POPIA and your home security cameras

Home CCTV is not automatically exempt from POPIA — it depends on where your cameras point and what you do with the footage. Here is the practical version.

The starting point: footage is personal information

The Protection of Personal Information Act (POPIA), fully in force since 1 July 2021, governs the processing of personal information about identifiable people. Video of a recognisable person is personal information, and recording it is "processing". So the Act is in the room the moment you install a camera.

The household exemption — and its edge

POPIA does not apply to processing carried out "in the course of a purely personal or household activity". A camera watching your own front door, inside your own boundary, for your own security, sits comfortably inside that.

The exemption gets thinner as your camera sees further out. Commonly raised situations:

• Pointed at the public pavement or road — you are now capturing people going about their business who have nothing to do with your household.
• Overlooking a neighbour's yard, windows or entrance — the most frequent source of real disputes.
• Covering a shared driveway or complex common area — often better handled by the body corporate than by an individual owner.
• Any business use — a home office with clients, a guesthouse, a workshop — the household exemption is not designed for this.

"Purely" is doing real work in that phrase. The further your view extends beyond your own property, the less safe it is to assume the exemption covers you.

Six practical steps

1. Point cameras inward. Aim at your own property. Where a camera must overlook a boundary, mask or crop the parts you don't need — most cameras and any decent detection system can do this in software.
2. Put up a notice. A simple visible sign at the entrance saying the premises are under CCTV surveillance, with a way to contact you, is cheap and does a lot of work.
3. Keep footage only as long as you need it. Indefinite retention is hard to justify. A defined window — two weeks, thirty days — that deletes automatically is far more defensible than a drive that overwrites whenever it happens to fill.
4. Secure it. Change default camera passwords, don't expose the recorder to the internet with port forwarding, and keep the app locked. A breach of your footage is your problem, not the camera brand's.
5. Think before sharing. Posting a clip of an identifiable person on a neighbourhood WhatsApp group or Facebook is a different act from keeping it for security. Handing it to SAPS or your insurer is ordinary; broadcasting it is where people get into difficulty — including defamation, quite apart from POPIA.
6. Handle requests reasonably. If a neighbour asks what your camera sees, a calm conversation and a screenshot of the view usually resolves it. Most disputes are about perceived surveillance, not actual footage.

What this means for AI detection

Adding analytics doesn't change the legal position of the cameras — but where the processing happens matters practically:

• On-premises processing means your video never leaves your property, so there is no third party holding it and no cross-border transfer question to answer.
• Cloud processing means a provider is processing personal information on your behalf. That is entirely lawful, but you are relying on their security and retention practices, and you should know where the servers are.
• Zones help here too. Restricting detection to your driveway rather than the whole frame reduces what is analysed and stored, which is exactly the data-minimisation instinct POPIA rewards.