Filming Without Consent In New Zealand: What Businesses Need To Know

If you run a small business, chances are you’ve thought about cameras at some point - for security, training, quality control, or even marketing.

But filming people without their consent (or without proper notice) can quickly become a legal and reputational headache if you don’t set it up properly from day one.

In New Zealand, there isn’t one single “camera law” that covers everything. Instead, filming intersects with privacy law, employment obligations, health and safety duties, and (in some cases) criminal law.

This guide breaks down what filming without consent means in practice, when it might be lawful, when it’s risky, and how to put sensible processes in place so you can protect your business without crossing the line.

What Does “Filming Without Consent” Mean For A Business?

In a business context, “filming without consent” usually means recording video (and sometimes audio) of a person where they:

• haven’t been told recording is happening (or haven’t been given clear notice), and/or
• haven’t agreed to it (expressly or impliedly), and/or
• would reasonably expect privacy in that situation.

From a business owner’s perspective, the tricky part is that consent isn’t always a simple “yes/no” form. In many real workplaces, consent might be:

• express (e.g. a signed consent form for a promotional video shoot)
• informed but not written (e.g. you tell staff and customers and they choose to proceed)
• implied (e.g. clear signage says CCTV is operating for security, and customers enter anyway)

However, implied consent has limits. If people wouldn’t reasonably understand what’s being recorded, why, and how it will be used, you can still run into issues.

It’s also important to separate two different questions:

• Is it lawful to record? (privacy, employment, and sometimes criminal law considerations)
• Is it lawful to use or share the recording? (privacy law, confidentiality, and reputational risk)

You might be allowed to have CCTV for security, but not allowed to repurpose footage for marketing. That second step is where businesses often get caught out.

When Is Filming Without Consent Allowed In New Zealand?

Whether filming without consent is “allowed” depends heavily on context. In general, you’re aiming to show that your filming is reasonable, transparent, and proportionate to a legitimate purpose.

1) CCTV In Public-Facing Areas (Often OK, With Safeguards)

Many businesses use CCTV in customer areas like entrances, shop floors, reception areas, and carparks.

Filming in these spaces is often lawful when:

• you have a legitimate purpose (e.g. preventing theft, protecting staff, investigating incidents)
• you keep the recording limited to what you need (don’t film extra areas “just because”)
• you’re transparent (usually signage and internal policies)
• you handle the footage carefully (storage, access controls, retention periods)

Even though customers aren’t signing a form, clear signage at the entry point can support informed, implied consent and help meet your Privacy Act notice obligations.

Because this is personal information in many cases, businesses often document how they collect and use footage in a Privacy Policy (and in internal procedures), so it’s clear what you’re doing and why.

2) Filming Employees (Possible, But Usually Higher Risk)

In an employment context, filming can feel like surveillance - and if it’s handled badly, it can damage trust or trigger personal grievance risk.

Filming employees may be lawful if it’s reasonable and you’ve been transparent about it (for example, CCTV in a retail store for security that incidentally captures staff at the counter).

But it becomes much riskier if you’re recording staff:

• for performance monitoring without telling them
• in staff-only areas where they expect privacy (break rooms, staff entrances)
• in a way that feels targeted (e.g. a camera pointed only at one person’s workstation)

This is one reason it’s smart to ensure your workplace expectations are documented clearly in your Workplace Policy, and supported by a properly drafted Employment Contract (so you’re not trying to “introduce” surveillance rules after a dispute starts).

3) Filming For Marketing Content (Usually Needs Clear Consent)

If you’re filming in your premises to create content for social media, your website, or ads, you’re moving beyond “security” and into “publication” territory.

Even if it’s lawful to film in your store generally, using footage of identifiable people in marketing can raise privacy and consumer expectations issues. As a practical rule, the more public the use, the more important it is to get clear consent.

This is particularly true where:

• a person is clearly identifiable
• the footage could be sensitive or embarrassing
• children are involved
• the footage will be used to promote your business

For staged shoots (or where you’re focusing on a specific customer or staff member), it’s often worth using a Model Release Form or a tailored consent process to reduce the risk of complaints later.

What Laws Apply To Filming Without Consent?

When business owners search “filming without consent”, they’re usually looking for one clear rule. In NZ, the legal position is more about overlapping obligations.

Here are the key legal frameworks that commonly apply.

Privacy Act 2020 (Personal Information Rules)

If your footage can identify a person (customer, staff member, contractor), it may be “personal information”. That means the Privacy Act 2020 is likely relevant, including obligations around:

• purpose - collect only for a lawful, necessary reason
• transparency - take reasonable steps to let people know you’re collecting it (and why)
• security - protect footage from misuse, loss, or unauthorised access
• retention - don’t keep it longer than you need
• access requests - people can request access to their personal information in many cases

In other words: even if filming without consent isn’t automatically illegal, collecting footage in a secretive or excessive way can create privacy risk.

Employment Law Duties (Good Faith And Fair Process)

If you have employees, you’re expected to act in good faith and follow fair process. Covert filming can become a major issue if you later rely on it for performance management or dismissal.

Even where you suspect misconduct, it’s rarely a “free for all”. In limited situations, covert surveillance may be considered, but it’s high-risk and fact-specific. The safest approach is to get legal advice before using surveillance as part of a workplace investigation, because the steps you take (and how you communicate them) can affect whether your actions are seen as reasonable.

If you’re introducing cameras into a workplace, it’s also wise to make sure your internal documentation is consistent - your employment agreements, policies, and privacy messaging should all align.

Criminal Law Issues (Particularly With Audio Or Private Spaces)

Some situations can cross from privacy complaint territory into criminal risk - especially if recording involves genuinely private activity, the recording is intimate, or the filming is done in spaces where privacy is clearly expected (like toilets or changing rooms).

Audio recording can also complicate things. Businesses sometimes install systems that record calls for “training and quality assurance”, and then forget that the legal and privacy issues are different from silent CCTV. In New Zealand, whether recording a conversation is lawful can depend on factors like who is doing the recording, whether the communication is “private”, and whether at least one party to the conversation consents. Because this is technical and fact-specific, it’s worth checking your position before you switch on audio recording.

If your business is recording conversations (in person or by phone), it’s worth tightening your process and documentation. Many businesses use a short verbal notice (“this call may be recorded…”) and reflect it in their privacy documentation. If you’re unsure, it’s better to check first than to assume it’s fine.

Common Risk Scenarios For Small Businesses (And How To Avoid Them)

Most filming without consent issues don’t start with a business trying to do the wrong thing. They start with a business trying to solve a practical problem quickly - theft, complaints, staff performance, or marketing content - without thinking through the legal flow-on effects.

Here are some common scenarios we see for SMEs.

1) Installing Cameras To Stop Theft

This is one of the most common and most legitimate reasons to use CCTV.

To reduce the risk of a filming-without-consent complaint, consider:

• placing cameras only where needed (avoid capturing neighbouring properties or public footpaths unnecessarily)
• using signage at entrances and high-visibility locations
• limiting who can access the footage (not “everyone with the password”)
• setting a retention period (e.g. overwrite after X days unless required for an incident)

If your business is also collecting other customer data (names, emails, IP addresses, membership info), make sure your overall privacy messaging is consistent so customers aren’t surprised by what you collect and why.

2) Using Footage In A Staff Investigation

Let’s say you review CCTV and believe a staff member has breached policy. It can be tempting to move straight to discipline.

Employment processes need care. A safer approach usually includes:

• checking whether staff were informed of the camera and its purpose
• using footage only for the purpose you collected it for (e.g. security, incident investigation)
• giving the employee a fair chance to respond to what you’re alleging
• keeping records of the process you followed

Where businesses get stuck is when surveillance feels selective or secret, or when policies don’t match what actually happens in the workplace.

3) Filming Content For Social Media In-Store

Short-form videos are great marketing - but they’re also a fast track to complaints if you accidentally capture people who don’t want to be online.

Practical ways to reduce risk include:

• filming outside busy periods
• using signage like “filming in progress” when doing a shoot
• positioning cameras to focus on products, not faces
• getting clear consent if a person is identifiable or featured
• having a quick “take-down” process if someone contacts you unhappy about a post

For planned campaigns, written releases are often the cleanest way to show consent later if a dispute arises.

4) Cameras In Staff Areas

Back-of-house areas can be a grey zone. Some staff areas are purely operational (stock rooms), while others are spaces where staff should reasonably expect privacy (break rooms).

As a general guide, it’s safest to avoid filming in areas where people are:

• changing clothes
• using bathrooms
• taking breaks in a private setting

Even if your intentions are good, these areas are much more likely to trigger concerns and escalation.

A Practical Compliance Checklist For Filming And CCTV In Your Business

If you want to reduce risk, the goal isn’t to drown yourself in paperwork - it’s to build a simple, consistent system where your purpose is clear and your practices match what you’ve told people.

Here’s a practical checklist you can work through.

1) Be Clear On Your Purpose

Write down (even in a short internal note) why you’re recording:

• security and theft prevention
• health and safety incident investigation
• customer and staff safety
• training/quality assurance (note: audio is a different risk category)
• marketing content (usually requires separate consent)

Try not to list “everything” as the reason. Broad, vague purposes can make it harder to justify your practices later.

2) Use Signage And Notices

For customer-facing areas, signage is often a key practical step. You want it to be:

• visible before people enter (not hidden behind a plant)
• clear that CCTV is operating
• high-level on purpose (e.g. “for security”)

For staff, you’ll usually also want written communication (policy updates, onboarding documents, or contract terms) so there’s no confusion.

3) Limit Access And Set Retention Periods

Footage is only helpful if it’s secure. Consider:

• who can access live feeds and recordings
• how passwords are managed
• whether footage is stored locally or in the cloud (and who the provider is)
• how long recordings are kept before being overwritten

Keeping footage indefinitely “just in case” often creates unnecessary risk, because the longer you hold it, the more likely it will be misused, leaked, or requested.

4) Have A Process For Requests And Complaints

People may ask questions like:

• “Are you recording me right now?”
• “Can I get a copy of the footage?”
• “Please delete that video of me.”

You don’t need to improvise every time. Have a basic process, and make sure your team knows who to escalate to.

Many businesses also use an Access Request Form to help handle privacy requests in an organised way.

5) If You’re Recording Audio, Be Extra Careful

Audio recording is often perceived as more intrusive than video. If you record calls or in-person audio (for example, through security systems), make sure you have:

• a clear and lawful purpose
• clear notice (often a verbal message for calls)
• strong access controls
• staff training (so people don’t make promises like “we never record” when you do)

If you’re unsure whether your setup crosses into higher-risk surveillance or interception issues, it’s worth getting advice before you switch it on.

Key Takeaways

• Filming without consent isn’t always automatically unlawful in NZ, but it becomes high-risk if people aren’t informed, the filming is excessive, or the footage is used for a new purpose.
• CCTV for security in customer areas is often workable if you’re transparent, limit what you collect, and secure your footage properly.
• Filming employees requires extra care - covert or targeted surveillance can create employment law risk and undermine trust in the workplace.
• Marketing content is a different category: if identifiable people are featured, getting clear consent (often in writing) is usually the safest approach.
• The Privacy Act 2020 will often apply because footage can be personal information, which brings obligations around purpose, transparency, security, retention, and access requests.
• Simple, consistent policies and processes (signage, access controls, retention periods, request handling) go a long way in reducing complaints about filming without consent.

If you’d like help setting up CCTV policies, privacy documentation, or consent processes that suit how your business actually operates, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.