How Long Does CCTV Footage Stay? Retention Rules 2026

Updated October 2026: a short answer to how long CCTV footage stays, cloud-camera plan periods (Ring, Google Home Premium), Nevada's April 2026 casino retention change and the exact PCI DSS 9.2.1.1 three-month rule.

This is engineering guidance, not legal advice. Confirm specifics with qualified counsel.

Why this matters

Our companion article turned retention days into terabytes of storage; this article is about the days themselves — how to choose them, defend them, and enforce them. It is for the security integrator, product manager, operations lead, or compliance owner who has to answer a deceptively simple question — "how long do we keep the video?" — and discovers the answer is neither one number nor a free choice. Get the period too short and you fail an investigation, a chargeback, or a regulator's minimum; too long and you breach privacy law, carry needless storage cost, and turn an archive into a liability that an attacker or a subpoena can reach. No legal background is needed: every rule is explained in plain language and tied to the named law, and every period is grounded in a real operational or regulatory reason. The aim is a policy you can write down, encode in the system, and stand behind.

How long does CCTV footage stay? The short answer

In practice, most CCTV systems keep footage for about 30 days, and the usual range is 7 to 90 days (our estimate from vendor defaults and the systems we build and audit, 2026); after that the recorder deletes it automatically, either by overwriting the oldest video when the disk fills or by erasing anything older than a set maximum age. Home cloud cameras keep whatever the subscription tier allows, regulated sites keep what their rule sets (7 days for routine casino recordings in Nevada in 2026, 90 calendar days for California cannabis licensees), and in the EU the privacy default for routine footage is only a few days. Footage is not deleted after a fixed 24 hours unless someone set it up that way.

What does "3-day video retention" mean?

A 3-day video retention setting means the system keeps a rolling window of the last 72 hours: every new hour of recording pushes the oldest hour out, so footage from four days ago is already gone. The same logic applies to 30-, 90- or 180-day settings. Three days fits the EU expectation that routine footage is kept only a few days, and it is too short anywhere incidents are reported late, such as retail theft found at the next stock-take.

Does camera footage delete after 24 hours?

Not by default on most systems. Footage disappears within a day only when retention is set to 1 day (Ring's shortest option), when a free tier keeps just hours of history (3 to 6 hours of event video on recent Nest cameras without a subscription, per Google in 2026), or when a small SD card or disk fills within a day and the oldest recording is overwritten. On a typical NVR, footage stays until the disk wraps, usually 1 to 4 weeks on default sizing (our field estimate).

How often does CCTV footage get deleted automatically?

Continuously, in one of two ways. With capacity-driven overwrite, the recorder writes over the oldest footage whenever the disk is full, so the period is whatever disk size divided by daily write rate happens to be. With policy-driven deletion, footage is erased once it reaches a set maximum age, such as 14 or 90 days, whether or not the disk is full; ONVIF Profile G recorders expose this as MaximumRetentionTime. Only the second gives you a period someone actually chose, which is what the rest of this article is about.

What does 90-day video retention mean, and who needs it?

A 90-day setting keeps a rolling three months of footage. It is the legal floor for California cannabis licensees (90 calendar days under 4 CCR §15044(h)), a practical choice for point-of-sale cameras, because most card disputes surface within it (merchants whose acquirers allow 120-day disputes keep POS footage longer), and roughly the PCI DSS minimum for video or badge records at the doors of card-data server rooms; that rule says at least three months, so set 92 days or a calendar-month rule to be safe. It is far above the EU privacy default, so every 90-day camera needs a written reason.

How long should construction site video evidence be kept?

No US federal or EU rule sets a fixed period for construction cameras, so the period follows the purpose: we usually start routine site coverage at 30 days so theft and damage found at the next site walk are still on record, and we pull any clip tied to an injury, claim or dispute out of the rolling buffer as soon as it is reported. Once a claim or lawsuit is reasonably anticipated, a legal hold applies and routine deletion of that footage must stop.

The one idea: retention is a decision, not a disk size

Ask most surveillance systems how long they keep footage and the honest answer is "until the disk is full." A recorder writes camera streams to its drives, and when the drives fill, it overwrites the oldest recording to make room for the newest — a first-in, first-out loop. The retention period that results is whatever the disk capacity divided by the daily write rate happens to be. It is a number nobody chose.

Work that out with the figures from our retention-math article. Take 40 cameras at 2 Mbps, recording continuously. Each camera writes about 21.6 GB per day, so the site writes roughly 0.864 TB per day. On a 26 TB array:

26 TB ÷ 0.864 TB/day ≈ 30 days before the loop wraps

So the system "retains 30 days" — but only because the array happens to be 26 TB. Add cameras, raise the resolution, or switch on a second site, and the same array now retains 18 days. Swap in bigger drives and it retains 60. The keep-period drifts with the hardware, which is exactly what a policy is supposed to prevent. If the law says you must keep 90 days, this system silently loses a month of required footage. If privacy law says you should keep only a few days, this system over-retains for weeks. Either way, the period is an accident.

A retention policy replaces that accident with a decision: footage of a given type is kept for a stated period, for a stated reason, and is then deliberately deleted — regardless of how much disk is free. The rest of this article is about how to make that decision and, harder, how to make the system actually obey it.

Figure 1. Retention lives between two limits: a minimum set by operational need and legal or sector rules (how long you must keep), and a maximum set by privacy law (how long you may). The policy is the window between them.

Two limits, pulling in opposite directions

The reason retention feels confusing is that two different forces set it, and they pull opposite ways. Keeping them separate is the whole trick.

The first force is the minimum — the floor below which the footage is useless or non-compliant. It comes from two places. One is plain operational need: an incident is often not reported the day it happens, so footage has to outlive the gap between an event and someone asking for it. A slip-and-fall claim, a disputed transaction, an employee complaint, or a theft discovered at the next stock-take can surface weeks later. The other is a legal or sector requirement: some industries are told, in regulation, the minimum number of days they must retain specific footage. Below the minimum, the system has failed at its job.

The second force is the maximum — the ceiling above which keeping footage becomes a liability rather than an asset. This comes from privacy law, which treats recorded video of identifiable people as personal data and says, in essence, that you may not keep personal data longer than you actually need it. Above the maximum, every extra day is unnecessary risk: more to secure, more exposed to a breach, more discoverable in litigation, and — in the jurisdictions that enforce it — a standing violation.

A retention period is any number that sits between those two limits. The minimum says "no shorter than this"; the maximum says "no longer than this." When the minimum exceeds the maximum — when a sector rule demands more than privacy law would otherwise allow — the specific legal obligation generally wins for that footage, and the longer period is itself the lawful basis for keeping it. The job of a policy is to find the right point in that window for each kind of footage, write it down, and delete on time.

The minimum: how long you must keep footage

Start with the floor, because it is the easier of the two to reason about and the one most teams get backwards by guessing.

Operationally, the question is: what is the longest plausible gap between something happening on camera and someone needing the footage? For a quiet office lobby that might be a week. For a retail store with chargeback disputes, it is the card-scheme dispute window, which can run 60 to 120 days. For a workplace where a harassment or injury claim might be filed, it can be longer still. The honest method is to list the incident types the cameras exist to cover, find the slowest one to surface, and set the minimum to outlast it — not to pick a round number because it sounds safe.

On top of operational need sit sector minimums written into regulation, and these are specific, citable, and easy to get wrong. A few real examples as of 2026:

The pattern to notice: there is no universal number. "How long should we keep footage?" has no answer without naming the sector, the jurisdiction, and the camera's purpose. A casino floor camera, a dispensary vault camera, and a back-office lobby camera in the same building can have three different lawful minimums.

Common mistake: "PCI DSS requires 90 days of video on every camera." PCI DSS does carry a three-month rule, but it is narrow. Requirement 9.2.1.1 (v4.0.1) says individual physical access to sensitive areas within the cardholder-data environment is monitored with video cameras or physical access-control mechanisms, or both, and that the collected data is stored for at least three months unless the law restricts it. "Sensitive areas" means places like data centers and server rooms that house card-data systems; public-facing areas where only point-of-sale terminals sit are excluded. So the server-room door camera, or the badge log that replaces it, needs three months. The sales-floor and checkout cameras get no PCI period at all: their retention has to come from a real operational reason, such as the chargeback window.

The maximum: how long you may keep footage

Now the ceiling, which is where surveillance teams most often drift into quiet non-compliance — because cheap storage makes "keep it all, forever" feel free, and privacy law says the opposite.

The controlling principle in the EU is storage limitation, set out in the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), Article 5(1)(e). It says personal data must be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed." Recorded video of identifiable people is personal data, so the clock is not optional: once the footage is no longer needed for the purpose that justified recording it, it must go.

How short is "no longer than necessary" for video? The body that interprets GDPR for cameras — the European Data Protection Board (EDPB) — answers this directly in its Guidelines 3/2019 on processing of personal data through video devices. Its position, restated in the EDPB's own April 2026 awareness summary of those guidelines, is blunt: because damage or an incident "can be detected within one or two days," a storage period of "a few days" is often sufficient, and footage should be erased — ideally automatically — once it is no longer necessary. The guidelines give a worked example: an organisation that auto-deletes footage after two days simply cannot supply that footage to anyone afterward, because it no longer exists. The guidance leaves room for longer where a member state sets a specific period or where a real need justifies it, but the default expectation is short.

This is the mirror image of the minimum, and the tension is real. A card-dispute window might argue for 90 days; the privacy default argues for a few. The resolution is not to split the difference but to tie each period to a named, defensible purpose: the 90-day POS camera is kept 90 days because of the documented dispute window, and the lobby camera with no such need is kept a few days. A period you cannot justify by purpose is a period that is too long.

Common mistake: keeping everything forever because storage is cheap. The cost that matters is not the disk — it is the liability. Every extra day of retained footage is more personal data to secure, more to lose in a breach, more that a subpoena or a data-subject access request can reach, and, in the EU, a standing storage-limitation violation. An archive you cannot justify is not an asset; it is a stockpile of risk that grows every day the deletion job does not run. The cheap-storage instinct (see our storage-tiers article, where a $1/TB archive class tempts exactly this) is the thing the maximum exists to stop.

The sharper ceiling: biometric footage

One category carries a much harder maximum: footage processed for biometrics — face recognition, or any analytic that turns a face into a searchable template. Under GDPR this is special-category data (Art. 9) with a higher bar; under US law it triggers state biometric statutes. Illinois' Biometric Information Privacy Act (BIPA, 740 ILCS 14/15(a)) requires any private entity holding biometric identifiers to publish a written retention schedule and to permanently destroy the data when the purpose is satisfied or within three years of the person's last interaction, whichever comes first. That is a statutory deletion deadline with a private right of action behind it. If your system runs face recognition, the face templates have their own retention clock, separate from and stricter than the video they came from — a point our face-recognition article flags and the BIPA article covers in full. Colorado added a second clock on July 1, 2025 (HB24-1130): biometric identifiers must be deleted at the earliest of the purpose being met, 24 months after the person last interacted with the business, or 45 days after the business decides it no longer needs them. In the EU, the AI Act already bans real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions (Art. 5, since February 2, 2025), and treats other remote biometric identification as high-risk; the Digital Omnibus on AI, approved by the Council on June 29, 2026, moved those stand-alone high-risk obligations to December 2, 2027, but it did not change GDPR retention. Treat biometric data as its own retention class, always.

Figure 2. There is no universal retention number. Sector minimums (casino, cannabis, PCI sensitive areas, banking) set a floor for specific cameras; the GDPR storage-limitation principle pulls the default toward days, not months. Each camera's period follows its purpose.

Setting the policy: one system, many clocks

The mistake hiding inside "how long do we keep footage?" is the word we, as if one number governs the whole system. It almost never should. A real retention policy assigns each class of footage its own period, each justified by its own purpose, and lets the system run several clocks at once.

The method is short. First, group cameras (or events) into classes by purpose: general coverage, transaction or point-of-sale, access-controlled or high-value areas, incident-flagged clips, and any biometric output. Second, for each class find the minimum (operational need, plus any sector mandate) and the maximum (the privacy default, unless a specific obligation lifts it). Third, set the period to the shortest value that clears the minimum and stays at or under the maximum — shortest, because storage limitation rewards restraint and every extra day is risk. Fourth, write it down, including the reason for each period, because a regulator, an auditor, or your own future team will ask why.

Here is that method as a worked policy for a mixed retail site:

This worked policy assumes a US retail site; an EU site would shorten the general-floor class toward a few days and document why any longer class is needed. Notice that the same building runs five different clocks, and the shortest defensible period wins in each row. Notice too that only the flagged-incident class is kept long, and only because a specific, documented reason lifts it — which is exactly how the storage-limitation maximum is meant to be cleared: by a named purpose, not by default. The arithmetic from our retention-math article still applies underneath, but now the terabytes follow the policy instead of the policy following the disks.

Figure 3. Setting a retention period per footage class: start from the purpose, apply any legal or sector minimum as the floor, hold flagged or litigation-relevant footage, and otherwise take the shortest period under the privacy-law maximum.

Making deletion actually happen

Choosing periods is the easy half. The hard half — the half that fails audits — is making the system delete on schedule and prove it did. Three things get in the way.

First, the two kinds of "delete" are not the same. Overwriting the oldest footage when the disk fills (the first-in, first-out loop we started with) is capacity-driven deletion: footage disappears when space runs out, at an age that depends on disk size and camera load. Deleting footage when it reaches a stated age is policy-driven deletion: footage disappears on a schedule, regardless of free space. A compliant system needs the second, and most recorders ship configured only for the first. The fix is to set an explicit maximum retention age so that footage is deleted at, say, 14 or 90 days whether or not the disk is full — and to size storage so the policy age is reached before the disk wraps, never after.

The surveillance standards make this enforceable. ONVIF — the common language that lets cameras and recording software from different makers work together — governs recorded video through Profile G (recording and retrieval; current Specification v1.1, October 2025). Its Recording Control Service defines a MaximumRetentionTime on a recording: the device "shall delete any data older than the maximum retention time." Set it to a real number and the standard obliges the recorder to enforce a policy age; set it to zero and retention is limited only by disk space — which is the accidental, capacity-driven mode again. Profile G standardizes the control — how a VMS sets and enforces the retention age across mixed-vendor recorders — but it does not decide the number. Remember the boundary from our ONVIF explainer: the standard guarantees the interface both sides conform to, not the policy you pour into it. For the commercial overview of how the profiles map to real products, Fora Soft's guide to ONVIF profiles in security systems is the companion read.

Second, footage escapes the schedule. The retention clock governs the primary recording, but copies leak out of it constantly: a clip exported for an investigation, a nightly backup, a cloud archive copy (the kind our cloud-and-hybrid-storage article describes), a frame emailed to a manager. Each of those is footage that will outlive the deletion job unless it is tracked. A policy that deletes the primary recording at 14 days but leaves year-old exports in a shared drive has not actually retained for 14 days — it has retained for a year, in the worst possible place to defend. Every export and backup needs its own retention rule and its own deletion, or the policy is fiction.

Third, deletion has to be provable. Privacy law expects accountability (GDPR Art. 5(2)): being able to show, not just assert, that footage was deleted on time. That means logging deletions — what was deleted, when, and under which rule — without logging the footage itself. When a regulator or a data-subject access request asks "do you still have video of me from last month?", the defensible answer is a deletion record showing the footage aged out on schedule, not a shrug. Recording modes interact here too: a system using motion or event recording retains less to begin with, which makes the deletion story simpler.

Figure 4. Deletion in practice: policy-driven deletion at a stated age (enforced via ONVIF Profile G MaximumRetentionTime) versus capacity-driven overwrite, the legal-hold freeze that suspends it, and the exports and backups that must carry their own retention rule.

The exception that overrides everything: legal hold

One event suspends the entire retention policy for specific footage: a legal hold (also called a litigation hold or preservation hold). When an organisation knows, or reasonably should know, that particular footage is relevant to actual or anticipated litigation, investigation, or a regulatory request, a common-law duty to preserve attaches — and scheduled deletion of that footage must stop, even if its retention period has expired.

The stakes are concrete. Under the US Federal Rules of Civil Procedure (Rule 37(e)), destroying electronically stored information that should have been preserved — surveillance video squarely included — can draw sanctions for spoliation: curative measures whenever the loss prejudices the other side, and, where the court finds intent to deprive, an adverse-inference instruction (the jury is told to assume the lost footage would have hurt you) up to default judgment. The routine, automatic deletion that keeps you compliant the rest of the time becomes the thing that sinks you if it runs over footage you were obliged to hold.

Two engineering implications follow. The hold must be surgical: it freezes the specific clips, cameras, and time ranges that matter, while the rest of the system keeps deleting on its normal schedule — a hold that freezes everything turns a compliance feature into a storage and privacy problem. And it must be releasable: when the matter resolves, the held footage returns to the normal retention clock and is deleted, rather than living forever because nobody remembered to lift the hold.

Common mistake: a deletion job that destroys footage under hold — or a hold that never lifts. The first is spoliation: the auto-delete runs at 14 days and erases the exact clip a lawsuit needed, because nobody told the system to preserve it. The second is its mirror: a hold is placed, the case settles, and three years later the "temporary" preservation copy is still sitting in storage, now an over-retention violation. A working system can flag footage as held, exempt it from automatic deletion, and — just as importantly — surface holds that are ready to be released. Build the freeze and the thaw together.

Where Fora Soft fits in

Retention is the part of a surveillance system where a clean demo and a defensible deployment diverge, because the demo never runs the deletion job and never gets a subpoena. Fora Soft has built video streaming, real-time video, and computer-vision systems since 2005 — 250+ shipped projects — and the surveillance work sits where storage, standards, and privacy meet. When we design or integrate a VMS, we set retention as an explicit policy per footage class rather than letting the disk size decide it, enforce the period through the ONVIF Profile G maximum-retention control so mixed-vendor recorders obey one rule, and build the deletion path to reach exports, backups, and cloud copies — not just the primary array. We treat biometric output as its own stricter clock, wire in a surgical, releasable legal-hold mechanism, and log deletions so the system can prove it deleted on time. The policy is judged not on the day it is written but on the day someone asks whether the footage was there when it should have been — and gone when it should have been. If you are scoping a VMS or a retention overhaul, our video surveillance software development team builds the storage, retention and legal-hold layer, and our computer vision for video surveillance work covers the biometric analytics whose output needs its own deletion clock.

The handbook

Fora Soft Video Engineering Handbook

We wrote a seven-volume, 9,000-page series that works through the whole video stack — encoding, delivery, audio and AI — so an engineer who has read it can design and build a surveillance system that keeps each class of footage exactly as long as its purpose allows. Volume 7 sits closest to this article: the compliance and cost side of video products, from biometric rules to what it costs to keep footage and models running. Volume 1 covers the bitrate and H.265 choices that turn a 14- or 90-day period into terabytes, and volume 6 covers video search and face recognition — the biometric output that runs on its own, stricter clock. Written by Nikolay Sapunov, CEO at Fora Soft.

Browse the handbook on Amazon →7 volumes · Kindle & paperback

See our case studies

References

1. Regulation (EU) 2016/679 (GDPR), Art. 5(1)(e) — storage limitation, European Union. The controlling principle that personal data, including identifiable video footage, must be kept "no longer than is necessary for the purposes for which the personal data are processed" — the legal maximum that caps surveillance retention, distinct from any operational minimum. Tier 1. https://eur-lex.europa.eu/eli/reg/2016/679/oj (accessed 2026-06-09)
2. Regulation (EU) 2016/679 (GDPR), Art. 17 — right to erasure ('right to be forgotten'), European Union. The data-subject right that can compel deletion of footage before its scheduled retention age, and the accountability backdrop (Art. 5(2)) for proving deletion. Tier 1. https://eur-lex.europa.eu/eli/reg/2016/679/oj (accessed 2026-06-09)
3. EDPB Guidelines 3/2019 on processing of personal data through video devices (Version 2.0, 2020; reaffirmed in the EDPB April 2026 awareness summary), European Data Protection Board. The video-specific interpretation of GDPR storage limitation: because incidents are "detected within one or two days," a storage period of "a few days" is often sufficient; footage should be erased, ideally automatically (the two-day auto-delete example); member states may set specific periods. Tier 2 (issuing-body guidance). https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32019-processing-personal-data-through-video_en (accessed 2026-06-09)
4. ONVIF Profile G (recording and retrieval) and the ONVIF Recording Control Service Specification, ONVIF. The open standard for recording control across vendors; the Recording Control Service defines MaximumRetentionTime, under which "the device shall delete any data older than the maximum retention time," with a value of 0 meaning retention is limited only by storage — the standards mechanism for enforcing a policy retention age. Current Profile G Specification v1.1 (October 2025). Tier 1. https://www.onvif.org/profiles/profile-g/ (accessed 2026-06-09)
5. Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/15(a), Illinois General Assembly. Requires a private entity holding biometric identifiers to publish a written retention schedule and to permanently destroy the data when the purpose is satisfied or within three years of the individual's last interaction, whichever is first — the statutory deletion deadline for face-recognition templates, backed by a private right of action. Tier 1. https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004 (accessed 2026-06-09)
6. Nevada Gaming Control Board, Regulation 5 — Surveillance Standards (Standard 9, Records; Rev. 04/26), State of Nevada. Routine recordings retained a minimum of 7 days until April 3, 2027 and 15 days thereafter; recordings of detentions and questioning by security retained at least 30 days — a concrete example that sector minimums are camera- and event-specific and do change. Tier 1 (state regulation). https://www.gaming.nv.gov/siteassets/content/regs/regulation-5---surveillance-standards-as-of-04-26.pdf (accessed 2026-10-16)
7. U.S. Federal Rules of Civil Procedure, Rule 37(e) — failure to preserve electronically stored information, U.S. Courts. The basis for the legal-hold duty and spoliation sanctions: surveillance video that should have been preserved for litigation, if destroyed by routine deletion, can draw adverse-inference instructions up to default judgment — the rule that suspends a retention policy for held footage. Tier 1. https://www.law.cornell.edu/rules/frcp/rule_37 (accessed 2026-06-09)
8. EN IEC 62676-4:2025: Video surveillance systems for use in security applications — Part 4: Application guidelines, IEC / CENELEC. System-level guidance for planning surveillance recording, including retention and the availability and integrity of stored footage — the engineering framework that treats a defined retention period as a design requirement. Tier 1. https://webstore.iec.ch/publication/68479 (accessed 2026-06-09)
9. PCI DSS v4.0.1, Requirement 9.2.1.1 — monitoring physical access to sensitive areas, PCI Security Standards Council. Individual physical access to sensitive areas within the cardholder-data environment is monitored with video cameras and/or physical access-control mechanisms, and the collected data is stored for at least three months unless restricted by law; sensitive areas exclude public-facing areas where only POS terminals are present — the basis for the corrected PCI callout. Tier 1. https://www.pcisecuritystandards.org/standards/pci-dss/ (accessed 2026-10-16)
10. California Code of Regulations, Title 4, §15044 — Video Surveillance System, Department of Cannabis Control. "Surveillance recordings shall be kept for a minimum of 90 calendar days" (subsection (h)). Tier 1. https://www.law.cornell.edu/regulations/california/4-CCR-15044 (accessed 2026-10-16)
11. Colorado HB24-1130 — Privacy of Biometric Identifiers and Data, Colorado General Assembly. Effective July 1, 2025: biometric identifiers deleted at the earliest of purpose satisfied, 24 months after the consumer's last interaction, or 45 days after the controller determines storage is no longer necessary. Tier 1 (bill page: https://leg.colorado.gov/bills/hb24-1130); summary used for verification: Paul Hastings, July 2025, https://www.paulhastings.com/insights/ph-privacy/colorado-imposes-new-privacy-requirements-on-organizations-collecting-biometric-identifiers-and-data (accessed 2026-10-16)
12. Understanding and adjusting your video storage time, Ring. US video storage options from 1 to 180 days; default 60 days for 1080p and 2K devices and 30 days for 4K devices. Tier 2 (vendor documentation). https://ring.com/us/en/support/articles/1nce1/Understanding-and-Adjusting-Your-Video-Storage-Time (accessed 2026-10-16)
13. Learn about event and 24/7 video history, Google Home Help. Google Home Premium Standard: up to 30 days of event video history; Advanced: up to 60 days of event history and up to 10 days of 24/7 history on wired models; without a subscription, 3 to 6 hours of event video on recent Nest cameras. Tier 2 (vendor documentation). https://support.google.com/googlehome/answer/9681538?hl=en (accessed 2026-10-16)
14. Council of the EU approves Digital Omnibus on AI, Cuatrecasas (June 30, 2026). Council final approval on June 29, 2026; obligations for stand-alone Annex III high-risk AI systems apply from December 2, 2027. Tier 4 (law-firm analysis of the official act). https://www.cuatrecasas.com/en/global/intellectual-property/art/council-eu-approves-digital-omnibus-ai (accessed 2026-10-16)
15. Video surveillance (including guidance for organisations using CCTV), UK Information Commissioner's Office. Sets no fixed retention period; notes the guidance is under review after the Data (Use and Access) Act. Tier 2 (regulator guidance). https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/cctv-and-video-surveillance/guidance-on-video-surveillance-including-cctv/ (accessed 2026-10-16)
16. Data protection conference: high hurdles for video surveillance in the retail sector, Oppenhoff (September 11, 2020). Reports the German Data Protection Conference (DSK) position that storing video beyond 72 hours is normally permitted only in exceptional cases. Tier 4 (law-firm report of regulator position). https://www.oppenhoff.eu/en/news-detail/data-protection-conference-high-hurdles-for-video-surveillance-in-the-retail-sector (accessed 2026-10-16)
17. Video surveillance retention requirements by sector (banking, casino, cannabis, retail), ECAM / Mammoth Security / industry references. Corroborated sector retention practice — banking ~90 days to 6 months, cannabis 30–90 days, retail 30–90 days — used as the basis for the sector-minimum table; cross-checked against the Nevada Gaming and state-cannabis primary sources where available. Tier 5 (institutional). https://ecam.com/security-blog/what-you-need-to-know-about-video-surveillance-retention-requirements (accessed 2026-06-09)
18. EDPB, "Video devices & data protection: when to act and what to do" (April 2026 awareness summary), European Data Protection Board. A 2026 first-party restatement of Guidelines 3/2019 confirming the storage-limitation expectation ("a retention period of a few days should often be appropriate") and the automatic-erasure recommendation remain current. Tier 2 (issuing-body guidance). https://www.edpb.europa.eu/system/files/2026-04/summary_edpb_guidelines_201903_video_devices_en.pdf (accessed 2026-06-09)

Where sources disagreed, the official law and standard were followed and the controlling fact stated plainly. The most common contested claim — that "PCI DSS requires 90 days of video" — is half true: Requirement 9.2.1.1 sets a three-month minimum only for video or access records of entry to sensitive card-data areas, not for sales-floor or POS cameras, so the article follows the standard text and flags the over-broad reading. Earlier versions of this article called the claim a pure myth; that was corrected in October 2026. On the EU side, the EDPB video guidance (Guidelines 3/2019, reaffirmed April 2026) overrides the cheap-storage instinct to keep footage indefinitely; the article follows the guidance toward short default retention and treats any longer period as needing a named, defensible purpose. Sector-minimum figures are stated as examples to verify against the live regulation for the specific jurisdiction, not as universal numbers.