Most people installing a CCTV camera in India think there’s one law that covers it. There isn’t. Not even close.
It’s actually a patchwork — IT law, criminal law, a privacy judgment from 2017, and a data protection act that’s still finding its feet. I’ve seen shop owners and society secretaries assume that owning the camera means they can point it wherever, whenever. That assumption is exactly what gets people in trouble. Sometimes they don’t even realize it until someone files a complaint.
So let’s actually go through what applies. Not the textbook version — the version that matters when you’re the one setting up the system.
It starts with Puttaswamy, not with CCTV at all
Back in 2017, the Supreme Court ruled in Justice K.S. Puttaswamy v. Union of India that privacy is a fundamental right under Article 21. Doesn’t sound like a surveillance case. It wasn’t, technically. But every camera law that came after leans on this judgment, whether it says so or not.
If a camera records someone in a place they’d reasonably expect privacy, and there’s no real reason for it being there — that’s now a constitutional problem, not just an awkward one.
IT Act, 2000 — the old workhorse
Section 43A and Section 72A still do a lot of the heavy lifting here. Footage counts as data under this Act, which honestly surprises people the first time they hear it.
- Section 43A makes companies liable if they don’t keep “reasonable security practices” around sensitive data — and yes, your CCTV recordings fall into that bucket.
- Section 72A penalizes sharing personal info without authorization, once it’s been collected under some kind of lawful contract.
Translation: if your footage gets leaked, or an employee shares a clip they shouldn’t have, that’s not just bad optics. That’s a legal exposure.
BNS Section 77 — voyeurism, and it used to be IPC 354C
The Bharatiya Nyaya Sanhita replaced the IPC in 2023. Section 77 covers voyeurism now — watching or filming a woman in a private act where she’d expect not to be observed.
A few things worth knowing here, not the obvious stuff:
- Saying yes to being filmed isn’t the same as saying yes to that footage being forwarded around. Courts treat those as two separate acts.
- Washrooms, changing rooms — no defense exists for a camera there. None.
- There’s actually a recent Supreme Court case, Tuhin Kumar Biswas v. State of West Bengal, where the Court said filming during a property dispute — not a private act — didn’t qualify as voyeurism. So the law isn’t as broad as people assume. It’s specific. Deliberately so.
DPDP Act and the Rules — this is the one to actually watch
The Digital Personal Data Protection Act, 2023 is India’s first real data protection law. The rules under it have been finalized, and — here’s the part most blog posts about this topic completely skip — the government has confirmed AI-enabled CCTV, including facial recognition systems, falls under DPDP too.
That changes things. If your camera system does any kind of recognition, not just recording:
- You need a lawful reason for processing that data. Not a vague one. An actual one.
- Purpose limitation applies — footage collected for security can’t just get repurposed because someone found a use for it later.
- The Data Protection Board can step in on breaches, and penalties scale up depending on how bad it is.
I keep coming back to this point because most people setting up commercial CCTV think “recognition features” is a marketing checkbox. It’s not. It’s a compliance category now.
Where the line actually sits — public vs. private
| Space | Generally Permitted | Legally Risky |
| Entrances, parking, common corridors | Yes, with visible signage | — |
| Office floors, shop floors, warehouses | Yes, for security purposes | Covert audio without disclosure |
| Washrooms, changing rooms, private cabins | — | Always off-limits |
| Neighbour’s property, windows facing it | — | Invites privacy complaints |
| Employee desks with audio recording | Depends, case by case | Often challenged under labour rules |
This table isn’t the whole picture — nothing this short is — but it covers where disputes actually start. Not from having cameras. From where they’re aimed.
What this actually means day-to-day
A few things I’d tell anyone setting this up, not theory:
- Put up signage. Every entrance, every angle that’s active. Covert filming is nearly impossible to defend, even with good intentions behind it.
- Keep footage access to a small group. Log who views what and when — a simple register works, doesn’t need to be fancy.
- Decide a retention window and stick to it. Footage sitting around for a year with no reason is exactly the kind of thing that turns a minor incident into a bigger one.
- Skip audio recording unless there’s a specific, disclosed reason for it. Audio gets scrutinized harder than video, always has.
- If there’s any facial recognition or analytics layer running — treat that footage differently. It’s not the same category as plain video anymore.
None of this is really about stopping people from using CCTV — cameras are everywhere in Indian cities now, and for good reason, mostly. What the law’s actually pushing toward is accountability. Why is the camera there. Who can see what it records. How long does that footage stick around before it’s gone.
Get that part right early, and honestly, most of the legal risk just — goes away. Not entirely. But mostly.
For anyone setting up a system and wanting it done properly the first time — CCTV Installation Mumbai.