The myth and the law
“CCTV is illegal under POPIA.”
No provision bans cameras. Footage of identifiable people must simply satisfy the conditions: a lawful ground (typically security as a legitimate interest), signage, minimality and safeguards.
“Personal information may only be processed if, given the purpose for which it is processed, it is adequate, relevant and not excessive.”
Note — Minimality is the provision CCTV most often actually trips over — cameras pointed at far more than the security purpose needs — together with missing signage under s 18. Neither failure makes cameras illegal; both are fixable.
The lawful ground for cameras
Security and crime prevention sit squarely within legitimate interests (s 11(1)(f)) — and footage can also protect the data subjects themselves (s 11(1)(d)): the visitor whose hijacking the gate camera records has no complaint about being filmed. The balancing question is placement and coverage: entrances, tills, perimeters and server rooms balance easily; bathrooms, change rooms and a neighbour’s garden do not.
Signage: the openness duty made visible
CCTV compliance is mostly the openness condition: section 18 requires reasonably practicable steps to make people aware their information is being collected — for cameras, visible signage at the entrances saying the area is under surveillance, naming the responsible party, and pointing to the full privacy notice. A sign is cheap; its absence converts ordinary security into covert monitoring, which is where cameras genuinely get businesses into trouble.
The CCTV compliance checklist
- Ground: security/crime-prevention legitimate interest identified and recorded (s 11(1)(d) and (f))
- Signage at entrances: surveillance disclosed, responsible party named (s 18)
- Placement: cameras cover the risk, not bathrooms, change rooms or neighbouring property (ss 9–10)
- Retention: short rolling overwrite; incident clips preserved as evidence (s 14)
- Access: footage restricted to defined roles; disclosures logged (s 19)
- Operators: monitoring company or armed-response provider under a written s 21 contract
Home cameras and neighbours
A camera protecting your own home for your own household purposes is purely personal or household activity — outside the Act under section 6(1)(a) (see when POPIA applies). Point it permanently into the neighbour’s living room and the household character strains — and ordinary privacy and nuisance law applies regardless of POPIA. In community schemes, the body corporate’s cameras are scheme processing with the full checklist above — see body corporates and HOAs.