Quick answer: Start with the retention requirement that actually applies to the site, then size and verify storage for it. A sector rule, contract, privacy purpose or records policy may set different conditions. No single number in an installer’s chart should be treated as the retention rule for every US or Canadian business.
On this page
Who chooses the recording period?
The customer should identify the applicable licence, contract or records-policy requirement and the person authorized to approve the policy. The installer translates that decision into supported recording settings, usable storage and verification. If two requirements appear to conflict, resolve that with the customer’s qualified advisers before setting an overwrite period.
Keep routine overwrite separate from an incident-preservation instruction. A useful policy explains who receives a request, which footage is protected or exported, where it is stored and who may later release it. The customer should settle when a legal hold applies; the installer should make the approved preservation process workable. Use the recording export workflow to document the approved evidence-handling steps.
Which industry examples are useful without becoming blanket rules?
The following are narrow examples from the cited published material, not an exhaustive legal schedule or a completed assessment. Record the jurisdiction, licence/assessment scope, version, section and check date beside the actual project requirement. The Oregon example cites the named January 2026 order; verify the rule and licence conditions currently applicable to the premises.
| Example | Published requirement or reference | Scope and installer action |
|---|---|---|
| PCI DSS v4.0 published example, sensitive areas within the cardholder data environment | Requirement 9.2.1.1 addresses at least three months of collected physical-access monitoring data unless law restricts it. | Published v4.0 example: video, physical access-control mechanisms or both may be used. Confirm the current assessment version and in-scope areas with the customer’s assessor; this is not every camera at every merchant. |
| Oregon licensed cannabis premises | OAR 845-025-1450(2)(c): minimum 90 calendar days; OLCC 6-2025 effective January 1, 2026. | Read the full current rule and licence conditions, including separate backup and recording-mode requirements. |
| Washington licensed cannabis premises | WAC 314-55-083(3): recordings kept for a minimum of 45 days on the licensee’s recording device. | Read the complete current surveillance section for the licensed premises, including continuous recording, coverage, time/date and protected recorder requirements. |
| Canadian federal cannabis licences referred to in subsection 62(1) | Section 73: qualifying recordings made under section 64 or 70 are retained for at least one year. | The listed federal licence scope matters. For a motion-activated device, the provision concerns recordings depicting movement; without that feature it concerns all such recordings. Do not apply this automatically to every cannabis retailer or licence type. |
In Canada, subsection 62(1) names standard cultivation, standard processing, sale licences authorizing possession, and cannabis drug licences only above its stated quantity condition. Check the actual licence and site against that scope; provincial retail rules and other licence types need separate review. Section 73’s treatment of motion recordings does not justify an event mode that misses activity required to be recorded.
How do you translate bitrate and days into storage?
For continuous recording, a decimal planning calculation is GB = average Mbps × 10.8 × days × camera count. Divide by 1,000 for decimal TB. Use a measured or deliberately conservative bitrate for the actual scene, codec and recording settings, rather than inferring bitrate from resolution alone. Cross-check those inputs with the NVR storage calculation guide.
| Average bitrate per camera | 30 days | 90 days | 365 days |
|---|---|---|---|
| 2 Mbps | 0.648 TB | 1.944 TB | 7.884 TB |
| 4 Mbps | 1.296 TB | 3.888 TB | 15.768 TB |
| 8 Mbps | 2.592 TB | 7.776 TB | 31.536 TB |
For 16 cameras averaging 4 Mbps continuously for 30 days, the video-data estimate is 20,736 GB, or 20.736 decimal TB. Adding 15% of that video-data estimate gives 23.8464 TB. That allowance is an example, not a guarantee: reserves, audio, recording metadata, filesystem use, RAID configuration, bitrate variation and supported drive limits must be accounted for in the actual design.
For equipment selection, compare supported bay/drive limits and usable capacity for the exact recorder revision. Do not treat the sum of drive labels as verified usable retention, or assume that an export copy automatically satisfies a separate off-site recording requirement.
How do you verify the installed recording window?
- Record the approved days and recording mode for each camera group.
- Confirm the actual storage configuration, healthy recording state, time settings and stream configuration.
- Log measured bitrate assumptions and the planned reserve separately.
- At commissioning, distinguish calculated retention from footage that can already be observed.
- Schedule an oldest-recording check after enough operating time has elapsed; a new system cannot demonstrate a 90-day history after one week.
- Recheck after adding cameras, changing bitrate or recording mode, replacing drives or changing storage protection.
What belongs in the customer’s policy and handover file?
Record the approved period and basis; affected camera groups; recording mode; capacity calculation and reserve; exact equipment/firmware; authorized change roles; evidence-preservation process; and the dates for an initial check, mature retention check and review. Keep the exact source in that record, such as the Washington licensed-cannabis surveillance rule only where that rule applies to the premises.
Keep the policy and handover record aligned with the actual camera groups, access permissions, notices and recording configuration. Name the customer’s policy owner, and mark unresolved approvals and later verification dates clearly.
FAQ
Is 30 days a legal default?
No. It can be a customer policy choice for a particular project, but first identify requirements and limitations that reach the site.
Can a larger recorder solve a policy question?
No. Settle the applicable policy first. When selecting a network video recorder, verify the exact revision’s supported storage configuration and usable recording window; extra drive bays do not approve a retention period.
Can event recording be assumed to save a fixed percentage?
No. Savings depend on the scene and trigger performance, and an applicable recording requirement may constrain the mode. Test the proposed design and document its assumptions. Where a rule allows motion recording subject to conditions, verify those conditions instead of assuming an ordinary event setting qualifies.
What should you send Anabon before equipment selection?
Provide the approved retention basis, camera groups, recording modes, measured bitrate assumptions and required usable capacity. Keep unresolved legal or assessment scope as an open item. For model-specific controls and supported drive configuration, contact security camera technical support.
References
References checked October 29, 2026. The PCI row is a published v4.0 example; confirm the current assessment version. The Oregon row cites the named order, and the Canadian pages display a consolidation current to September 30, 2026. Recheck current requirements and actual project scope before a commitment.
- PCI SSC — current document library
- PCI SSC — SAQ D for Merchants v4.0, physical PDF page 72: published 9.2.1.1 example, not confirmation of the current assessment standard.
- Oregon OLCC 6-2025 — permanent order, OAR 845-025-1450
- Washington State Legislature — WAC 314-55-083(3)
- Canada Cannabis Regulations, subsection 62(1)
- Canada Cannabis Regulations, section 73
