The Factory CCTV Compliance Checklist (India, 2026)
In 2026, factory CCTV in India has to clear four separate gates: the OSH (Central) Rules, 2026 wherever women work at night, your state's night-shift conditions, STQC-certified and BIS-registered hardware for anything bought after 1 April 2026, and DPDP-grade notice and retention. No law puts cameras in every plant. Most plants fail on hardware and retention.
This page is written for the owner of a 200–1,000 worker plant in India — Coimbatore, Ludhiana, Pune, Rajkot, Hosur — who has 40 to 120 cameras already on the wall and a consultant or an auditor about to ask questions. Print it, tick the lines, hand it over.
Key points
- The Factories Act, 1948 no longer governs. The Occupational Safety, Health and Working Conditions Code, 2020 came into force on 21 November 2025, along with the other three labour codes, and it consolidates the Factories Act, 1948 with a group of other central labour laws (DLA Piper). If your compliance file still cites Section 66(1)(b) of the old Act as live law, it is out of date — see our update note.
- CCTV is now written into the central rules, not just state exemptions. The OSH (Central) Rules, 2026 — G.S.R. 345(E), notified 8 May 2026 — set conditions for women working before 6 a.m. or after 7 p.m.: written consent, safe pick-up and drop from residence, well-lit entry and exit, toilets and water nearby, CCTV surveillance, displayed emergency numbers, and PoSH compliance (SCC Online summary).
- Your camera hardware can fail an audit even if it works. From 1 April 2026, CCTV cameras that do not meet the notified Essential Requirements — STQC certification alongside BIS registration — cannot be sold in India. The remaining exemptions were withdrawn by a MeitY office memorandum dated 16 January 2026. Details in our BIS/STQC 2026 guide.
- Retention has a trap. Karnataka's night-shift conditions require footage kept at least 45 days — but a PoSH complaint can normally be filed up to three months after an incident, so the evidence can be legally gone before the complaint arrives.
- Data law is a second, slower clock. The DPDP Rules, 2025 were notified on 13 November 2025 and took effect 14 November 2025, with the substantive fiduciary duties — notice, purpose limitation, retention limits, security safeguards — phasing in to May 2027. Penalties for failing reasonable security safeguards run to a ceiling of ₹250 crore.
What actually changed between 2024 and 2026
Three things moved, and they moved in different directions.
Labour law consolidated. The OSH Code took effect 21 November 2025; the Central Rules followed on 8 May 2026. Women's night work is no longer a state-by-state exemption from a prohibition — under the Code women may be employed at all hours with their written consent, subject to prescribed safety conditions. States are still framing their own rules under the Code through 2026, so existing state notifications generally continue to guide practice in the meantime.
Hardware got a border. Surveillance cameras were pulled under the Electronics and IT Goods (Compulsory Registration) Order regime by gazette notification in April 2024, with the Essential Requirements applying to new models from April 2025 and enforcement tightening into a hard 1 April 2026 line on sale.
Data law arrived but has not bitten yet. DPDP obligations phase in over roughly 18 months from November 2025. You have time — but the notice board and the retention policy are cheap to fix now.
The checklist
Tick each line. If it fails, the fix column is the shortest path to closing it.
| # | Line item | What "pass" looks like | If you fail this line, the fix | Signs off |
|---|---|---|---|---|
| 1 | Camera certification | Every model bought after 1 April 2026 has BIS registration + STQC certification against the Essential Requirements | Get the model list off your NVR, request certificates from the vendor in writing, replace uncertified models at next refresh — do not rip out working cameras mid-year | Purchase head + vendor |
| 2 | Coverage of night-shift areas | Lit and covered: gates, entry/exit, pathways, washroom approaches, transport bay, canteen route | Add 4–8 cameras on the walking route, not more cameras on the machines | Safety officer |
| 3 | Retention | The minimum your state names (45 days where confirmed); longer on the areas that generate complaints | Add HDD or a cloud tier before adding cameras; retention beats resolution | IT / systems |
| 4 | Written consent (night shift) | Signed consent from every woman on the roster, refreshed at least annually | Re-issue consent forms in the local language; keep in the HR file, not the security file | HR head |
| 5 | Worker notice | Signage at every entrance and covered zone, in the regional language + English, naming purpose and retention | Print and mount boards this week; cost is a few thousand rupees | HR head |
| 6 | No-camera zones | Zero coverage of washrooms, change rooms, crèche, medical room | Physically re-aim or remove; a single mis-aimed camera is the finding that sinks an audit | Safety officer |
| 7 | Footage access log | Written record of who exported what, when, and why | A ruled register at the NVR is a workable minimum; a shared login with no record is not | Security in-charge |
| 8 | Evidence certificate | A Section 63 BSA certificate template ready, with device particulars and hash | Prepare the template now; producing it months later is what gets footage challenged | Occupier + IT |
| 9 | Transport and escort | Safe pick-up and drop; CCTV/GPS-fitted vehicle, trained driver, female security presence per your state's condition | Contract it; this is a separate obligation and cameras do not substitute for it | Admin |
| 10 | State permission current | Night-shift permission or exemption live, not lapsed | Diary the renewal — Haryana's exemption runs one calendar year | Occupier |
Hardware: the 1 April 2026 line
The rule that catches most plants is not about how you use the camera — it is about which camera you bought.
Essential Requirements for the security of CCTV were notified by gazette in April 2024 under the Electronics and IT Goods (Requirements for Compulsory Registration) Order framework, requiring STQC certification alongside BIS registration, with the existing product standard being IS 13252 (Part 1): 2010 (BIS implementation guidelines, PDF). Requirements applied to new models from April 2025; the remaining exemptions were withdrawn by MeitY office memorandum in January 2026, leaving 1 April 2026 as the date after which non-conforming cameras cannot be sold in India.
Two honest points. First, this restricts sale, not ownership — a working 2022 camera on your wall does not become illegal overnight. Second, buyers on government, defence-adjacent, or export-audit contracts increasingly get asked for the model list anyway, so the practical pressure lands earlier than the legal one.
Retention: the number nobody agrees on
There is no single national CCTV retention period for factories. What exists is a patchwork, and the binding number for you comes from your state's night-shift conditions plus your customers' audit protocol.
| State | Night-shift condition (women) | CCTV specifics |
|---|---|---|
| Karnataka | Batch of not less than 10 women; women ≥ 2/3 of night-shift strength; not less than two female wardens per night shift (notification dated 20 Nov 2019) | Proper lighting and CCTV inside and surrounding the factory; footage maintained ≥ 45 days |
| Haryana | Batch of not less than 4; at least one female security guard on the night shift; doctor or female nurse available; written consent from workers, supervisors and security staff (revised conditions, May 2025) | CCTV inside the factory and in surrounding accessible areas; CCTV and GPS in transport vehicles; exemption valid one calendar year. Haryana revised these conditions more than once during 2025 — confirm the live version |
| Central baseline (all states) | Written consent; safe pick-up and drop from residence; PoSH compliance (OSH Central Rules, 2026) | CCTV surveillance; well-lit entry and exit; toilets and water nearby; emergency numbers displayed at the workplace and inside vehicles |
Now the trap. Karnataka's floor is 45 days. A complaint under the PoSH Act, 2013 is normally to be brought within three months of the incident, and the internal committee may extend that window further. Comply to the letter on storage and the footage that would have cleared your supervisor — or convicted him — is already overwritten.
Our recommendation: 90 days on the gate, transport bay and walking routes; 30 days on production lines. Storage cost is roughly linear in days, so a 90-day tier on 10 perimeter cameras costs far less than a 90-day tier on 90. State-by-state positions are tracked in our state CCTV night-shift tracker, and the records side in our women's night-shift retention checklist.
Notice, consent, and DPDP
Under DPDP, employee monitoring is not automatically consent-based — much processing connected to the employment relationship sits under legitimate uses. But "no consent needed" is not "no obligation." You still owe notice, purpose limitation, security safeguards, and deletion when the purpose ends.
Practically, three artefacts close this: entrance signage naming the purpose and retention period; a one-page CCTV policy in the HR file; and an access log at the recorder. The Rules were notified 13 November 2025 and took effect the next day, with the substantive obligations phasing in to roughly May 2027 — so this is a 2026 housekeeping job, not an emergency. More in our DPDP and worker CCTV note.
Evidence: who signs, and on what
Since 1 July 2024, electronic records have been governed by the Bharatiya Sakshya Adhiniyam, 2023, whose Section 63 replaced Section 65B of the Evidence Act. Footage produced without the original device needs a certificate identifying the record, describing how it was produced, giving device particulars, and — in the form prescribed under the Adhiniyam — signed by the person in charge of the device together with an expert, with the hash value stated.
Translation for an owner: name one person as "person in charge of the device" in writing, keep the NVR clock synced, and export with a hash. Do it before you need it. Certificates assembled after a police complaint are where cases fall apart.
What CCTV does not fix
Be clear-eyed, because this is where vendor checklists lie.
Cameras do not create a defence to a safety prosecution. If a machine had no guard, footage of the accident is evidence against you. Fix the guarding first.
Cameras do not substitute for the human conditions. Under the Central Rules and state notifications, transport, female security presence, batch minimums and consent are separate obligations. A perfect camera grid with no transport still fails.
More cameras can increase your exposure. Recording a washroom approach too tightly, or retaining footage with no policy, converts a security asset into a liability under DPDP and PoSH.
Analytics accuracy is not a compliance claim. No inspector accepts "the AI flagged it." Detection helps you act faster; it does not discharge a statutory duty.
And cameras do not raise output by themselves. They surface what is happening; someone still has to change the shift plan. That is the honest boundary between compliance spend and the productivity case.
No standard in your audit file mandates cameras by itself. Customer audit protocols, IATF, GMP and food-safety schemes ask for traceability and control of process — they do not, as a rule, contain a clause saying "install CCTV." Cameras are one way to evidence a control, not the requirement itself.
FAQ
Is CCTV legally mandatory in Indian factories in 2026? Not universally for every plant. It is mandatory in specific situations: wherever women work between 7 p.m. and 6 a.m., under the OSH (Central) Rules, 2026 and state night-shift conditions, and wherever a sector rule or a customer's audit contract requires it. Many mid-size plants are effectively covered because they run a night shift.
Does the Factories Act, 1948 still apply to my CCTV compliance? No, not as the governing statute. The OSH Code, 2020 came into force on 21 November 2025 and consolidated the Factories Act with other central labour laws. Old state exemption notifications issued under the Factories Act generally continue to guide practice until states notify replacement rules under the Code — but cite the Code and the Rules.
How long must a factory keep CCTV footage in India? There is no single national number. Karnataka's night-shift conditions specify at least 45 days, and Maharashtra and Gujarat land in the same place. Because a PoSH complaint can arrive up to three months after an incident, we recommend 90 days on gates, transport bays and walkways, and 30 days on production lines.
Do I have to replace my existing Hikvision or Dahua cameras by April 2026? No — the rule restricts sale of non-conforming models, not continued use of ones already installed. But new purchases must be STQC-certified and BIS-registered, and government or export-facing buyers may ask for your model list. Plan replacement at refresh, not in panic.
Who signs off on the compliance file? The occupier or factory manager owns it. In practice split it: HR for consent and notice, safety officer for coverage and no-camera zones, IT for retention and hashing, purchase for certificates. One named person must be the "person in charge of the device" for evidence purposes.
What does non-compliance cost? The OSH Code carries fines running into lakhs of rupees, and imprisonment is available where a contravention causes a worker's death — check the current figures in the Code's penalty chapter before quoting a number to your board. Separately, DPDP penalties for failed security safeguards have a ceiling of ₹250 crore, though those obligations phase in through 2027.
This is operational guidance, not legal advice. State rules under the OSH Code are still being framed through 2026 — verify your state's live notification, and the current penalty provisions, before you rely on any figure here.