India Factory CCTV Compliance Calendar 2026: Every Deadline in One Place

There is no single "factory CCTV law" in India with one deadline. There are four separate regimes — a camera-certification ban, the OSH Code that replaced the Factories Act, the DPDP data-protection rollout, and state-by-state women's-night-shift rules — each on its own clock, run by a different ministry. This page pulls every dated obligation into one calendar, links each to its primary source, and is honest about the dates that are still "awaited" or that only exist state by state. Two dates already passed (the sale ban on 1 April 2026 and the OSH Code on 21 November 2025); the big one still ahead is DPDP's full compliance phase in May 2027.

If you run a 200–1000 worker plant somewhere between Coimbatore and Ludhiana, the problem is not that the rules are harsh. It is that they are scattered across MeitY, the Ministry of Labour, and your own state's factory inspectorate, and every installer WhatsApp forward mashes them into one panicked "replace everything by April." This is the calendar we keep for our own scoping work. Use it to see what has actually bitten, what is coming, and — just as important — where a confidently-quoted "deadline" turns out not to exist.

Key points

• Four regimes, four clocks. Camera certification (MeitY/STQC), workplace safety (OSH Code 2020), data protection (DPDP), and women's night-shift permissions (each state). They do not share a deadline and they are not enforced by the same people.
• The camera sale ban is already live. From 1 April 2026, no internet-connected CCTV camera can be sold in India without STQC/BIS Essential Requirements (ER) certification. It binds manufacture, import and sale — not the cameras already on your wall.
• There is no by-name "Hikvision/Dahua ban" notification. The effective block on Chinese cameras runs through the ER certification regime, not through a separate order naming those companies. Government/critical procurement carries an additional, older restriction on land-border-country bidders.
• The Factories Act 1948 is gone. The OSH Code 2020 came into force on 21 November 2025; the OSH (Central) Rules were notified 8 May 2026. CCTV appears there only inside the women's-night-shift package.
• DPDP is the deadline still ahead. Full data-protection duties on your footage — notice, purpose, retention, security, breach reporting — bite in the third phase, around 14 May 2027. There is no headcount threshold: a single-shed unit is a full data fiduciary.
• Women's night-shift CCTV is state law, not central. Maharashtra, Gujarat, Karnataka and others have each notified their own conditions and retention windows on their own dates. There is no single national date.
• Some "deadlines" do not exist. There is no all-India Fire-NOC CCTV date and no blanket FSSAI CCTV mandate. We mark those honestly rather than invent one.

⚠️ This is a reference, not legal advice. Laws, notification numbers and dates change, and several items below are administered state by state. Verify every date against the primary source linked in its row, and confirm your own position with a qualified compliance advisor before you rely on it commercially.

The master calendar

Dates are given as notified. Rows are ordered by the date the obligation takes (or took) effect. "Applies to" separates the genuinely universal rules from the ones that only bite government buyers or specific states.

Regime 1 — the camera certification "ban" (MeitY / STQC / BIS)

This is the one every installer is calling you about, and it is the most misunderstood.

What is actually true: from 1 April 2026, an internet-connected CCTV camera or recorder cannot be legally sold in India unless the specific model carries BIS CRS registration under IS 13252 (electrical/fire safety) and STQC certification against the Essential Requirements (the cybersecurity layer notified by gazette Order S.O. 1652(E) on 9 April 2024). The MeitY Office Memorandum of 16 January 2026 withdrew the last relaxation for old stock, and there has been no further extension. Certification is granted per model and per firmware build, not per brand — a "CP Plus quotation" proves nothing until the exact SKU resolves on the registry.

What is a myth: that there is a standalone government order naming Hikvision, Dahua or TP-Link and banning them from critical infrastructure on 1 April 2026. There is no such by-name notification. The effect — most Chinese-chipset lines are not certified and therefore cannot be sold — is a consequence of the ER regime, not a separate ban. Reporting that says "India bans Chinese CCTV from 1 April" is describing the certification rule, correctly in substance but loosely in form. Treat the ER regime as the operative law.

The extra layer for government work: if you supply or bid public tenders, a separate and older restriction applies — the 23 July 2020 public-procurement order requiring bidders from land-border countries to register with the DPIIT Registration Committee and clear MEA/MHA. That, plus the February 2026 linkage of STQC ER test reports to the Make-in-India procurement order, is what actually keeps Chinese vendors out of government/critical projects. A purely private plant is not bound by the procurement order.

What it does not do: it does not force you to rip out working cameras. There is no retrospective clause and no inspection regime aimed at owners for holding older installed cameras. The rule bites the next time you buy. Analogue cameras are exempt from the security ER entirely (they still carry BIS safety registration). See do I have to replace my factory CCTV in 2026?, the deeper dive in BIS/STQC 2026 for factory cameras, and the certified-brand comparison in best Hikvision & Dahua alternatives.

Regime 2 — workplace safety (OSH Code 2020, not the Factories Act)

The Factories Act 1948 was repealed on 21 November 2025, when the four Labour Codes were brought into force; the OSH Code 2020 subsumed it along with 12 other central laws. The OSH (Central) Rules were notified on 8 May 2026. For cameras, the Code itself is nearly silent — the one place CCTV appears is inside the conditions for employing women on night shifts (Regime 4 below).

Two practical consequences for an owner:

1. Stop citing the Factories Act in the present tense. Any vendor page quoting "Section 66" as live law is stale. We keep our older Factories Act explainer online only as clearly-marked history; the current position is in the OSH Code 2020 and factory CCTV.
2. Your operative rulebook is your state's OSH rules, once notified — not the Central Rules — unless you are a central-sphere establishment. States are notifying on their own timelines through 2026, so labour is genuinely in transition. Confirm your own state's status directly.

CCTV is not a general safety requirement under the Code. A vendor claiming the OSH Code mandates cameras on every production line is overclaiming — see is CCTV mandatory in Indian factories?.

Regime 3 — data protection (DPDP), the deadline still ahead

Video of a recognisable worker is personal data under the Digital Personal Data Protection Act, 2023. There is no headcount or turnover threshold — a single-shed unit is a full data fiduciary, and the compliance duty lands on the factory, not on your CCTV vendor or AMC contractor.

The DPDP Rules 2025 commence in three phases:

• 13 November 2025 (Phase 1): Data Protection Board constituted, definitions and procedure live, complaints can be filed.
• 14 November 2026 (Phase 2): Consent Manager registration opens; enforcement and penalty machinery operative.
• ~14 May 2027 (Phase 3): full compliance — notice/consent, data-principal rights, security safeguards, breach reporting, retention & deletion, children's data, and cross-border transfer under Section 16 / Rule 15.

Phase 3 is the date that matters for your footage. By then you need CCTV signage, one written purpose, data minimisation (cameras on machines and lanes, off rest rooms and private areas), a capped retention window with auto-overwrite, and a locked-down NVR with role-based access. The penalty ceiling for failing reasonable security safeguards is ₹250 crore. The operational how-to is in DPDP and worker CCTV, the notice wording in worker CCTV privacy notice under DPDP, and the retention question in how long to keep footage.

Date nuance — 13 vs 14 May 2027. The Rules' commencement clause dates Phase 3 to 18 months after the 13 November 2025 notification, which most trackers read as 14 May 2027. Some advisers count from the 14 November 2025 effective date and cite 14 May 2027. The one-day gap does not change your work — plan to be compliant before mid-May 2027 — but do not treat either date as gospel until you see it confirmed against the gazette.

Regime 4 — women on the night shift (state law, no national date)

The OSH Code (s.43) permits women to work nights everywhere in India with consent; the OSH Central Rules 2026 put CCTV inside the safeguard package. But because labour is a Concurrent-List subject, the operative conditions — including retention length — are set state by state, each on its own notification date. There is no single national deadline.

We maintain the fuller, dated version of this table in which Indian states require CCTV to run women at night, with the operational placement detail (where the cameras go, and where they must not) in running women on the night shift and the Maharashtra specifics in the Maharashtra women night-shift CCTV guide.

Deadlines that people quote but that do not exist

Being honest about the absence of a date is part of what makes a calendar trustworthy.

• All-India Fire-NOC CCTV date — none. Fire safety is administered by state fire-services acts and the National Building Code; there is no national CCTV mandate or single renewal date. NOC renewal cycles are state-specific (commonly annual, but verify your state). See Fire NOC for an Indian factory and cameras. Status: state-dependent / ongoing.
• Blanket FSSAI CCTV mandate — none found. We could locate no general FSSAI direction requiring cameras in food factories; Schedule 4 mandates practices, and cameras are how you evidence them, not a legal box with a date. See cameras in food-processing plants: FSSAI. Status: no fixed date.
• Factory-licence renewal — no national date. Renewal cycles are set by each state's factory rules, not by a central calendar. Status: state-dependent.
• A named "Hikvision/Dahua ban" order dated 1 Apr 2026 — does not exist as a standalone notification. The block operates through the ER certification regime (above). Status: reframed, not a separate deadline.

Putting the calendar to work

Bring it down to four questions, in this order:

1. Buying a new camera this year? Then the 1 April 2026 ER rule applies to that purchase — certified SKU only. Installed cameras are fine.
2. Running (or planning) women at night? Then your state's rule sets your CCTV coverage and retention — find your row above and confirm it locally.
3. Filming identifiable workers? Then DPDP Phase 3 (~May 2027) is your real deadline — signage, purpose, retention cap, locked NVR.
4. Bidding government work? Then the procurement restriction and STQC ER test reports apply on top.

The complete step-by-step sits in the India factory camera compliance playbook 2026, and the one-page tick-list in the factory CCTV compliance checklist. Compliance decides what you may buy and how long you keep footage; it never answers how many cameras and where. Record a two-minute phone walk of your floor and Mama returns a placement plan — count, mounting, zones and hazards — plus a plain-language read of the space.

FAQ

Is there one factory CCTV law in India with a single deadline? No. Four separate regimes touch factory cameras — camera certification (MeitY/STQC, live 1 April 2026), workplace safety (OSH Code 2020, in force 21 November 2025), data protection (DPDP, full compliance ~14 May 2027), and women's night-shift conditions (each state, various dates). They are run by different authorities and do not share a deadline.

Are Hikvision and Dahua banned in India from 1 April 2026? Not by a notification naming them. From 1 April 2026 any internet-connected camera that lacks STQC/ER certification cannot be sold, and most Chinese-chipset Hikvision/Dahua lines are not certified — so they are effectively out of legal sale. But it is a certification rule, not a by-name ban, and it targets new sales, not cameras already installed on your wall.

Do I have to replace my existing factory cameras by any of these dates? No. None of these regimes forces removal of working, installed cameras. The certification rule binds manufacture, import and sale; DPDP governs how you handle footage, not what hardware you own. You are forced to buy certified only when you next purchase, expand or bid a tender that requires it.

What is the real DPDP deadline for a factory? The third phase, around 14 May 2027 (18 months after the 13 November 2025 Rules notification; some advisers cite 14 May). That is when notice/consent, retention limits, security safeguards and breach reporting become fully enforceable on the worker footage you capture. There is no headcount threshold — every factory that films identifiable workers is covered.

Which states require CCTV to run women on the night shift, and for how long must I keep footage? Maharashtra, Gujarat and Karnataka confirm a ~45-day retention window scoped to the women's shift; Haryana, UP, Rajasthan and Tamil Nadu require cameras but we could not confirm a specific retention figure — ask your factory inspectorate. The dated table above and our state tracker carry the detail.

Is CCTV required by the OSH Code or by FSSAI or fire rules? The OSH Code only requires CCTV inside the women's-night-shift package, not as a general safety rule. We found no blanket FSSAI CCTV mandate and no all-India Fire-NOC CCTV date. Anyone quoting one of those as a hard deadline is overclaiming.

Related reading: BIS/STQC 2026 for factory cameras · Do I have to replace my CCTV in 2026? · DPDP and worker CCTV · The OSH Code 2020 and factory CCTV · States requiring CCTV for women's night shifts · The India factory camera compliance playbook 2026.

Last verified 9 September 2026. Camera-certification dates checked against the BIS CRS CCTV implementation guidelines and MeitY Office Memorandum reporting; OSH Code and Central Rules against the India Code text and SCC Online; DPDP phasing against the PIB release and AZB Partners' phased-rollout note; women's night-shift entries against the cited state notifications and law-firm alerts; the public-procurement restriction against the 23 July 2020 PIB release. Several items are administered state by state and change frequently. This page is a reference, not legal advice — confirm each date against its primary source and with your own compliance advisor before relying on it.