Does Your Complex’s CCTV System Infringe on Your Privacy or POPIA Rights?

In many sectional title schemes and residential complexes, CCTV systems have become standard practice. Cameras monitor entrances, parking areas, pedestrian gates, common property and perimeter fences to improve security and assist with incident investigations.

A common question raised by residents is:

“Does the Body Corporate’s CCTV system violate my privacy or my rights under POPIA?”

The short answer is: not necessarily.

Under South African law, a Body Corporate may lawfully operate a CCTV system, provided it is done correctly, proportionately and in compliance with applicable legislation.

CCTV and POPIA: Understanding the Legal Position

The Protection of Personal Information Act, commonly known as POPIA, regulates how personal information is collected, stored, processed and shared.

Video footage that identifies individuals, vehicles, visitors or residents may constitute personal information under POPIA.

Importantly, POPIA does not prohibit CCTV systems. Instead, it regulates:

• why footage is collected;
• how it is used;
• who may access it;
• how long it is retained; and
• whether the surveillance is reasonable and lawful.

A Body Corporate also has obligations under sectional title legislation and the Prescribed Management Rules to manage and protect common property. This means trustees are often expected to implement reasonable security measures where the risk justifies it.

When CCTV Is Generally Lawful

A Body Corporate CCTV system is typically considered lawful and reasonable where it is used for legitimate security purposes such as:

• monitoring common property;
• preventing crime and vandalism;
• investigating incidents;
• managing access control;
• protecting residents and visitors; and
• monitoring perimeter security.

Examples of appropriate CCTV coverage areas may include:

• vehicle entrances;
• pedestrian gates;
• parking areas;
• shared passages;
• boundary walls;
• lift lobbies; and
• refuse or utility areas.

In these situations, CCTV is usually viewed as a legitimate operational and security tool.

When Privacy Concerns Start Arising

Problems generally arise when surveillance becomes excessive, uncontrolled or misused.

Cameras Pointed Into Private Areas

A camera directed into private spaces may create legitimate privacy concerns, especially where it records or monitors:

• a resident’s unit;
• bedroom windows;
• private balcony areas; or
• exclusive-use courtyards.

CCTV should generally be positioned to monitor common property and security-relevant areas, not to intrude unnecessarily into private living spaces.

Uncontrolled Sharing of Footage

One of the biggest POPIA risks in complexes is not always the camera system itself, but the misuse of recorded footage.

Examples of poor practice include:

• sharing footage on resident WhatsApp groups;
• uploading clips to Facebook or other social media platforms;
• allowing guards, contractors or residents to access footage without authority; and
• providing footage informally without a proper request process.

Even where footage was lawfully collected, improper disclosure can still create liability and privacy concerns.

No Governance or Policies

Many schemes install CCTV systems but fail to implement proper governance around the system.

This may include failing to have:

• a CCTV policy;
• an access procedure;
• a defined retention period;
• POPIA notices;
• trustee controls; and
• a record of who accessed footage and why.

This creates unnecessary legal, operational and reputational risk for the Body Corporate.

Do Residents Have Rights Regarding CCTV Footage?

Yes. Residents remain data subjects under POPIA and retain certain rights.

Depending on the circumstances, a resident may:

• request access to footage where they are identifiable;
• ask how footage is stored and used;
• raise objections to unreasonable surveillance;
• lodge complaints regarding misuse; and
• query retention periods and access controls.

However, this does not mean residents automatically have unrestricted access to all footage.

The Body Corporate must also consider:

• other residents’ privacy;
• ongoing investigations;
• security risks;
• third-party rights; and
• POPIA limitations.

Practical Example

Consider the following scenario:

A resident’s vehicle is damaged in the parking area overnight. The resident requests CCTV footage to determine who entered the area, whether another resident caused the damage, or whether suspicious activity occurred.

In most cases, the Body Corporate may lawfully review the footage and assist with the investigation, provided this is done through a controlled process.

By contrast, simply posting footage of another resident, child, visitor or contractor onto a public WhatsApp group may create serious POPIA and privacy concerns.

What Every Body Corporate Should Have

To reduce disputes and improve compliance, every scheme operating CCTV should ideally maintain the following:

1. A CCTV Policy

This should cover:

• the purpose of the system;
• camera locations;
• retention periods;
• who may access footage; and
• how footage may be disclosed.

2. POPIA Notices and Signage

Residents and visitors should be informed that:

• CCTV monitoring is in operation;
• footage may be recorded; and
• the purpose relates to security, safety and incident investigation.

3. A Formal Footage Request Procedure

Requests for footage should be documented and assessed properly rather than handled informally.

4. Controlled Access to Recordings

Access should generally be limited to authorised persons such as:

• trustees;
• managing agents;
• authorised security personnel;
• approved service providers; and
• law enforcement, where legally required or appropriate.

5. Reasonable Retention Periods

Footage should not be retained indefinitely without justification.

Most systems typically retain footage for:

• 7 days;
• 14 days; or
• 30 days;

depending on storage capacity, system design and operational requirements.

The Reality in Residential Complexes

In practice, most residents expect some form of CCTV monitoring in modern residential complexes.

The issue is therefore usually not:

“Can the Body Corporate install CCTV?”

but rather:

“Is the system being managed responsibly and lawfully?”

A properly managed CCTV system can:

• improve resident safety;
• assist with investigations;
• reduce false allegations;
• support access control management; and
• deter opportunistic crime.

However, poor governance can quickly create disputes and liability exposure.

How Prestige Access & Security Solutions Assists Complexes

Prestige Access & Security Solutions assists residential complexes, estates, body corporates and commercial properties with practical security solutions, including:

• CCTV system design;
• POPIA-conscious camera placement;
• AI surveillance systems;
• access control integration;
• remote access management;
• security infrastructure upgrades;
• trustee and Body Corporate support; and
• CCTV policy guidance and operational procedures.

We understand the operational realities trustees face when balancing:

• security requirements;
• resident expectations;
• POPIA compliance;
• budget constraints; and
• incident investigations.

Final Thoughts

A Body Corporate CCTV system does not automatically violate privacy rights or POPIA.

In most cases, CCTV is lawful where:

• there is a legitimate security purpose;
• surveillance is reasonable;
• access is controlled; and
• footage is handled responsibly.

The real risk usually lies in poor governance, uncontrolled sharing of footage, or excessive surveillance practices.

As CCTV systems become more advanced and more common in residential schemes, proper management and compliance become increasingly important.