How long do you have to keep security camera footage?

There is no single answer — retention requirements vary by industry, jurisdiction, and use case. Common minimums are 30 to 90 days for general commercial use, 90 days to a year for regulated industries like banking, and longer for specific situations like an active investigation or a subpoena. Always check your local regulations and any contracts with insurers or customers.

What is the typical security camera footage retention period?

For general commercial and residential security, 30 days is the most common default. Higher-risk environments (banking, healthcare, casinos, schools) commonly retain for 90 days to one year. Operations that handle insurance subrogation regularly often run on a 6 to 12 month window. Once a specific incident is identified, the relevant footage should be preserved separately and excluded from the normal retention sweep.

Are there legal requirements to retain security footage?

Yes, in specific industries and jurisdictions. Banks, casinos, healthcare facilities, and licensed liquor establishments often have minimum retention requirements set by regulation. Some U.S. states and many other countries have additional rules. Anywhere there is no specific regulation, your insurance carrier and your customer contracts are typically the next constraint.

When can you delete security camera footage?

Once the retention window has elapsed and no active investigation, subpoena, or hold notice applies to the specific footage. Deletion should be on a documented schedule, logged, and authorized — not ad-hoc. Anything under an active hold needs to be tagged so it is excluded from the deletion sweep.

How Long Should You Keep Security Camera Footage? A Retention Guide

Retention windows for security camera footage range from 30 days for low-risk commercial sites to over a year for regulated industries, with no single legal answer that applies to everyone. The right window for any given site is set by the strictest of three things: applicable regulation, insurer or customer contract, and the operational need to look back when an incident surfaces. This guide walks through how to think about retention, what common windows look like by industry, and how to enforce a policy without storage costs running away from you. For the broader workflow context, start with our guide to incident video management.

How to set the retention window

Three constraints drive the right answer for any specific site:

Regulation. Industry-specific rules — banking, casinos, healthcare, alcohol licensing, school safety — may set explicit minimums. Some states (California, Illinois, New York) and many non-U.S. jurisdictions add general video retention or privacy rules on top.
Contracts. Many commercial leases, insurance policies, and customer agreements specify retention requirements independently of regulation. These can be longer than the regulatory minimum.
Operational need. How far back do incident requests typically reach? An insurance subrogation request that arrives 8 months after an incident is useless against a 30-day window. If your customers regularly come back months later, the window needs to accommodate that.

Set the retention window to the longest of these three. If regulation requires 90 days, your insurer requires 6 months, and you commonly get 9-month-old subrogation requests, the answer is 9 months — not 90 days.

Common windows by industry

These are typical, not legally definitive. Always confirm against the specific regulations and contracts that apply to your operation.

| Industry / use case | Typical window | Notes | | --- | --- | --- | | General commercial security | 30 days | The most common default. Often set by storage cost rather than rule. | | Residential / HOA | 30 days | Sometimes 7–14 days for lower-cost systems. | | Retail | 30–90 days | Higher windows where shrinkage/litigation are routine. | | Hospitality (hotels, restaurants) | 30–90 days | Liquor licensing in some jurisdictions sets the minimum. | | Healthcare | 90 days – 1 year | Some U.S. states set explicit minimums; HIPAA may apply to any footage that includes PHI. | | Banking and financial | 90 days – 1 year+ | Set by federal regulators and bank policy. | | Casinos / gaming | 7 days – 6 months for live floors | Gaming commission rules vary by state; specific events (e.g., disputes) trigger much longer holds. | | Schools (K-12) | 30–90 days | State-specific; some FERPA implications when footage shows identifiable students. | | Critical infrastructure | 90 days – 1 year+ | TSA, NERC-CIP, and similar regulators set minimums for transport, energy, water. | | Sites under active investigation | Indefinite | Footage placed under a hold notice should be preserved until the hold is lifted. |

Insurance carriers often require longer retention than regulators do. If you operate sites under a master insurance policy, the policy's retention clause is often the binding constraint.

Holds and exceptions

Retention is set by policy; holds override policy:

Specific incident hold. Once an incident has surfaced — a clip request, an insurance claim, an officer's report — the footage covering that incident should be tagged and excluded from the regular retention sweep, until the matter is closed.
Subpoena hold. If you receive a subpoena, the relevant footage must be preserved as-is for as long as the order is in force. Document the receipt of the subpoena and the boundaries of the hold.
Litigation hold. When litigation is reasonably foreseeable — including before a suit is filed — relevant evidence must be preserved. This duty often arises earlier than people realize.
Internal investigation hold. When an internal investigation is opened (employment matters, internal theft), the footage covering the matter should be held separately.

The mechanical part is straightforward: tag the relevant clips, exclude them from the deletion sweep, and document what's on hold and why. The non-mechanical part is making sure the people running the sweeps know what holds are in effect.

What happens at expiry

Deletion should be:

Scheduled and documented. A retention policy is only credible if it's enforced consistently. "We delete eventually" is not a retention policy.
Logged. When footage is deleted, the deletion event itself should be recorded — what was deleted, when, by what process, under what policy.
Final. Recovery tools should not silently keep deleted footage past the retention window. If your storage backend (cloud or on-prem) keeps deleted objects in a recovery bucket, that bucket needs the same retention rules.

Inconsistent enforcement is its own evidentiary problem. If footage from incident A was deleted at 30 days but footage from incident B is still around at 90, opposing counsel has a fair question to ask.

How retention interacts with chain of custody

Retention and chain of custody are closely related but distinct:

Retention is about which footage you keep, and for how long.
Chain of custody is about how you can demonstrate the footage you have is what it claims to be.

Footage outside the retention window is gone. Footage inside it needs to be accounted for. The two policies are written together but enforced separately — see our chain of custody guide.

Storage cost reality

The conversation often comes down to storage cost. A few practical anchors:

Continuous recording on a single 1080p H.264 camera at moderate bitrate produces roughly 30–60 GB per month, per camera. H.265 cuts that roughly in half where supported.
A site with 16 cameras at 1080p at 30 days is in the range of 500 GB–1 TB.
Moving from 30 to 90 days roughly triples the storage requirement. Moving to a year is roughly 12x.
Cold storage (slower retrieval, lower cost per GB) is reasonable for the older end of the retention window. Most cloud object stores have a cold tier under a different name.

The right answer is rarely "store everything as hot data for a year." It's typically "hot for the most recent N days, cold for the rest of the window, deleted after that." A tool like Incident Clips can help structure this — incidents your operators have packaged are kept; ad-hoc raw footage rolls off on schedule.

Practical recommendations

Pick the longest of regulation, contract, and operational need. Write it down. Apply it consistently across all sites of the same type.
Tag any footage tied to a known incident, subpoena, or litigation hold. Exclude tagged footage from the deletion sweep.
Log deletions. Don't rely on "the system handles it" — make sure the log exists and is reviewable.
Review the policy annually. Insurance contracts and regulations change.

For the connected workflow — what to do once a clip has been pulled, how to package it, how to share it without losing the chain — see our incident video management guide and chain of custody guide.

Where Incident Clips fits

Incident Clips does not replace your camera storage or VMS — those handle the underlying retention. Incident Clips manages the lifecycle of clips and packages derived from that footage: which incidents you've already touched, who you've shared them with, when the access expires, and when the package itself should be archived or deleted. See pricing or contact us for a walkthrough.