A CCTV system can protect the estate — but if access is poorly controlled, it can also expose personal data.
For condominiums and strata properties, CCTV is often treated as a security tool. But under PDPC’s MCST guidelines, CCTV footage may contain personal data, and MCSTs should have retention policies for personal data captured in CCTV footage.
CCTV is not only a security issue. It is also a PDPA and data access issue.
The Two Risks MCSTs Must Manage
Privacy Risk:
Who can view CCTV footage?
When can footage be shared?
How long is it kept?
Can residents or third parties request access?
Is there a process for approval?
Cybersecurity risk:
Are CCTV accounts protected by strong passwords?
Are admin accounts shared?
Is vendor access reviewed?
Are cloud platforms secured?
Is footage being sent through WhatsApp or personal email?
When either side is weak, the estate may face unnecessary exposure.
Why This Matters in Singapore
A Singapore MCST case shows the risk clearly. In August 2025, PDPC announced a case involving a public request for CCTV footage, where the organization was found in breach of the PDPA Accountability Obligation for failing to appoint a DPO and for not having policies to handle access requests or manage third-party access to CCTV systems.
The lesson: MCSTs should not wait for a CCTV request or complaint before deciding who can access footage and how it should be managed.
What MCSTs Should Check
Access control
Limit CCTV access to authorized people only. Avoid shared passwords and remove old vendor accounts.
Retention
Set a clear retention period for CCTV footage and avoid keeping clips longer than necessary.
Sharing rules
Do not send CCTV clips casually through messaging apps, personal email, or unsecured folders.
Vendor oversight
Review CCTV contractors, access system vendors, IT providers, and cloud platforms that may touch resident or visitor data.
Incident readiness
Have a clear response plan if footage, access logs, or resident records are wrongly accessed or disclosed.
Suggested graphic: CCTV Footage → Access Control → Vendor Review → Retention → Incident Response
How Privacy Trust Helps
PrivacyTrust helps MCSTs review both sides of the risk: PDPA compliance and cybersecurity readiness.
This includes CCTV handling, access systems, vendor controls, resident data workflows, retention practices, and breach-response planning.