AI CCTV and DPDP Compliance in India: What Businesses Must Do Before 2027

From 13 May 2027, every business in India that runs AI-enabled CCTV must protect that footage the way a bank protects account data, or face penalties of up to ₹250 crore. In April 2026, the government told Parliament that AI-enabled CCTV cameras are covered by the Digital Personal Data Protection (DPDP) Rules. A month earlier, a spy ring busted in Ghaziabad was found to have tapped unsecured CCTV feeds, and the Home Ministry ordered a pan-India audit of camera networks. At Adiance, we see one lesson in both stories. DPDP compliance for CCTV puts the legal duty on the business that installs and operates the cameras. Whether that business can actually meet its data protection and CCTV security obligations depends on how the camera and video platform were built. Privacy cannot be added after installation; it has to be designed into the surveillance system from the factory.

What Does DPDP Mean for CCTV?

CCTV footage can contain identifiable people and may therefore constitute personal data. The business that decides where cameras go, why they record and how long footage is kept is the Data Fiduciary. Camera makers and installers are not fiduciaries just because they supply equipment. A cloud platform that stores CCTV footage on your behalf is a Data Processor, and you stay responsible for what it does.

The DPDP Rules, 2025 were notified on 13 November 2025 and come into force in phases. The obligations that matter most for CCTV data privacy and security start on 13 May 2027.

Rule 6, security safeguards. Encryption or masking of personal data, access control, logs with monitoring and review, backups, and a contract with your processor that commits it to the same safeguards. Access logs must be kept for one year.

Rule 7, breach intimation. Notify affected people and the Data Protection Board without delay, then send the Board a detailed report within 72 hours.

Penalties. Up to ₹250 crore for failing to take reasonable security safeguards, enforced by the Data Protection Board.

The hardware rules arrived first. Since 1 April 2026, CCTV cameras that do not meet MeitY's Essential Requirements cannot be sold in India. DPDP now adds rules for how the personal data and video footage produced by those cameras are handled.

Does DPDP Apply to CCTV in India?

Yes. CCTV footage can fall within India's digital personal data protection framework when it contains information that can identify an individual. For businesses using CCTV, DPDP compliance therefore involves more than installing secure cameras. Businesses should also consider how surveillance footage is collected, processed, stored, accessed, retained and protected.

Why AI CCTV Raises the Stakes

A plain CCTV camera records video that someone may watch later. An AI CCTV camera turns that video into structured data: faces matched, vehicles read, people counted and tracked, and events tagged. Natural-language search lets an operator find one person across weeks of CCTV footage in seconds.

This is what makes AI surveillance useful, and it is also what makes a breach worse. A leaked recording is a privacy problem. A leaked index of who came, when and with whom is a much bigger one. It also means more people and systems touch the data, so CCTV access control, cybersecurity and audit logs matter more.

Consent is the hard part. Lawyers point out that collecting individual consent in a busy mall, factory or campus is not practical, and the Act has no specific mechanism for CCTV. That is all the more reason to get the parts that are under your control right: clear notices at entry points, a defined purpose, limited retention, and strong CCTV data security.

The Adiance View: DPDP Compliance Is Built In at the Factory

The DPDP duty sits with you, but most of the safeguards Rule 6 asks for have to come from the equipment and software you buy. If a camera ships with a shared default password or sends video unencrypted, no policy document will fix it. So we design for compliance at three layers.

1. The Camera

Adiance and ArcisAI cameras are BIS-ER registered (R-72003735, ER01:2024). That means no default passwords, encrypted video streams, secure boot with signed firmware, debug ports disabled, and disclosed chipset origin.

We build on non-Chinese SoCs (Qualcomm, Ambarella, Novatek, Sigmastar) and design the PCB and firmware in-house in India. When a vulnerability appears, we can patch it ourselves.

2. The Platform

ArcisAI Cloud VMS is STQC certified. Streams and recordings are encrypted end to end. Role-based access control decides who sees which cameras. Every action, alert and playback is logged for audit.

ArcisAI is ISO 27001:2022 certified.

3. The AI

S-Series edge AI cameras run analytics on the device. Heavier analytics, such as ANPR, run in ArcisAI Cloud AI. Either way, AI results and natural-language search sit inside the same access controls and audit logs as the video.

How Does Adiance's CCTV Technology Map to DPDP Rule 6?

Encryption of personal data: Adiance uses encrypted streams from the camera and end-to-end encrypted storage in Cloud VMS.

Access control: Unique device credentials and role-based access are used across the VMS and app.

Logs, monitoring and review: An audit log records actions, alerts and playback activity.

Backup and continuity: Cloud storage can scale without on-site servers, while an NVR option is available for on-premise deployments.

Processor safeguards: STQC-certified VMS and ISO 27001 processes support appropriate contractual safeguards.

Technical and organisational measures: Secure boot, signed firmware, in-house patching and a disclosed supply chain support the security architecture.

Your CCTV DPDP Compliance Checklist Before 13 May 2027

Businesses using CCTV in India can use the following checklist to review their surveillance infrastructure and data protection practices.

1. Map Every Camera

List each camera, its location, its brand and model, and who can view it. The MHA audit after the Ghaziabad case shows that unaccounted cameras are now a security risk, not just an admin gap.

2. Check CCTV Certification

Confirm that each model is BIS-ER registered and that your VMS is STQC certified. Search the R-number on crsbis.in or use the ArcisAI certificate verifier.

3. Write Down the Purpose

Security, safety, loss prevention or operations. Turn on AI features such as face matching only where that purpose needs them.

4. Put Up Clear Notices

Signs at entry points saying that CCTV and AI analytics are in use, why, and who to contact.

5. Set CCTV Retention

Decide how long footage is kept for each purpose, set it in the VMS, and delete on schedule. Keep access logs for at least one year.

6. Lock Down CCTV Access

Use unique accounts, role-based permissions, no shared logins, and an audit log of every playback and export.

7. Encrypt CCTV Data End to End

Protect video from the camera to the recorder, cloud and mobile app through appropriate encryption and security controls.

8. Plan for a Data Breach

Name an owner, prepare notices for affected people, and make sure you can send the Board a detailed report within 72 hours.

9. Sign the Right Contracts

Your cloud VMS provider and installer must commit in writing to the same security safeguards.

10. Replace What Cannot Comply

A camera that cannot be patched or encrypted is a liability. Phase it out before the deadline, not after a breach.

For Integrators and Brand Partners: CCTV Compliance Is the Product

Over the next seven months, every enterprise, hospital, school, bank and retailer you serve will be asking the same question:

"Is our CCTV DPDP-ready?"

Partners who can say yes, with certificates and audit logs to back it, will win those renewals and upgrades.

Adiance gives partners a full stack that is compliant from the start: BIS-ER cameras, STQC-certified Cloud VMS, a mobile app, and AI, all available under your own brand.

For sites with existing ONVIF cameras that are still sound, the Arcis Bridge Device connects them to the same cloud platform, its access controls and its audit trail.