How long
to keep recordings

One month at most from the moment the images are captured, and that limit isn't a best-practice recommendation: it's the one Spanish data protection rules set for video surveillance. After that period the footage must be deleted, and in most systems nobody has to do anything by hand, because the recorder works in a loop and automatically overwrites the oldest footage as soon as the disk is full. The real problem usually isn't a lack of willingness to comply, but that the loop is configured once, on installation day, and nobody looks at it again. Over the years, and especially if the disk installed is larger than necessary, the system can end up storing months of recordings without anyone noticing. Keeping footage longer just in case may look like a sensible precaution, but it isn't: it's simply a breach that only persists because nobody checks.

You shouldn't have it, and that's the most common misunderstanding about this exception: many people think it lets you extend the general period when needed, and it works exactly the other way round. The exception doesn't extend anything for the whole system; it lets you find and keep one very specific clip, the one that proves something that may be a crime or an offence, and only if you act within the month while that recording still exists. After that month, if nobody extracted the clip in time, there's nothing left to recover because the overwrite loop has taken it. Extracting the clip means taking it out of the recorder into a separate file, with the date, time and camera identified, and protecting it from automatic deletion while the rest of the system carries on with its normal one-month cycle. That material doesn't stay stored indefinitely in your office: the aim is to hand it to the police or the court, not to build up a parallel archive of incidents.

It's exactly the opposite of what it seems. A recorder set up to keep a year isn't better prepared and offers no extra guarantees: it's in breach of the rules every single day from day thirty-one onwards, continuously, without any incident being needed for that breach to exist. And there's a second side to the problem that is usually overlooked: the longer footage piles up, the greater the damage if someone gains unauthorised access to that disk, because it's no longer a month of recordings but a complete history of who came in, went out or walked past each camera over an entire year. Long storage is often presented, even in sales pitches, as a superior feature of the equipment, but it isn't: it's simply a larger exposed surface. If you have a recorder like that, the sensible question isn't whether you should keep more, but how quickly you can correct the configuration and bring the loop back within the month.

Only the person responsible for the system and the people they have expressly authorised in writing, and only for the security purpose that justified installing the cameras. That rules out uses that are very common in practice and that many people don't see as a problem: showing a recording to someone out of curiosity, using it to settle an internal dispute that has nothing to do with security, or sharing a clip on social media or WhatsApp because the moment looks funny or striking. Any of those uses is access to personal data with no legal basis to support it, whether or not that person has general permission to view the cameras: the permission covers the security purpose, not any later use of the footage. The list of who can access it should be in writing and no longer than necessary, because each person with access is one more point where that limit can be broken without anyone noticing.

You don't hand the video directly to a private individual, even if they insist they appear in it and have the right to see it. What they do have is a right of access to their own data, and that right can be met in other ways, for example by confirming that they appear and in what time slot, without giving them a copy that also shows third parties who haven't consented to their image being passed around. Handing over the full file would, in fact, mean processing those other people's data with no legal basis to justify it. If what lies behind the request is a possible offence or crime, the correct route doesn't go through the neighbour or whoever is complaining: you find the specific clip, keep it and make it available to the police or the court, who are the ones entitled to request and handle it. If you find yourself in this situation and aren't sure how to respond without exposing yourself, the sensible thing is to get advice before handing anything over.

The legal maximum is the same everywhere: one month, regardless of the type of business or property. What changes from one case to another is what period is reasonable within that limit. In a shop with a till, where a cash discrepancy or an incident is usually spotted within hours or a couple of days, there's no need whatsoever to use the full month. In a warehouse or premises with intermittent activity, for example one that closes at weekends, it makes sense to cover at least a couple of weeks, because an incident on a Friday afternoon may not be noticed until someone comes back on Monday morning. The general idea is to set the period based on how long it really takes to realise something has happened, not to max out the legal limit by default just because the disk allows it. Keeping the whole month for no reason adds nothing, but it does add risk.

It depends on several factors that vary a lot from one system to another: how many cameras there are, what resolution they record at, and whether they record continuously around the clock or only when they detect motion, which hugely reduces the number of hours recorded. There's no single figure in gigabytes or terabytes that works for every case, and anyone who gives you one without knowing your specific system is guessing. What matters isn't so much calculating the exact disk as approaching the problem the other way round from how it's usually done: instead of buying the biggest disk available and seeing how long it lasts, you choose the capacity so that the recorder's overwrite loop naturally falls within the month set by the legal limit. Done that way, compliance no longer depends on someone remembering to check the configuration every so often: the system itself deletes only what shouldn't be there any more, without anyone having to step in or remember anything.

The maximum period is exactly the same even if the footage isn't on a disk in front of you, so it's worth reading the service contract carefully before accepting it. Some cloud camera providers offer 60 or even 90 days of history as a selling point, presenting it as an advantage over the competition. Signing up for that option and leaving it switched on is just as much a breach as having a badly configured local recorder, with an added aggravating factor: the footage is on a system you don't directly control, managed by a third party, which makes it even harder to prove what has been done with it and how long it has been accessible. If the service you use doesn't let you reduce retention to under a month, that particular service doesn't fit what the rules require, however many features it has in other respects, and it's worth looking for one that does let you adjust it or reviewing the configuration with whoever installed it.