Under Malaysia's Personal Data Protection Act 2010, CCTV footage that identifies a person is personal data, and face recognition uses biometric data, which is treated as sensitive. Shops should display clear notices, collect only what they need, limit access, keep footage for a defined period and get proper advice before enabling face recognition. This article is general information, not legal advice.
AI cameras can now recognise faces, count visitors and flag repeat incidents in a shop. These tools are powerful, but they also touch personal data, and in Malaysia that means the Personal Data Protection Act 2010 (PDPA). Here is a practical overview of what shop owners should think about before turning features on.
Is CCTV footage personal data?
When footage can identify a person, such as a clear face or a licence plate, it can count as personal data. Collecting it for security is normally a legitimate purpose, but the PDPA still expects you to handle it responsibly: tell people it is being recorded, protect it, and not use it for unrelated purposes.
Display clear CCTV notices
Put visible signs at entrances and in monitored areas stating that CCTV is in operation and the purpose. A short notice with the business name and contact details is a good habit. Signs also act as a deterrent, which is the main reason most shops install cameras in the first place.
Face recognition is different
Face recognition processes biometric data, which the PDPA treats as sensitive personal data and which generally needs explicit consent. For ordinary shop security, people counting and event detection do the job without identifying individuals. Think hard about whether you truly need face matching before enabling it.
Limit access, retention and sharing
Only authorised staff should be able to view or export footage. Keep it for a defined period, such as 30 days, and then let it overwrite. Share clips with police or insurers only through a documented process. Strong passwords, user accounts and an access log protect you if questions arise later.
Choose privacy-friendly AI features
Many useful AI features do not identify people at all: people counting, queue length, line crossing and zone intrusion. They improve safety and operations while keeping data minimal. Where recognition is needed, such as for access control, keep it on-premises and tell users clearly.
Key takeaways
- Identifiable CCTV footage is personal data under the PDPA.
- Display notices and limit who can view footage.
- Face recognition uses sensitive biometric data and needs care and consent.
- Prefer features like people counting that do not identify individuals.
- Seek legal advice for your specific case.
Further reading
Related articles from our blog:
- AI camera vs standard camera: which do you really need?
- Protecting your CCTV system from hacking
- CCTV maintenance checklist for business owners
Trusted external sources: Personal Data Protection Department, Malaysia and Hikvision official website.
Frequently asked questions
Do I need a sign for CCTV in my shop?
It is strongly recommended and expected as part of notifying people that they are being recorded. Place signs where they can be seen before entering the area.
How long can I keep CCTV footage?
Keep it no longer than necessary for your purpose. Many shops use 30 days, longer only if an incident needs to be investigated.
Is this legal advice?
No. This is general information. Speak to a qualified adviser about your own obligations under the PDPA.
Need help choosing?
Dr. CCTV by Yury Tech Sdn Bhd designs and installs CCTV, AI cameras, access control and alarm systems across Johor Bahru. Explore: AI Cameras, Access Control, or book a free site survey and we will recommend the right system for your property.
