CCTV recording methods, and how long to keep footage

NVR, VMS or cloud: how should your cameras record, and for how long?

There are four CCTV recording methods: a network video recorder (NVR) on site, a video management system (VMS) on a server, cloud recording, and recording on the camera itself. For one small site, an NVR is usually enough. Once there are several sites, other systems to connect, or a need to find footage fast, a VMS or a mix of on-site and cloud recording usually pays for itself. Whichever you choose, the Privacy Act expects you to set how long footage is kept and to delete it after that. The decision that matters most is rarely the recorder. It is whether you can find and export the right footage in minutes when someone asks for it.

The four ways to record

• Network video recorder (NVR). A dedicated box on site that records the cameras on its network. Simple, low cost to start, and it works without the internet. Each NVR has a channel limit, it is often tied to one manufacturer’s cameras, and several sites mean several boxes to check. If it is stolen or fails, the footage on it goes too.
• Video management system (VMS). Software on a server, on site or hosted, that manages cameras across one site or many, often from different manufacturers. It brings central search, user permissions, audit trails, and connections to access control, alarms and analytics. It comes with licences, usually per camera, annual software support, and a server someone has to look after. Wisenet WAVE and Milestone are examples.
• Cloud recording. Footage is sent to a data centre and viewed through a browser or app. Off site by design, so a stolen recorder does not take the evidence with it, and easy to reach from anywhere. It depends on upload bandwidth, which matters with many high-resolution cameras, and costs run per camera per month for as long as you use it. Check where the data is stored and who can reach it.
• On-camera recording. A memory card in the camera. Rarely the main method, but a useful backup: if the network or recorder drops out, the camera keeps recording and fills the gap.

A resilient commercial system often combines two methods: recording on site for speed and reliability, with cloud or on-camera storage as the second copy.

What drives the cost over five years

The recorder is the number on the quote. The costs that arrive later are:

• Licences and subscriptions. Per-camera licences, annual support agreements and cloud fees all recur.
• Channel and licence limits. When an NVR or licence tier is full, adding one camera or one site triggers a bigger purchase than the camera itself.
• Storage. The retention period, resolution, frame rate and compression set how much storage you need. Newer compression (H.265) can cut storage substantially against H.264 at similar image quality, where the cameras and recorder both support it.
• End of support. Once a recorder or VMS version stops getting firmware and security updates, it is a risk on your network and a forced replacement on someone else’s timeline.

Our article on comparing security quotes works through how to put a five-year number on each of these.

How long to keep footage

The Privacy Act 2020 does not set a number of days. Information privacy principle 9 says personal information must not be kept for longer than it is needed for the purpose it was collected for. The Privacy Commissioner’s CCTV guidance says to set a retention period no longer than necessary to achieve that purpose. In practice:

• Pick a period for each system, write down why, and set the recorder to delete automatically when it is reached.
• Base it on how long it takes you to find out something happened. A site that finds stock losses at a monthly count needs a longer period than one where incidents are noticed the same day.
• Keep pulled clips separately. Footage exported for an incident, an insurance claim or Police is kept for as long as that matter is open, with a note of why.
• Check for other requirements. If an audit, a contract or your insurer sets its own retention requirement, record it as part of your purpose.

Getting footage to Police, insurers and auditors

Footage only helps if it can be found and handed over quickly, in a form that holds up. Before you need it, check:

• The clock. Every recorder and camera is synchronised to the correct time, so timestamps match across cameras and sites.
• Search. You can find an incident by time and camera and, where analytics are on, by type of event, without scrolling through hours of video.
• Export. Footage exports in its original format with a player, and the export records who made it and when.
• The access log. The Privacy Commissioner’s guidance asks you to log access to footage by people outside the business, including Police.
• People. More than one person knows how to do all of this.

The difference is large in practice. At Carterton District Council, footage requests from Police took 2 to 3 hours on the old system, and camera uptime was about 74%, with cameras dropping off an ageing wireless network. On the new Wisenet WAVE platform, with the wireless links replaced, requests take under 20 minutes and camera uptime is 98.5%. At Medifab, checking an event fell from about 2 hours to 20 to 30 minutes.

Five checks on your recording

1. Find out what records each site: NVR, VMS, cloud or a mix, and whether any of it is near the end of its support.
2. Check the retention period set on each recorder, and whether anyone chose it.
3. Check the headroom: how many cameras can you add before the next licence or recorder purchase?
4. Pick an incident from last week at random and time how long it takes to export the clip. Over 30 minutes is a gap worth closing.
5. Check what happens if the recorder is stolen or fails: is there a second copy of the footage?

How Blue Eagle handles it

We design recording around how the footage will be used: how fast it has to be found, who needs it, and how long it has to be kept. Storage and licences are sized to that, with room for the next site. Our planned maintenance includes firmware and software updates, image quality checks, and reporting on hardware approaching end of life, so replacement lands in your capital plan rather than as an emergency.