A retention policy is the rule for how long recorded video is kept before it is automatically deleted. It is not a disk size — it is a decision, and the two are often confused: a system that "keeps 30 days" frequently keeps 30 days only because that is when the disks fill and the oldest footage is overwritten, which is an accident of capacity, not a policy. A real retention policy states a target duration per camera or class and sizes storage to meet it.
The defining idea is that retention has two opposing limits. There is a minimum — operational needs and sector rules that say keep footage at least so long (gaming, banking, and cannabis sectors set explicit minimums) — and a maximum, because privacy law caps how long you may keep personal data. Under GDPR Article 5(1)(e) footage must not be kept longer than necessary, and EDPB Guidelines 3/2019 point to a few days as typical for ordinary CCTV. Different footage can have different clocks: one system, many retention periods.
The pitfalls are capacity-driven retention and forgetting the maximum. Letting the disk size decide retention means you cannot answer "how long do we keep footage and why", which is exactly what a regulator or court asks. Deletion should be policy-driven (ONVIF Profile G exposes a maximum retention time), logged, and applied consistently — and a legal hold must be able to override it to preserve specific footage for an investigation. This is engineering guidance, not legal advice; confirm specifics with qualified counsel.
