Who this suits: Businesses setting recording retention and incident-export procedures.
Direct answer: there is no universal business retention number
Choose a retention period that supports a defined business purpose and applicable obligations, while avoiding unnecessary retention of personal information. Seven, thirty or ninety days is not automatically correct for every Australian business. The relevant questions include when incidents are normally discovered, how long it takes to request footage, what agreements require and what privacy or other rules apply to the circumstances.
This is an operational planning guide, not legal advice or a determination of your obligations. Seek appropriate advice for the business, premises and use. Do not choose a period merely because a drive happens to hold it, and do not assume a larger storage budget justifies keeping everything indefinitely.
Start with discovery and reporting delays
List the events for which footage is genuinely useful: a delivery dispute, missing stock, property damage, an unauthorised entry or a customer incident. For each, estimate the normal delay before someone notices and asks for a review. Use actual incident records if available. Distinguish an immediate alarm from a stock discrepancy discovered at the next count.
Include weekends, holidays, staff absence and the time needed for an authorised person to retrieve and preserve a clip. A recording that overwrites before the request reaches the manager provides little help. Conversely, a very rare hypothetical complaint years later does not, by itself, establish that continuous identifiable footage should be held for that entire period.
Worked example: a reporting window, not a legal rule
Assume a warehouse checks discrepancies every fourteen days, management may take up to three more days to review them, and a holiday period could add four days. On those illustrative operational assumptions, the potential discovery-and-action window is twenty-one days. A preliminary thirty-day recording proposal could provide margin, subject to the actual business purpose and applicable advice.
That is not a recommendation that all warehouses need thirty days or a claim that thirty days satisfies any law. If incidents are reported much sooner, the justified window could be shorter. If a specific contractual or regulatory requirement applies, the design needs to address it appropriately. Write the assumptions down and validate them with the people who handle real requests.
Separate rolling recordings from preserved incidents
Routine recording usually operates as a rolling buffer, overwriting according to configuration and available capacity. An authorised incident export is a separate record with its own purpose, access, retention and disposal decision. Keeping a clip for an active matter is different from retaining all footage indefinitely in case something eventually happens.
Define who can preserve footage, how the reason and date are recorded, where the original export is stored and who can authorise access. Avoid copying clips into personal cloud folders or group chats for convenience. A request may need privacy, legal or insurer advice. Do not destroy or alter material when an applicable preservation obligation or authorised hold requires it to remain available.
Consider privacy coverage and other requirements
The OAIC explains that organisations covered by the Privacy Act must handle personal information collected through surveillance under the Australian Privacy Principles. Its security-camera guidance addresses security and disposal when information is no longer needed. APP 11 guidance includes qualifications, such as information required to be retained under law or an order. The correct action depends on circumstances.
The OAIC also explains that some small businesses are covered even though many are not. Do not infer coverage solely from staff count or assume an exemption settles state or territory surveillance and workplace issues. Audio, staff monitoring and sensitive locations can raise additional questions. A supplier's standard retention setting is not a legal opinion for your business.
Convert the policy into a technical requirement
Once a period is justified, specify which cameras and streams it applies to, whether recording is continuous or event-based, and how gaps will be detected. State a minimum observed retention under the approved image-quality settings rather than relying only on nominal disk capacity. Ask how the recorder handles full storage, drive failure and manual changes.
Use the storage estimator for capacity planning, but keep policy and calculation separate. The tool cannot determine a lawful period or guarantee actual retention. Event recording can have missing periods because no event was recorded; that is not equivalent to uninterrupted coverage of the same calendar window. Confirm that the chosen mode matches the business purpose.
Verify the actual oldest usable recording
After the system has operated long enough, check each channel's oldest usable footage and inspect representative periods for gaps. A date highlighted in a calendar does not prove the required clip exists. Confirm timestamps and daylight-saving behaviour, and test playback and export with an authorised operator. Record the settings and observed result.
Repeat checks after adding cameras, changing quality, replacing drives or altering recording schedules. Capacity pressure can silently shorten the rolling window. Do not solve a shortfall by reducing quality below the agreed evidence task without approval. Investigate the cause and compare changes to storage, settings and recording mode transparently.
Document the operational response to an incident
Give staff a simple way to report the approximate event time, location and reason for review without granting unrestricted access to footage. Decide who checks the request, who retrieves the relevant period and how any authorised export is logged. Include a deputy so the process still works during leave. A longer rolling window does not compensate indefinitely for a request that nobody owns.
When a matter is preserved, record the relevant camera, time range, export date, authorised custodian and review trigger. Keep the original as appropriate and manage working copies. Ask the responsible adviser how an active investigation, dispute or other preservation requirement changes normal disposal. Separate these decisions from routine overwrite so a storage upgrade or recorder replacement does not accidentally remove material the business has agreed or is required to retain.
Frequently asked questions
Does a thirty-day drive estimate mean I have thirty days? No. Actual bitrate, usable capacity, recording activity, faults and configuration affect the result. Treat the estimate as provisional until observed and continue monitoring. A drive label gives capacity, not a verified retention guarantee.
Should exported footage be kept forever? Not automatically. Decide its specific purpose, any applicable preservation requirements, authorised access and review date. Track copies so disposal or continued retention can be managed appropriately. An export outside the recorder is still potentially sensitive business information and should not disappear from the retention process merely because it is no longer in the rolling buffer.
Put the decision into a short policy
Record purposes, cameras in scope, ordinary rolling period, incident-preservation process, access roles, review frequency and the adviser or owner responsible for questions. Keep staff instructions practical: how to request footage promptly, who can export it and where approved exports belong. Review the policy when operations or obligations change, rather than copying another business's number.
For premises context, see warehouse planning or office planning. If the technical requirement is defined, request equipment options for the intended recording window. BoxFreeIT and Security Wholesalers share ownership. Equipment selection can support a chosen policy, but a related supplier recommendation should not be mistaken for independent legal or compliance assurance.
Sources and review notes
Official references used for this guide. Product features and terms can change. Examples are illustrative unless explicitly described otherwise.