A retail manager in Mississauga flagged a stock discrepancy during a routine audit. She was fairly sure the shortfall had happened six weeks earlier during a busy weekend shift. She checked the NVR. The footage was gone. Her system was set to a seven-day loop and nobody had ever changed it.
Seven days is a common factory default. It is also wrong for almost every commercial installation in Canada.
Footage retention is one of the most overlooked settings on any commercial CCTV system. Keep footage too short and it disappears before you know you need it. Keep it too long and you run into privacy obligations under Canadian law that most businesses are not set up to meet. The right answer sits in between, and it changes depending on your industry, your insurer, and what your current NVR storage can actually hold.
What Canadian Law Says About CCTV Footage Retention
The primary federal law governing commercial video surveillance in Canada is the Personal Information Protection and Electronic Documents Act, known as PIPEDA. Video footage of identifiable individuals is personal information under PIPEDA, which means collecting it triggers obligations around how long you can keep it and what you must do with it.
PIPEDA does not set a specific retention period in days or months. What it establishes is a principle: personal information should be kept only as long as necessary to fulfill the purpose for which it was collected, and no longer. For commercial CCTV, that purpose is typically security monitoring and incident investigation. Once footage has no reasonable security or investigative value, retaining it creates privacy risk without corresponding benefit.
The Office of the Privacy Commissioner of Canada has published guidance indicating that for most commercial settings, retention beyond 30 days is difficult to justify without a specific, documented reason. The OPC has also found against businesses in complaints where footage was retained indefinitely with no clear retention policy in place.
Three provinces have privacy legislation that applies in place of PIPEDA for provincially regulated businesses: Alberta and British Columbia each have their own Personal Information Protection Acts (PIPA), and Quebec’s Law 25 is currently the strictest private-sector privacy legislation in Canada. If your business operates in any of these provinces, the applicable provincial law governs. The practical retention guidance is similar to the federal framework in all three provinces.
Two Competing Risks Most Businesses Do Not See at the Same Time
Understanding why most businesses get this wrong requires seeing the two competing pressures clearly.
Retaining too little: An incident like a slip and fall, employee theft, break-in, or customer dispute may not surface for days, weeks, or even months. A workplace injury claim can be filed up to two years after the incident in Ontario. A commercial insurance claim involving disputed liability may require footage that is 45 or 60 days old. If your system overwrites footage on a short loop and the footage is gone before you know you need it, the absence of evidence typically works against you, not for you.
Retaining too much: Under PIPEDA, retaining footage of identifiable individuals beyond the period necessary for your stated purpose creates liability. If a privacy complaint is filed and you cannot explain why you still hold footage of someone from eight months ago, you have a compliance problem. Unlimited retention is not a conservative approach. It is an exposure.
The practical answer is a defined retention period that is long enough to cover realistic incident timelines for your industry, short enough to satisfy PIPEDA’s necessity principle, and backed by a clear preservation process for when a specific incident comes to light.
Recommended Retention Periods by Industry
No single Canadian regulation mandates specific retention periods for every industry. The figures below reflect the OPC’s published guidance, common commercial insurance requirements, and the practical timelines within which incidents are typically discovered and reported in each sector.
| Industry | Recommended Minimum | Practical Maximum | Key Reason |
|---|---|---|---|
| General commercial office | 30 days | 60 days | Covers most incident discovery windows. Aligns with standard commercial property insurance expectations. |
| Retail and hospitality | 30 days | 90 days | Slip and fall claims frequently surface 3 to 6 weeks after the incident. High-volume environments have higher incident frequency. |
| Warehouse and logistics | 30 days | 90 days | Inventory discrepancies often discovered at cycle count intervals. Cargo theft investigations can span weeks. |
| Financial services | 90 days | 180 days | FINTRAC and internal compliance requirements. Fraud investigations frequently require footage from well beyond 30 days prior. |
| Healthcare facilities | 30 days | 90 days | Patient safety incidents. Note: cameras in patient care areas carry additional consent and privacy requirements under provincial health legislation. |
| Multi-tenant commercial buildings | 30 days | 60 days | Common area liability. Landlords and property managers need footage to resolve tenant disputes and building incidents. |
| Construction sites | 30 days | 90 days | Equipment theft, safety incidents, and subcontractor disputes can surface well after the fact. Site conditions change fast and footage context matters. |
What Your Commercial Insurer Actually Expects
Commercial property and liability insurers do not always specify camera retention requirements in the policy document itself. The issue tends to surface at claim time, when the adjuster asks for footage and it no longer exists.
In a commercial general liability claim involving a customer or visitor injured on your premises, the insurer handling the claim will almost always request security camera footage from the period surrounding the incident. If the claim is filed 45 days after the incident and your footage is on a 30-day loop, that footage is gone. The claim proceeds without it, which typically means a harder negotiation and frequently a worse outcome.
Several commercial insurance brokers serving the Ontario market note that some policies now explicitly reference video surveillance retention as a condition of coverage for specific claim types, particularly in retail and hospitality. The language varies by insurer and policy, but the trend is toward formalising what was previously an informal expectation.
Practical guidance from brokers consistently points to 30 days as the minimum for standard commercial property and liability, and 60 to 90 days for businesses in higher-risk categories or with histories of claims. If you are not sure what your insurer expects, the question to ask is: how long after an incident does your claims team typically require footage to be available?
The Preservation Protocol: What to Do the Moment You Know Something Happened
Your retention setting handles the rolling storage window. It does not handle the situation where an incident has already happened and the overwrite clock is running. That requires a separate process, a preservation protocol, that everyone with access to the NVR knows and follows.
The moment a potential incident is identified, whether a complaint, an injury, a theft report, or a dispute, the relevant footage must be exported and stored separately, outside the overwrite loop. Most NVR systems allow you to lock or export specific time ranges. If you do not know how to do this on your system, find out now, before you need it at 11pm on a Sunday.
The preservation process should include:
- Export the relevant footage to an external drive or secure cloud storage immediately. Do not rely on the NVR alone. NVR drives fail.
- Document what was exported: date range, camera numbers or names, time of export, and who performed the export. This chain of custody record matters if the footage is ever used in a legal proceeding.
- Notify your insurer or legal counsel promptly if the incident has claim potential. They may have specific requirements for how footage should be stored and shared.
- Do not edit, trim, or compress the footage. Export the original file. Any modification to footage reduces its evidentiary value and could be challenged if the matter goes to court or a tribunal.
How to Check Whether Your Storage Can Support Your Retention Period
NVR storage is finite. Before setting your retention policy, check that your system can actually hold that many days of footage at your current camera count and resolution. Most NVR management interfaces have a storage calculator built in, but the manual formula is straightforward:
Daily storage (GB) = Bitrate (Mbps) x 60 x 60 x 24 x Camera count ÷ 8 ÷ 1024
A practical example: 16 cameras recording at 4MP resolution with H.265 compression at an average bitrate of 2 Mbps each:
2 Mbps x 86,400 seconds x 16 cameras ÷ 8 bits ÷ 1,024 = approximately 337 GB per day
At 337 GB per day, a 30-day retention window requires roughly 10 TB of raw storage. Most NVR vendors recommend buying 20 to 30 percent more storage than the calculation suggests to account for higher-activity periods, motion-triggered recording spikes, and drive health margin.
If your current NVR storage cannot support the retention period your industry and insurer require, the options are adding drives (if your NVR chassis supports it), replacing the NVR with higher storage capacity, or reducing recording resolution on cameras in lower-risk zones to extend total retention at the same storage level.
Five Mistakes Canadian Businesses Make with Footage Retention
1. Never Checking What the NVR Is Actually Set To
A large proportion of commercial CCTV systems are set to whatever the installing technician defaulted to on the day of installation. Seven days is a common factory setting. Many business owners have a general sense that footage exists but no idea how far back it actually goes. Log in, check the storage settings, and verify the actual retention window today.
2. Treating All Cameras the Same
Not every camera in a commercial deployment carries equal risk weight. A camera pointed at the server room in a low-traffic area does not need the same retention as a camera covering the main entrance, the loading dock, or the cash register. Some NVR systems allow per-camera retention settings. Using them lets you apply 90 days to high-risk zones and 30 days to lower-risk areas without tripling your total storage requirement.
3. No Written Retention Policy
Under PIPEDA, the necessity principle requires that you can justify why you hold footage for as long as you do. “We just never changed the settings” is not a justification that satisfies a privacy complaint. A simple written policy that states the retention period, the purpose it serves, and the destruction process for footage that is no longer needed provides the documentation that demonstrates compliance.
4. No Process for When the Drive Fails
NVR hard drives have a limited lifespan, typically three to five years under continuous operation. Many commercial systems have been running for years on the original drives with no monitoring and no replacement schedule. A drive failure does not just mean losing future footage. It often means losing all existing footage as well. Drives should be health-monitored and replaced proactively, not reactively.
5. Sharing Footage Without Understanding the Implications
When a police officer asks for footage, when a landlord requests access to a tenant’s camera, or when an opposing party in a civil claim requests CCTV video, sharing is not always as simple as handing over a USB drive. Under PIPEDA, disclosures of personal information, including footage of identifiable individuals, need to be handled carefully. Law enforcement requests typically need to follow a formal process. For any request outside your normal operations, speak with legal counsel before sharing.
Frequently Asked Questions
How long does PIPEDA require businesses to keep CCTV footage?
PIPEDA does not specify a fixed retention period. It requires that personal information, which includes identifiable video footage, be kept only as long as necessary for the purpose it was collected. For commercial security purposes, the OPC’s guidance points to 30 days as a reasonable standard for most general commercial settings. Businesses with specific investigative or regulatory needs may justify longer retention, but should document the reasoning.
What is the minimum CCTV footage retention for commercial businesses in Ontario?
There is no provincial minimum mandated by Ontario legislation for private-sector commercial CCTV. In practice, 30 days is the widely accepted standard for general commercial use, driven by OPC guidance, commercial insurance expectations, and the realistic window within which most incidents are reported. Businesses in regulated sectors (financial services, healthcare, certain licensed industries) may have additional requirements from their regulators.
Can a business keep CCTV footage indefinitely in Canada?
Not without a documented reason. Under PIPEDA, indefinite retention of personal information, including video footage of identifiable individuals, is not compliant with the necessity principle. Businesses have been found non-compliant in OPC investigations for retaining footage with no defined retention period or destruction process. A written retention policy with a defined end date protects the business both from privacy complaints and from unnecessary data liability.
What happens to CCTV footage when an incident occurs?
When a specific incident is identified, such as an injury, theft, dispute, or anything with claim potential, the relevant footage should be exported and stored separately immediately, before the rolling storage window overwrites it. Do not rely on the NVR to preserve it. Export the original file, document the export with a chain of custody record, and notify your insurer or legal counsel promptly if the incident has claim implications.
Does commercial insurance require a minimum CCTV retention period?
Not always explicitly, but insurers handling liability claims routinely request footage from the period of an incident. If that footage has been overwritten, the claim typically proceeds without it. The absence of footage is not neutral. Most commercial insurance brokers recommend 30 days as a practical minimum for standard commercial liability, and 60 to 90 days for retail, hospitality, and other higher-claim-frequency environments. Check your specific policy for any surveillance or evidence preservation conditions.
Can I extend my NVR storage without replacing the entire system?
In most cases, yes. NVRs typically support additional hard drives up to a chassis maximum, or can be connected to external NAS (Network Attached Storage) for expanded capacity. Whether your specific NVR supports expansion depends on the model and manufacturer. If your current system is more than four or five years old, expanding storage may not be the most cost-effective approach. A modern NVR with higher base storage, H.265 compression support, and current firmware is often a better long-term investment.
Not Sure What Your NVR Is Set To?
Most commercial CCTV systems are configured with whatever the installer defaulted to on the day they were installed. Neither the retention window nor the storage capacity has been revisited since. That is fine until you need the footage and it is not there.
Cablify installs and services commercial IP camera systems for offices, warehouses, retail environments, and multi-tenant buildings across the Greater Toronto Area. If you are not certain what your current NVR retention is set to, whether your storage capacity supports the window your industry requires, or whether your system’s drives are still healthy, we can check all of it in a single site visit.
Contact Cablify: +1-647-846-1925 | info@cablify.ca | Serving Toronto, Mississauga, Vaughan, Brampton, and the GTA