Quick answer: No US federal law and no Canadian statute sets one retention period for security video. The number comes from whichever rule reaches the site: a sector regulator (cannabis, gaming, law enforcement), a contractual standard (PCI DSS asks for at least three months of video or access data for sensitive payment areas), privacy law that caps how long footage may be kept (state privacy laws in the US; PIPEDA and the provincial laws in Canada), and the customer’s own written policy. The installer turns that number into drives, sets the recorder to match and documents it. Formula: GB per camera = average Mbps x 10.8 x days. This is a technical summary, not legal advice.
Who actually sets the retention period?
The floor comes from a regulator or a contract that says footage must exist for a minimum time; the ceiling comes from privacy law, which says footage may not be kept longer than the purpose requires. Most commercial sites have no floor at all, so the customer chooses a default, commonly 30 to 90 days as practice, not law, and the installer sizes storage for it. Four sources set the number:
- Sector regulators. Cannabis licensing bodies in US states and the federal Cannabis Regulations in Canada, gaming commissions and law-enforcement standards bodies publish explicit minimums.
- Contractual standards. PCI DSS applies to any merchant that stores, processes or transmits card data; requirement 9.2.1.1 of version 4.x (verify the current version and numbering) asks that video or access-control data for sensitive areas be stored for at least three months unless restricted by law.
- Privacy law. In the US, comprehensive state privacy laws and biometric statutes such as Illinois BIPA impose retention limits on personal or biometric data. In Canada, PIPEDA and the Quebec, BC and Alberta laws require footage to be kept only as long as the documented purpose needs (see video surveillance privacy in Canada).
- Litigation and evidence. Once an incident occurs or a claim is reasonably anticipated, relevant footage must be preserved regardless of the overwrite setting; this legal-hold step needs an export procedure, not a longer loop.
Retention examples by industry (sourced and dated)
The figures below are the published rule or standard as understood on October 20, 2026. Before you write any of them into a proposal, open the current text, quote the section and date the check.
| Sector | Published minimum or practice | Source of the rule | Note for the installer |
|---|---|---|---|
| Card-payment environments (US and Canada) | At least 3 months of video or access-control data for sensitive areas | PCI DSS v4.x, requirement 9.2.1.1 (verify the current version) | Contractual, through the card brands; applies to cameras covering sensitive areas of the cardholder data environment (for example server rooms or back offices housing payment systems), not the whole site |
| Cannabis, US states | Set by each state (for example 30 days in Colorado, 45 days in Washington, 90 days in California, Oregon and Illinois; verify the current rule) | State cannabis regulator rules | Many states also set resolution, frame rate and coverage rules; read the whole surveillance section |
| Cannabis, Canada (federal license holders) | Recordings retained at least 1 year | Cannabis Regulations under the Cannabis Act | Continuous coverage of operations and storage areas; a year of continuous video drives the largest storage designs |
| Law enforcement body-worn video, Texas | At least 90 days | Texas Occupations Code, body-worn camera provisions (TCOLE standards) | Public-sector example; fixed-camera retention for the same agency follows its records schedule |
| Law enforcement body-worn video, New York City | 18 months by default | NYPD department policy, as published | A records policy can far exceed a statutory minimum |
| Casino gaming, Nevada | Routine surveillance recordings at least 7 days; longer minimums for recorded incidents | Nevada gaming surveillance standards | Verify the current standard with the regulator; incident retention is usually the design driver |
| Banks and credit unions (US) | No fixed number; set by the institution’s security program | Bank Protection Act and its regulations | Surveillance is required; retention is a policy decision you size for |
| General commercial (US and Canada) | No mandate; 30 to 90 days common practice | Customer policy; privacy law caps the maximum in Canada | Write the number and its reason into the handover file |
Cannabis: state rules and Health Canada
In the US, each legalizing state writes its own surveillance section: minimum retention commonly runs from 30 to 90 days (Colorado 30 days, Washington 45 days, California, Oregon and Illinois 90 days; verify each state’s current rule), and most states also prescribe continuous recording of specific areas, minimum resolution, frame rate and a failure-notification duty. In Canada, the federal Cannabis Regulations require license holders to keep visual recordings for at least one year, and provincial retailers add their own licensing conditions; a 40-camera cultivation site with a year of continuous recording is a storage design first and a camera design second. Our cannabis facility camera guide covers coverage and documentation; here the point is arithmetic: a year of continuous 4 Mbps video is about 15.8 TB per camera before any margin, and the 90-day figure is about 3.9 TB per camera.
How do you translate days into terabytes?
One megabit per second for one day is 86,400 megabits, or 10,800 megabytes:
GB per camera = average bitrate (Mbps) x 10.8 x days, then multiply by the camera count and add 10 to 15 percent for overhead and bitrate peaks. Use the camera’s measured average bitrate for its actual scene and settings; a printed resolution says nothing about bitrate, and compression savings such as S+265 are confirmed per model and scene, not assumed.
| Average bitrate per camera | 30 days | 90 days | 365 days |
|---|---|---|---|
| 2 Mbps | 0.65 TB | 1.9 TB | 7.9 TB |
| 4 Mbps | 1.3 TB | 3.9 TB | 15.8 TB |
| 8 Mbps | 2.6 TB | 7.8 TB | 31.5 TB |
Worked example. Sixteen cameras at an average 4 Mbps, continuous, 30 days: 16 x 4 x 10.8 x 30 = 20,736 GB, about 20.7 TB, or about 23 TB with margin. At 90 days the same site needs about 62 TB, and at 365 days about 252 TB. Match that to what the recorder prints: the CS-N440 M-AI prints 4 x 10 TB HDD, so 40 TB is its printed maximum and the 90-day case at 4 Mbps does not fit without lowering bitrate or moving to event-based recording; the CS-N880 H-AI prints 8 x 24 TB HDD, 192 TB, which carries the 90-day case with room and still needs bitrate or recording-mode changes for a full year at that rate. The CS-N220 P16H-AI prints up to 10 TB capacity for each HDD; take the bay count from its spec sheet. The NVR storage calculator works the same arithmetic for 10, 20, 40 and 80 channels, and the Search Config Tool includes a storage calculator for a technical cross-check on the bench.
Three settings decide whether the installed drives deliver the promised days: the overwrite or expiry setting, the recording mode (continuous versus event) per camera, and the per-camera bitrate cap. After a week of live operation, open the playback calendar and confirm that the oldest recording is where the policy says it should be; write that check into the commissioning report.
How do you document the policy for the customer?
Copy this template into the handover file, one per recorder:
| Field | Example entry |
|---|---|
| System and site | Main recorder, warehouse and yard, 24 cameras |
| Default retention and basis | 45 days continuous; customer policy, no regulatory minimum applies |
| Regulatory minimum (if any), section and date checked | PCI DSS v4.x req. 9.2.1.1, payment-system back-office cameras only, 3 months; checked 2026-10-20 |
| Privacy maximum (if any) | Canada: as long as the purpose requires; policy sets 45 days |
| Recording mode per camera group | Continuous on dock and cash office; event-based on corridors |
| Measured average bitrate and calculated capacity | 2.8 Mbps average; 24 x 2.8 x 10.8 x 45 = 32.7 TB, about 37.6 TB with 15 percent margin |
| Installed capacity and recorder | 40 TB on CS-N440 M-AI (printed 4 x 10 TB HDD) |
| Legal-hold and export procedure | Named person exports to external media within 24 hours of an incident; export log kept |
| Who may change retention settings | Operations manager; installer on written request |
| Verification and review dates | Oldest-recording check at commissioning plus 7 days; policy review every 12 months |
Record the real export procedure (user, menu, media) so the customer can preserve evidence without calling you; our guide to exporting evidence from a CASE NVR is written for that handover. And when the customer adds cameras or raises bitrate later, treat it as a retention change: the days fall unless the drives grow.
What to tell your customer
“No single law tells you how long to keep video. We identify any minimum that applies to your sector, respect any privacy limit on the maximum, and then you choose the default period as policy. We size the drives for that number, set the recorder to match, verify it after a week and document it all, including how your team preserves footage after an incident.”
FAQ
How long do most businesses keep security camera footage?
Where no regulator sets a minimum, 30 to 90 days is common practice in the US and Canada, chosen by the customer as policy rather than required by law. Sector rules change that: card-payment environments need at least three months for sensitive areas under PCI DSS, Canadian cannabis license holders need a year, and US cannabis states set their own figures. Document the reason beside the number.
Does PCI DSS require video surveillance retention?
PCI DSS version 4.x, requirement 9.2.1.1 (verify the current version), asks merchants to monitor individual physical access to sensitive areas with video cameras or physical access-control mechanisms and to store the collected data for at least three months unless restricted by law. It is a contractual standard applied through the card brands, so confirm scope with the customer’s PCI assessor and size the covering cameras for the three months.
How long must cannabis facilities keep video?
In the US each state sets its own minimum, commonly between 30 and 90 days, with Colorado at 30 days, Washington at 45 days and California, Oregon and Illinois at 90 days (verify each state’s current rule). In Canada the federal Cannabis Regulations require license holders to keep recordings for at least one year. Read the full surveillance section of the applicable rule, which usually also fixes coverage, resolution and frame rate, and date your check.
How many terabytes do I need for 30 days of video?
Multiply the average bitrate per camera in Mbps by 10.8 to get gigabytes per day, then by 30 and by the camera count, and add 10 to 15 percent margin. Sixteen cameras at 4 Mbps need about 20.7 TB for 30 days, about 23 TB with margin. Measure the real bitrate on site; resolution alone does not determine it, and compression savings are confirmed per model and scene.
Can privacy law force a business to keep footage for less time?
In the US, state privacy and biometric laws limit how long specific data types may be kept. In Canada, PIPEDA and the Quebec, BC and Alberta laws require personal information, including identifiable video, to be kept only as long as the documented purpose needs, so a long default loop with no stated reason is a problem. Where a minimum and a privacy limit both apply, document how both are met.
References
- Data retention — Wikipedia
- Payment Card Industry Data Security Standard — Wikipedia
- Cannabis Act (Canada) — Wikipedia
- Legal hold — Wikipedia
- Body camera — Wikipedia
- 4 CCR § 15044 Video Surveillance System — California Code of Regulations (Cornell LII)
- WAC 314-55-083 Security and traceability requirements — Washington State Legislature
- 1 CCR 212-3, Rule 3-225 Video Surveillance — Colorado Marijuana Rules
