· Codemax · 6 min read
CCTV and the PDPA: signage, footage requests and the 72-hour rule
Most outlets and central kitchens run CCTV. What the PDPA expects from the notice at the door to the day footage goes missing, and what changes when AI analytics reads the cameras.
TL;DR
CCTV footage of identifiable people is personal data under Malaysia's PDPA when it is used in a business. Outlets should post a notice in Bahasa Malaysia and English stating why cameras run, limit and log who views footage, keep it only as long as the purpose needs, answer access requests within 21 days, and report qualifying data breaches to the Commissioner within 72 hours.
- CCTV images of identifiable people are personal data when used in a commercial setting.
- The notice should be in Bahasa Malaysia and English and state why the cameras run.
- The PDPA sets no fixed retention period, so set one by purpose and write it down.
- Since 1 June 2025, qualifying data breaches go to the Commissioner within 72 hours.
- CCTV installers, cloud recorders and analytics vendors now carry security duties of their own.
Under PDPA CCTV rules, footage of identifiable people is personal data once it is used in a business, so an outlet that runs cameras has the same duties as one that keeps a customer list. In practice that means a clear notice in Bahasa Malaysia and English, a short list of people who can view footage, a retention period you can explain, a way to answer footage requests within 21 days, and a plan for the 72 hours after footage leaks.
Most F&B groups installed CCTV for security years ago and haven’t looked at the paperwork since. Two things make this a good month to look again: the 2025 amendments to the Personal Data Protection Act 2010 (PDPA) are now in force, and more operators are adding AI analytics to the cameras they already have.
What counts as personal data in CCTV footage?
CCTV footage is personal data under the PDPA when a person can be identified from it, directly or indirectly, and it is used in connection with a commercial transaction. The Personal Data Protection Department (Jabatan Perlindungan Data Peribadi, JPDP) said as much in its 2014 proposal paper on CCTV: an individual’s image is personal data, and CCTV used in commercial settings has to follow the Act’s data protection principles.
That paper was a consultation draft, and we found no final CCTV guideline. Until there is one, the Act’s general principles do the work: notice, purpose, disclosure, security, retention and access. The business that runs the cameras is the data controller, whoever installed them.
This is not legal advice; check with the Personal Data Protection Commissioner (JPDP) or your adviser.
What should a PDPA CCTV notice say?
A PDPA CCTV notice tells people that cameras are operating and why. Three details matter.
- Both languages. Section 7(3) of the Act says written notices must be in the national language and English. A notis CCTV in Bahasa Malaysia only, or English only, falls short.
- At the entrance, not behind the till. The 2014 paper suggested a notice visible to visitors at the entrance to the monitored area. For an outlet, that means the front door and, for back-of-house cameras, the kitchen and store entrances.
- The real purposes. “For security” is accurate if security is all the footage is used for. If cameras also support food safety checks, incident reviews or customer-flow counts, say so. The 2014 paper warned that workplace CCTV installed for crime prevention shouldn’t quietly be used for other purposes, and the principle behind that runs through the Act: use footage for what you told people.
Staff need more than a sign. Put CCTV in the employee privacy notice too, covering which areas are monitored, what for, who reviews footage and for how long. Update it when the purpose changes, for example when AI checks are added. We covered how to introduce that change in coaching, not surveillance.
Who can see the footage, and how long should you keep it?
Viewing. Decide who can view live and recorded footage at outlet and at HQ, and keep that list short. Outlet managers rarely need access to other outlets. The 2014 paper suggested logging access to recordings and limiting it to authorised people, which also protects you when a clip turns up somewhere it shouldn’t.
Retention. The PDPA sets no minimum or maximum period for CCTV. Choose a period that fits the purpose, set the recorder to overwrite on that cycle and write the decision down. Clips needed for an investigation, an insurance claim or a customer complaint can be kept longer, with a note of why. Everything else goes when the cycle ends.
Security. Change default passwords on recorders, keep them in a locked space, and don’t expose the recorder to the internet without a secure connection. A stolen recorder, or a camera app shared on a group chat, is a data breach.
Handling requests: customers, police, insurers and social media
A customer asks for footage of themselves. Treat it as a data access request under section 30. Section 31 gives you 21 days. Verify who is asking, find the clip and protect other people in the frame, for example by blurring them, before you share it.
The police ask for footage. Ask for the request in writing, share only the relevant clip and record what was handed over, to whom and when.
An insurer or lawyer asks. Check that the request fits a purpose people were told about, such as incidents on the premises, and share the minimum needed.
Someone wants to post it. Uploading a clip of a customer who didn’t pay, or a staff member caught on camera, is a disclosure for a purpose nobody was told about. It also makes you the brand in the viral video. Hand the clip to the police instead.
Vendors, breaches and DPOs: what changed in 2025 and 2026
Vendors carry duties too. Since 1 April 2025, the Security Principle applies directly to data processors, Skrine notes. Your CCTV installer, cloud recording provider and analytics vendor are likely processors. Put security, access and deletion in a written agreement.
Biometric data is sensitive. From the same date, biometric data became sensitive personal data. Face recognition on CCTV moves footage into that category, with a higher bar for consent.
Breaches have a clock. Since 1 June 2025, the Commissioner’s data breach notification guideline has applied. Notifiable breaches go to the Commissioner within 72 hours, and affected people are told within 7 days of that notice where there is significant harm. A breach affecting more than 1,000 people is notifiable on scale alone. Every breach, notifiable or not, goes in a register kept for at least two years.
A DPO may be needed. The DPO guideline requires one where processing covers more than 20,000 people, sensitive data of more than 10,000, or regular and systematic monitoring. A large chain with cameras at every outlet should check where it stands, then register the DPO within 21 days of appointment.
New guidelines, April 2026. The Commissioner issued guidelines on data protection impact assessments (DPIAs), automated decision-making and data protection by design on 30 April 2026. Allen & Gledhill reports that systematic monitoring and AI-driven features are among the factors that point to a DPIA.
Where VisionAI fits
Codemax VisionAI adds AI to the CCTV you already run, so it’s worth being precise about what it processes and what it doesn’t.
- Anonymous by default. Footfall, demographics, PPE and queue models work on anonymised signals: age band, gender, dwell and counts. No face recognition, no stored biometrics.
- Video stays on your network. The AI Box analyses video on site. Only alerts and statistics go to Codemax Cloud.
- No continuous recording by VisionAI. An alert keeps a single frame of the moment, sent only to the people you choose. Your existing recorder, and the notice, retention and access duties that come with it, stay yours.
Adding VisionAI is a good prompt to update the notice and the staff privacy notice with the new purposes, such as hygiene and PPE checks. The list of VisionAI capabilities is a useful starting point for that wording, and how CCTV AI checks kitchen hygiene shift by shift shows what the reports look like.
A ten-minute check for each outlet
| Check | Good answer | Red flag |
|---|---|---|
| Notice | At every monitored entrance, in Bahasa Malaysia and English, with purposes | One English sign by the cashier |
| Staff notice | CCTV covered in the employee privacy notice | Staff learned about cameras by noticing them |
| Access | A named list, with viewing logged | Shared login, or the camera app on personal phones |
| Retention | A written period, recorder set to match | ”Until the drive is full” |
| Requests | A process that verifies, blurs others and replies within 21 days | Clips sent over WhatsApp on request |
| Vendors | Written agreement covering security and deletion | Installer still has remote access nobody reviews |
| Breach | Someone knows the 72-hour rule and keeps the register | No idea who would report it |
If two rows show red flags, start with access and the notice. They are the cheapest to fix and the first things anyone checks.
Frequently asked questions
Is CCTV footage personal data in Malaysia?
CCTV footage is personal data under Malaysia's Personal Data Protection Act 2010 (PDPA) when a person can be identified from it and it is used in connection with a commercial transaction, which covers a restaurant, shop or central kitchen. The business that runs the cameras is the data controller and is responsible for how the footage is collected, used, kept and shared.
Do I need a CCTV notice under the PDPA?
A CCTV notice is the usual way to meet the PDPA's Notice and Choice Principle. Section 7(3) of the Act says written notices must be in the national language and English. The Personal Data Protection Department's 2014 proposal paper on CCTV suggested placing the notice at the entrance to the monitored area and stating that CCTV is operating and why. This is not legal advice.
How long can a restaurant keep CCTV footage in Malaysia?
The PDPA does not set a minimum or maximum retention period for CCTV footage. Under the Retention Principle, footage should be kept only as long as its purpose needs, then deleted. Clips needed for a police investigation, an insurance claim or a customer dispute can be kept longer, as long as there is a reason recorded for keeping them.
Can a customer ask for CCTV footage of themselves?
A customer can ask for CCTV footage of themselves as a data access request under section 30 of the PDPA, and section 31 gives the business 21 days to comply. Verify who is asking, find the relevant clip, and protect other people in the frame, for example by blurring them, before sharing. Keep a record of the request and the reply.
What should an outlet do if CCTV footage is leaked or stolen?
If CCTV footage is leaked or a recorder is stolen, contain it first, then assess whether the breach causes or is likely to cause significant harm or affects more than 1,000 people. Under the Commissioner's guideline, notifiable breaches go to the Commissioner within 72 hours, and affected people are told within 7 days where there is significant harm. Log every incident either way.
Does AI video analytics change PDPA obligations for CCTV?
AI video analytics can change what personal data is processed. Face recognition uses biometric data, which has been sensitive personal data under the PDPA since 1 April 2025. Anonymous analytics, such as Codemax VisionAI, works on signals like counts, dwell and PPE without face recognition or stored biometrics. The business's own CCTV recordings still carry the usual PDPA duties.
Read your cameras without identifying anyone.
See how Codemax VisionAI works on anonymised signals from the CCTV you already have, analyses video on site and sends only alerts and statistics to the cloud.
Sources
- Personal Data Protection Act 2010 (Act 709) — Laws of Malaysia, 10 Jun 2010
- Proposal Paper No. 5/2014: Guide on the Management of CCTV under Personal Data Protection Act (PDPA) 2010 — Personal Data Protection Department, 2014
- Amendments to the Personal Data Protection Act 2010: dates of coming into force — Skrine, 26 Dec 2024
- New guidelines on mandatory breach notifications under Malaysia's Personal Data Protection Act 2010 — CMS, 9 Apr 2025
- Guidelines on appointment of data protection officers in Malaysia — CMS, 27 Mar 2025
- PDP Commissioner launches guidelines on data protection impact assessment, automated decision-making and profiling, and data protection by design — Allen & Gledhill, 6 May 2026
Related reading
- How CCTV AI checks kitchen hygiene, shift by shift What AI on your existing kitchen cameras watches from opening to overnight, how a detection becomes a closed task, and what it doesn't do.
- KL food premises closures are up: what inspectors find, and how to reopen Kuala Lumpur and Putrajaya have issued more closure orders in nine months than in all of 2025. The three findings behind most of them, what happens after an order, and a routine that keeps every outlet ready.
- Same dish, every branch: fixing consistency across outlets Dishes rarely drift because of one bad cook. Six places where variation enters, what a standard recipe card needs, and how to measure consistency across outlets.