12 shops,
one dashboard.

No, and in fact trying to usually works out worse. The usual approach is to set the standard first (which camera, recorder and router model will be used in every shop from now on) and apply it to newly opened shops or those already due for renewal because of a fault or end-of-life equipment. The rest of the chain is migrated in batches, starting with the shops running the oldest systems, until the whole network is covered within a reasonable timeframe, rather than halting trade at every site at once. What you should avoid while the migration is under way is adding yet more different systems: if a shop needs a new recorder this month, that's the moment to install the new standard, not a third model that will have to be replaced again. Every exception added during the transition is one more system to maintain afterwards.

Yes, with per-user authenticated access and through an encrypted tunnel to each shop, not by exposing the recorder directly to the internet. What you should never do is the quick fix of registering the recorder with a public address and an open port: it's the easiest way to view the cameras from your phone, but also the most common way to end up with those same cameras listed on a search engine for internet-exposed devices, open to anyone. The model that works in retail is record locally, view centrally: each shop keeps its own video on its own recorder, and an encrypted connection lets you review it from outside without exposing anything to the public network. That way, if a shop loses its internet connection for a while, it keeps recording regardless. The difference between relying on a local recorder or on the cloud is explained in NVR recorder or cloud.

There's no regulation that makes it mandatory in so many words, but mixing it with the payment terminal's network means taking on a risk that isn't worth what you save by not separating it. Any customer device connected to the same network as the card terminal is, in practice, a potential entry point to the payment system, and that doesn't depend on the customer having bad intentions: a phone with malware its owner doesn't know about is enough. Separating it with a captive portal (the welcome screen that asks you to accept terms before browsing) costs little to set up on the network each shop already has. And doing it properly brings an added benefit that has nothing to do with security: it gives you real footfall data, how many people come in and at what times. Each shop's connection and how much capacity is needed to separate both networks properly is explained in fibre & networks.

As a general rule, one month at most, and only specific recordings documenting an incident that has already been reported are kept longer, not the whole month's archive just in case. Keeping more than necessary isn't more prudent and gives no extra legal protection: quite the opposite, because keeping recordings without a specific reason breaches the data minimisation principle that governs video surveillance. In a chain of several shops that period has to be the same everywhere, with the same automatic deletion procedure configured on every recorder, because different criteria in each shop mean different risks. You also need a visible information sign in every shop and a single person at head office able to handle a request for access to the footage, with the same procedure everywhere. How long it's advisable to keep footage depending on the type of business is explained in how long to keep recordings.

The first step is to choose a single model, or two at most depending on the size of the premises, and use it in every shop in the chain without exception: that brings maintenance costs down because the technician handling an incident already knows the equipment, and it lets you keep common spare parts instead of different stock for each shop. Within that choice, the usual dilemma is Wi-Fi cameras versus cameras with a network cable powered over PoE. In retail premises with lots of customers' Wi-Fi devices connected at once (exactly the scenario of a shop with a captive portal), Wi-Fi interference and congestion make PoE the more reliable option, because it doesn't compete for the same wireless bandwidth. PoE also simplifies installation in new shops, because a single cable carries both data and power. The full comparison is in Wi-Fi or PoE cameras.

Yes, always, and it has to be done before the camera starts recording, not after it's been installed. Informing staff beforehand isn't an optional formality that can be left for later: it's a requirement for that footage to be used legitimately, for example if it's ever needed as evidence after an incident. The usual way to comply is a visible sign in each recorded area plus a written notice to the team, explaining which areas are covered and for what purpose, which in a shop is usually the security of the premises and loss prevention, not constant monitoring of each employee. With several shops, that notice should be identical everywhere, written once by head office rather than improvised shop by shop. Which areas can be recorded and how to inform the team correctly is explained in detail in cameras and employees: what the law says.