Using CCTV at Work in New Zealand: Privacy Rules for Businesses

CCTV can help deter theft, protect staff, and investigate incidents, but plenty of New Zealand businesses get the setup wrong. Common mistakes include putting cameras in places where people expect privacy, recording sound without thinking through the privacy impact, and collecting footage without telling staff or customers clearly enough. Another frequent problem is keeping recordings for too long, or letting too many people access them.

If you use CCTV security cameras at work, privacy law is not just a technical issue for your installer. It is a business decision that affects your policies, your employment processes, and how customers and staff trust your brand. The right setup depends on why you are filming, where the cameras are placed, what you record, and what you do with the footage after you collect it.

This guide explains the main privacy rules New Zealand businesses should think about before installing cameras, updating an existing system, or using footage in a workplace issue. It also covers practical steps, common mistakes, and the questions business owners ask most often.

Overview

New Zealand businesses can usually use CCTV in the workplace, but only where the collection of personal information is lawful, necessary for a clear purpose, and handled fairly. Cameras are not a free pass to monitor everything, and the main legal risk is often poor process rather than the camera itself.

• Define a clear business purpose for the cameras, such as site security, staff safety, or investigating stock loss.
• Check whether filming is reasonably necessary, and whether a less intrusive option could work.
• Avoid placing cameras in spaces where people have a strong expectation of privacy, such as toilets, changing rooms, or private break areas.
• Tell staff, contractors, and visitors that filming is taking place, why it is happening, and how footage may be used.
• Limit access to footage and set a sensible retention period.
• Make sure your employment documents, policies, and internal procedures line up with how the cameras are actually used.
• Take extra care before using CCTV footage in disciplinary action, performance management, or a dispute.

What CCTV Security Cameras Means For New Zealand Businesses

CCTV usually involves collecting personal information, so the Privacy Act 2020 is often central to how your system should be designed and managed. If a person can be identified from the footage, directly or indirectly, the recording is likely to be personal information.

That matters because privacy obligations do not begin when someone complains. They start when you decide to install the cameras, choose locations, write signage, prepare a privacy policy or collection notice, decide who can view footage, and set retention periods.

Why CCTV Is A Privacy Issue

A camera in a workplace can record employees, customers, contractors, delivery drivers, and visitors. In some businesses, it may also capture vehicle registration numbers, timestamped location data, and audio. All of that can become personal information depending on the context.

Under New Zealand privacy principles, businesses generally need a lawful purpose for collecting personal information, and the collection must be necessary for that purpose. You also need to be open about the fact that information is being collected and what will happen to it.

In plain English, that usually means you should be able to answer these questions before you spend money on setup:

• What problem is the CCTV meant to solve?
• Why is filming the right response to that problem?
• What areas need coverage, and what areas should stay off camera?
• Who will be told about the filming, and how?
• Who can access the footage?
• How long will recordings be kept?
• What is the process if someone asks for access to footage that shows them?

Can You Monitor Employees With CCTV?

Yes, sometimes, but it must be justified and handled carefully. Employers do not have unlimited rights to watch workers simply because the filming happens on business premises.

If your purpose is legitimate, such as workplace safety, site security, cash handling, or investigating repeated stock loss, CCTV may be reasonable. If the real purpose is broad surveillance of employee behaviour without clear justification, the setup is more likely to create privacy and employment risk.

Employment law also matters here. If you later rely on footage in a disciplinary process, the way the footage was collected and the fairness of the process can become just as important as what the footage shows.

Do You Need Consent?

Consent is not always the legal basis businesses rely on for workplace CCTV, but transparency is still essential. In many cases, the more practical question is not whether you obtained a signed consent form, but whether people were clearly informed and the collection was reasonable.

That said, high-risk or unusual monitoring may need more careful consultation, especially if employees are affected. A hidden or surprise camera setup can create serious issues unless there is a strong and specific reason for it, such as a tightly scoped investigation into suspected theft or misconduct, and even then the legal risk can be high.

What About Audio Recording?

Audio raises the privacy stakes. Recording conversations is often more intrusive than recording video alone, especially in customer service areas, offices, or staff spaces where private discussions can happen.

If your system has audio capability, do not assume it should be switched on. Many businesses decide video-only coverage is enough for their purpose. If audio is being considered, the purpose, notice, and privacy impact need closer review.

When This Issue Comes Up

CCTV questions usually arise at ordinary business moments, not after a formal legal review. The most common trigger is a practical problem on the ground, such as repeated shoplifting, damage to equipment, or concerns about staff safety when opening early or closing late.

Opening A New Site Or Moving Premises

Businesses often install cameras as part of a fit-out, alongside alarms, access control, and lease negotiations. This is a good time to check whether your commercial lease says anything about signage, exterior fittings, landlord approval, or changes to common areas.

If your cameras face a shared entrance, loading zone, or footpath, think carefully about whether the field of view is broader than necessary. Recording beyond your premises is not automatically unlawful, but a wide-angle setup that captures more than you need can create avoidable privacy concerns.

Retail, Hospitality, Warehousing, And Customer-Facing Sites

Cash handling areas, storerooms, entry points, and customer counters are common places for CCTV security cameras. Businesses in these sectors often have a genuine need to deter theft and protect staff.

The main issue is overreach. A camera pointed at the till may be justified. A camera aimed at a staff meal area or constantly recording private staff conversations usually raises a different question.

Investigating Loss, Misconduct, Or Safety Incidents

Many businesses only think seriously about CCTV after something goes wrong. Footage can be useful in investigating missing stock, threats, aggressive customer conduct, accidents, or damage to vehicles or property.

This is where founders often get caught. If the footage was collected through a poorly designed system, or people were not told cameras were operating, using the footage later may be harder and more contentious than expected.

Remote Monitoring And Third Party Providers

Some businesses use external security providers or cloud-based platforms to store and review footage. That can be fine, but the business still needs to know who is handling the data, where it is stored, and what protections apply.

If a provider stores footage overseas or can access it remotely, extra privacy questions can arise. Your contract with the provider should deal with access controls, confidentiality, security standards, and what happens to the footage if the service ends, including any data processing obligations.

Using Footage In HR Processes

CCTV often crosses into employment issues when an employer wants to use footage in a warning, dismissal, or performance discussion. Before you do that, check that the original purpose for collection supports the later use, and that your process is fair.

Even where the footage appears clear, employers should avoid treating CCTV as the whole case. Staff should usually have a fair chance to respond, and the employer should not rely on selective clips without context.

Practical Steps And Common Mistakes

The safest approach is to treat CCTV as a documented business system, not just a hardware purchase. Good signage helps, but signs alone do not fix a bad setup.

1. Write Down The Purpose Before Installation

You should be able to state the purpose in one or two clear sentences. For example, your reason might be to deter after-hours break-ins, monitor warehouse entry points, or protect lone workers at reception.

Vague reasons create problems later. If your stated purpose is security, then using the same footage for close monitoring of staff productivity may not sit comfortably with that original purpose.

2. Choose Camera Locations Carefully

Place cameras where they address the actual risk. Entry doors, tills, loading docks, and stock rooms are common examples. Avoid filming areas where there is a stronger expectation of privacy.

High-risk locations usually include:

• Toilets and shower areas.
• Changing rooms.
• Private lactation or medical rooms.
• Staff spaces used for sensitive personal conversations.

Break rooms can be tricky. Sometimes a camera near a doorway may be justified for security reasons, but constant monitoring of staff while they are on a private break can be difficult to justify.

3. Use Clear Notice And Workplace Policies

People should not have to guess they are being recorded. In most workplaces, that means visible signage at or before entry to the monitored area and a written policy for staff.

Your internal documents should usually cover:

• Why the cameras are used.
• Where cameras are located.
• Whether audio is recorded.
• Who can access footage.
• When footage may be reviewed.
• How long recordings are kept.
• How footage may be used in investigations or employment matters.
• How someone can ask for access to footage that includes them.

If you already have employment agreements, staff handbooks, or site rules, check they are consistent with the CCTV policy. This is especially important before you sign new employment contracts or onboard staff at a new site.

4. Limit Access To Footage

Access should be restricted to people who genuinely need it. In a small business, that may be one owner and one senior manager. In a larger business, access may sit with security, operations, or HR, depending on the purpose.

A common mistake is informal sharing. Footage should not circulate in team chat groups or be shown to staff out of curiosity. That creates obvious privacy risk and can also undermine trust.

5. Set A Retention Period

Do not keep recordings forever just because storage is cheap. Retention should reflect your purpose and practical needs.

Many businesses choose a set period unless footage is needed for a specific investigation. The key is to have a reasoned policy and to follow it. Keeping everything indefinitely can be hard to justify if the original purpose was routine site security.

6. Prepare For Privacy Requests

People may ask whether you hold footage of them, or request access to it. That can include staff, customers, contractors, or visitors.

You need a practical process for finding relevant footage, checking whether other people appear in it, and deciding what can be released. Sometimes information may need to be withheld or edited where another person's privacy is affected, but these requests should be handled carefully and within the required timeframe, often using an access request process.

7. Think About Security Of The System Itself

A CCTV system can create cyber and privacy risk if passwords are weak, remote access is poorly controlled, or footage is stored on an insecure platform. This is not just an IT issue. It affects whether the business has taken reasonable steps to protect personal information.

Basic controls often include:

• Strong passwords and limited administrator accounts.
• Multi-factor authentication where available.
• Role-based access for managers or providers.
• Logs showing who accessed footage and when.
• A process for deleting footage when required.
• A clear arrangement with any third party monitoring or storage provider.

8. Do Not Rely On Hidden Cameras As A Routine Tool

Covert surveillance is high risk. In rare cases, a business facing a serious and specific issue may consider it, but this should not be treated as a standard management option.

If a hidden camera is being considered, the purpose, timing, location, and legal justification need careful review before any installation. This is especially true if the footage may later be used in an employment process.

9. Avoid Function Creep

Function creep happens when a system installed for one reason slowly gets used for others. A camera set up to protect a front entrance can end up being used to monitor attendance, check staff conversations, or review work pace.

This is where businesses often drift into risk without noticing. If your use of CCTV changes, review the purpose, notices, and internal policy rather than assuming the old setup still covers the new use.

10. Check Other Documents And Approvals

Depending on your setup, CCTV may touch more than privacy law. Before you sign a contract with an installer or provider, it is worth checking related business documents and approvals, such as:

• Commercial lease terms for fixtures, common areas, signage, and landlord consent.
• Employment agreements and workplace policies.
• Contracts with third party security or cloud storage providers.
• Internal incident response procedures.
• Customer-facing privacy notices if your premises collect significant visitor footage.

Most businesses do not need a special general licence just to use CCTV on their own premises, but sector-specific environments or particular sites may have additional rules. If your business operates in a regulated setting, check the requirements that apply to that industry.

FAQs

Can a New Zealand business install CCTV in the workplace?

Usually yes, if there is a legitimate purpose, the collection is reasonably necessary, and staff and visitors are told about it. The location of the cameras and how the footage is used will matter.

Can we use CCTV footage to discipline or dismiss an employee?

Sometimes, but use caution. The footage should have been collected lawfully and your employment process still needs to be fair, including giving the employee a chance to respond.

Do we need signs if we have security cameras?

In most cases, clear notice is a sensible and expected part of compliance. Signs help, but they should match a real policy and actual business practice.

How long can we keep CCTV footage?

There is no single retention period that suits every business. Keep footage only for as long as you reasonably need it for the purpose you collected it, unless specific footage must be retained for an investigation.

Can cameras record public areas outside our premises?

Sometimes, but the coverage should be no broader than necessary. If your camera captures footpaths, neighbouring premises, or shared areas, review whether that extra recording is really needed and proportionate.

Key Takeaways

• CCTV can be lawful for New Zealand businesses, but the system needs a clear purpose, sensible placement, and fair handling of the footage.
• The Privacy Act 2020 is often engaged because identifiable video footage is usually personal information.
• Businesses should be open about CCTV, use clear signage and policies, and avoid filming areas where people expect privacy.
• Access to footage should be restricted, retention periods should be defined, and third party provider arrangements should be documented.
• Using footage in disciplinary or misconduct processes needs extra care, because privacy and employment law issues can overlap.
• Before you spend money on setup, review your camera plan, workplace documents, lease terms, and provider contracts together rather than treating CCTV as just an equipment purchase.

If your business is dealing with CCTV security cameras and wants help with privacy policies, employment documentation, supplier contracts, or commercial lease issues, you can reach us on 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.