporate security services.

Working with your security provider

If a security company installs or monitors your cameras, it may act as a data processor on your behalf. Make sure the contract covers confidentiality, who at the company can view footage, how long monitoring recordings are kept and what happens to data when the contract ends. Understanding CCTV and the Data Protection Act together with your provider keeps responsibilities clear. A provider that takes CCTV and the Data Protection Act seriously will help you document these arrangements.

Frequently asked questions

Is CCTV footage personal data in Kenya?

Yes, where it captures identifiable people, such as clear faces or linked number plates.

Do I need CCTV signs?

Organisations should display clear signs stating that CCTV is in use, why and who to contact. Signs are good practice for homes too.

How long can I keep CCTV footage?

Only as long as needed for your purpose. Many organisations use two to four weeks, keeping incident clips longer.

Can I put cameras in staff areas?

In work areas for security, if proportionate and explained, but not in toilets, changing rooms or sleeping quarters.

Can someone ask for footage of themselves?

Yes. People have a right to access their personal data. Have a procedure to verify, locate and provide footage.

Can I share CCTV footage with the police?

Yes, for investigations. Record what you shared, when and with whom.

Do I need to register with the ODPC?

Many organisations must. Check current requirements on the ODPC website.

Can I post CCTV clips of thieves online?

It is risky and can harm innocent people. Share footage with the police instead.

Does the Act apply to my home cameras?

Purely personal and household use is treated differently, but capturing neighbours, roads or domestic workers still calls for care.

Can Bestcare Security set up privacy-conscious CCTV?

Yes. Call 0709 004 600 for a free consultation.

Related reading

• CCTV Installation Price in Kenya: What Affects the Cost
• How Many CCTV Cameras Do I Need for My Home or Business?
• Types of CCTV Cameras in Kenya: Which One Is Right for Your Property?

Explore our CCTV monitoring services or see all our security services in Kenya.