New Zealand Security Camera Laws For Businesses

If you’re running a small business, security cameras can feel like a no-brainer. They can deter theft, help with health and safety issues, and give you evidence if something goes wrong.

But once your cameras record staff, customers, contractors, or even the footpath outside your shop, you’re not just thinking about “security” anymore - you’re dealing with privacy, workplace processes, and some very real legal obligations.

This guide explains how New Zealand security camera laws (and related rules) typically apply from a business owner’s perspective, so you can protect your premises without accidentally creating a privacy problem (or an employment dispute) down the line. This article is general information only and isn’t legal advice.

Are Security Cameras Legal For Businesses In New Zealand?

In most cases, yes - businesses can legally use security cameras in New Zealand.

There isn’t one single “CCTV Act” that controls everything. Instead, the main legal framework is the Privacy Act 2020 (through its information privacy principles), supported by other rules that can come up depending on your situation (for example, employment obligations if you’re filming staff, or health and safety obligations if you’re using footage to investigate incidents).

The key legal idea is this:

• It’s usually lawful to have cameras, but
• it must be done fairly, transparently, and for a legitimate purpose, and
• you must handle the footage responsibly.

So, if you’re asking “Are cameras allowed?”, the more useful question is: “Am I collecting and using video footage in a way that complies with privacy and workplace rules?”

What Counts As “Personal Information”?

Video footage will often be “personal information” under the Privacy Act 2020 because it can identify a person (even if you never say their name). That means your camera system is not just a security tool - it’s also part of how you collect and manage personal information.

As a business, it helps to treat CCTV like any other data collection activity: you should be clear about what you collect, why you collect it, and who can access it.

How The Privacy Act 2020 Applies To CCTV And Workplace Cameras

The Privacy Act 2020 sets “privacy principles” that apply when you collect, store, use, and disclose personal information. If you’re operating security cameras, those principles matter day-to-day.

Here’s what that looks like in practical terms for businesses using CCTV in New Zealand.

1. Have A Clear Purpose (And Don’t Over-Collect)

You should be able to clearly explain why you’re using cameras. Common legitimate purposes include:

• preventing theft and protecting stock
• protecting staff from violence or harassment
• investigating incidents (for example, break-ins or customer accidents)
• meeting health and safety requirements in higher-risk environments

Where businesses run into trouble is when cameras are used for “general monitoring” with no clear reason, or the coverage is wider than needed (for example, cameras that film private areas or capture unnecessary neighbouring property).

2. Be Transparent - Tell People They’re Being Recorded

In most customer-facing settings, the simplest way to stay compliant is to use clear signage at entrances and in relevant areas.

For staff, transparency usually means more than a sign. You should tell employees:

• where cameras are located
• what they record (video only, or video + audio)
• why they’re there
• how footage may be used (for example, incident investigations)
• how long footage is kept and who can access it

This kind of transparency often sits neatly in your workplace policies and onboarding documents. If you employ staff, it’s also worth making sure your Employment Contract and policies match what you’re actually doing on site.

3. Limit Access And Keep Footage Secure

If you’re collecting personal information, you need to take reasonable steps to protect it from:

• unauthorised access (including curious staff members)
• loss (for example, unencrypted storage)
• misuse (for example, sharing footage casually)

As a practical baseline, most small businesses should consider:

• restricting access to specific managers/owners only
• using passwords and two-factor authentication where possible
• ensuring cloud providers store data securely
• keeping a simple internal record of who can export or download footage

4. Only Keep Footage As Long As You Need It

The Privacy Act expects you not to keep personal information longer than necessary for your purpose.

Many businesses set systems to overwrite footage automatically (for example, 14–30 days), unless a specific incident requires longer retention. The “right” timeframe depends on your risks, how often incidents occur, and how quickly you typically discover issues.

5. Have A Privacy Framework That Matches Your CCTV Use

If you collect personal information generally (for example, online enquiries, booking details, loyalty programs, CCTV footage), it’s a good idea to have a Privacy Policy that reflects what you’re doing. The goal isn’t to overcomplicate things - it’s to show you’re collecting information for clear reasons and handling it properly.

Where You Can (And Can’t) Place Cameras In A Business

One of the most common practical questions we hear is: “Where can I legally put cameras?”

There isn’t a simple list in legislation, but the usual approach is to focus on what is reasonable and proportionate to your purpose.

Generally Lower-Risk Areas

These locations are commonly considered reasonable, assuming you have a legitimate purpose and you’re transparent about recording:

• store entrances and exits
• point-of-sale / till areas (often a high-theft risk point)
• stock rooms and storage areas
• factory floors and workshops (especially where safety incidents could occur)
• reception areas and customer service counters

High-Risk / Usually Inappropriate Areas

Even if your intentions are good, cameras in “private” areas create a high privacy risk and are much harder to justify. Examples include:

• bathrooms and toilet areas
• changing rooms
• areas used for staff medical treatment or sensitive conversations

In these spaces, the privacy expectation is high, and filming will generally be very difficult to justify.

What About Filming Outside The Premises?

Many systems capture some of the street or footpath. That can be fine, but you should try to:

• angle cameras primarily at your entrance/property
• avoid capturing neighbouring premises or private residential areas
• use privacy masking features if your system has them

If your cameras capture more than you reasonably need, it increases the risk that your surveillance could be seen as unfair or intrusive.

Workplace Surveillance: Key Rules When Staff Are On Camera

Even though CCTV is often installed for security, you need to remember that if your cameras capture employees doing their job, this becomes a workplace issue as well as a privacy issue.

This is where small businesses can get caught out - especially if footage is later used in disciplinary action or dismissal.

Be Clear About Why You’re Recording Staff

There’s a big difference between:

• security cameras placed to protect people and property, and
• performance monitoring cameras used to watch how staff work.

If your true goal is performance monitoring, you need to be upfront about that. Trying to “relabel” performance monitoring as “security” can create serious trust issues and legal risk.

Avoid “Covert” Cameras Unless There’s A Strong Justification

Hidden or covert cameras are higher risk and should generally be avoided. In rare situations (for example, investigating specific suspected serious misconduct where giving notice would likely defeat the purpose), a business might consider covert surveillance - but it should be a last resort, targeted, and time-limited, and you should get tailored advice before doing it. Covert recording can raise both privacy and employment law risks, and it can also undermine any later disciplinary process if it’s seen as unfair.

As a general rule, transparency is safer and more consistent with privacy obligations.

Using Footage For Disciplinary Action

If you’re using CCTV footage to support a warning, investigation, or termination, you should think about:

• procedural fairness (for example, giving the employee a chance to respond)
• consistency (are you applying rules evenly across staff?)
• context (does the footage show the full picture?)

Footage might be relevant evidence, but it doesn’t replace a fair process. If you’re unsure about the right steps, it’s worth getting advice early - before the situation escalates into a personal grievance.

Have Policies That Match Your Operations

A practical way to stay on track is to set expectations clearly in writing. For example, your staff handbook or internal policies can cover surveillance, privacy, and acceptable workplace conduct.

If your business collects other forms of sensitive information too (like health details for incident reporting), you might also need a stronger privacy framework, such as a Privacy Policy (Sensitive), depending on what you collect and why.

Audio Recording, Bodycams, And “Smart” CCTV: Extra Legal Risks

Modern security systems don’t just record video. Some also record audio, use facial recognition features, track movement, or integrate with door access systems.

These tools can be useful - but they also increase your compliance burden and legal risk.

Audio Recording Is Not The Same As Video Recording

People often expect they’ll be filmed in retail or hospitality settings, but they don’t always expect their conversations will be recorded.

If your cameras record audio, you should treat this as a higher-privacy activity and be careful: depending on how the system works and what it captures, audio recording can raise additional legal issues beyond privacy (including issues around recording “private communications”). Get advice before enabling audio, and make sure:

• you have a strong justification for recording audio
• you clearly notify people that audio is being recorded (not just “CCTV in use”)
• you limit audio recording to what’s necessary (or disable it entirely if you don’t need it)

If you’re thinking about recording customer calls as well (for example, for bookings or complaints), that’s a related area with its own considerations. You may also want to review the rules around call recording so your systems are consistent across the business.

Bodycams And Wearable Cameras

Bodycams can be helpful in higher-risk situations (for example, security staff, late-night retail, or locations with a history of aggressive behaviour).

But bodycams raise extra questions, like:

• when do they turn on/off?
• are they recording in sensitive situations?
• how do you notify people in fast-moving environments?
• how do you store and access recordings?

If you’re introducing bodycams, consider a written policy and training for staff so the use is consistent and defensible.

Facial Recognition And Advanced Analytics

If your CCTV system includes facial recognition, this can increase privacy risk significantly, because it may involve collecting biometric information and creating profiles about individuals.

That doesn’t automatically make it illegal, but it does mean you should slow down, review the purpose, and get advice before rolling it out.

How To Stay Compliant: A Practical CCTV Compliance Checklist For Small Businesses

It can feel like a lot, especially if you’re just trying to stop shoplifting or protect your staff. The good news is that most compliance is about good systems and clear communication.

Here’s a practical checklist you can use to reduce risk.

Step 1: Define Your Purpose (In Writing)

Write down why you’re installing cameras and what risks you’re addressing. This helps you make decisions like where cameras go, who can access footage, and how long you keep it.

Step 2: Choose Camera Locations That Match The Purpose

Aim for proportionality. If theft is your concern, focus on entrances, tills, and stock areas - not staff break rooms.

Step 3: Notify Customers And Visitors

Use clear signage at entrances and in recorded areas. Make sure signage is visible before someone enters the area being filmed.

Step 4: Tell Staff Clearly (And Keep It Consistent With Contracts And Policies)

Explain:

• what is recorded
• why it’s recorded
• how footage may be used

If you’re updating workplace policies as your business grows, you might also consider broader employee privacy practices (for example, workplace monitoring). Depending on what you’re doing, an Employee Privacy Handbook can help set clear boundaries and expectations.

Step 5: Secure Your Footage

Limit access to a small number of people, use secure storage, and avoid sharing footage informally (even internally). If you need to provide footage to insurers or the Police, document what was shared and why.

Step 6: Set A Retention Period

Choose a timeframe that’s realistic for your business (for example, 14–30 days) and set systems to overwrite automatically unless footage is required for a specific incident.

Step 7: Be Ready For Privacy Requests And Complaints

Individuals may request access to footage of themselves (this is often called an “access request”). You don’t have to provide everything automatically (for example, you may need to consider other people’s privacy and whether redactions are required), but you do need a process to respond appropriately. Under the Privacy Act, requests generally need to be handled as soon as reasonably practicable and no later than 20 working days (unless a lawful extension applies).

Having a simple privacy process in place (even if you’re small) makes these situations much easier to manage calmly and consistently.

Key Takeaways

• In most cases, security cameras are legal, but New Zealand’s security camera and privacy rules require you to operate CCTV in a way that is fair, transparent, and proportionate.
• The Privacy Act 2020 usually applies to CCTV footage because it commonly counts as personal information, meaning you must collect, store, use, and disclose it responsibly.
• You should be clear about your purpose for recording, avoid filming highly private areas (like bathrooms and changing rooms), and make sure camera placement matches your genuine security needs.
• When staff are on camera, workplace surveillance becomes an employment issue too - it’s important to be upfront, have consistent policies, and follow fair processes if footage is used in investigations or disciplinary action.
• Audio recording, bodycams, and advanced “smart” CCTV features can significantly increase privacy risk (and audio can raise additional legal issues), so it’s worth getting advice before rolling them out.
• Good CCTV compliance is mostly about practical steps: signage, staff communication, limited access, secure storage, and reasonable retention periods.

If you’d like help getting your CCTV practices, workplace policies, and privacy documentation right from day one, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.