![EGO Wiry Max 100W USB 3.0 Type - C to C Cable - 20cm/1m/2m [香港行貨] - DIGIBAL ONLINE1](https://img.myshopline.com/image/store/1759472791688/ego-wiry-max-100w-usb-30-type-c-to-c-cable-20cm1m2m-digibal-online-357276.webp?w=800&h=800)
![MOMAX ONEPLUG PD20W 2A2C 11位直立拖板 [香港行貨]-DIGIBAL ONLINE](https://img.myshopline.com/image/store/1759472791688/US11UKE.webp?w=722&h=707)
DIGIBAL ONLINE Editorial｜Last updated 2026-10-27｜Singapore
- 3 items｜purpose, organisation identity, privacy contact — the minimum a notice must carry
- 2 regimes｜publicly accessible premises vs restricted premises (card-access office, staff-only rooms)
- 30 days｜a workable default retention for a small shop; write it into policy and enforce it
- 0 cameras｜in toilets and changing rooms — ever
- 1 masking step｜the practical answer to "footage shows my staff and a customer"
Does PDPA apply to my shop's cameras?
Yes, whenever footage can identify an individual and the cameras are operated by an organisation — which a shop is. The Act governs collection, use and disclosure of personal data, and CCTV footage of identifiable people is personal data.
| Premises type | Consent | Notice | Reasonable purpose |
|---|---|---|---|
| Publicly accessible (shop floor, restaurant, mall unit) | Generally not required for publicly observable data, but good practice | Not strictly required for public areas, but expected practice | Required |
| Restricted (office with card access, staff-only back room, stockroom) | Required — notices at entry are the usual mechanism | Required | Required |
| Toilets, changing rooms, lactation rooms | Do not install. Coverage of these areas can amount to a criminal offence. | ||
The point most shops miss: the stricter regime is not the shop floor, it is the back room. A stockroom camera pointed at staff lockers, or a camera in a staff rest area, is where complaints originate — and that is exactly the camera nobody thought to write a notice for.
What must the notice actually say?
Three things, in plain language: what it is for, who is operating it, and who to contact. Everything else is optional.
- Purpose. "For security and loss prevention" is acceptable. "CCTV in operation" on its own is not — it states the fact but not why.
- Identity of the organisation operating the cameras. The shop's registered entity name, not just the trading name on the signboard.
- Privacy contact. An email or phone number a person can write to. A generic "ask our staff" is not a contact point.
Bilingual notice you can print
This is the wording we hand to clients. It is deliberately short — a notice nobody reads satisfies no one. Replace the bracketed fields.
Footage is recorded and retained for up to 30 days, then erased.
Operator: [Registered company name]
Privacy enquiries: [privacy@yourcompany.com] / [phone]
Recorded footage is retained for up to 30 days and automatically deleted thereafter.
Operator: [Registered company name]
Privacy enquiries: [privacy@yourcompany.com] / [phone]
How long can I keep the footage?
No longer than the purpose requires — and you must be able to show that the period is deliberate. The PDPA does not fix a number; the regulator's position is that footage should not be retained when the purpose has expired, and that organisations should review retention rather than keep everything forever.
| Shop type | Workable retention | Why |
|---|---|---|
| Small retail, low dispute volume | 14–30 days | Incidents and chargebacks surface within days to weeks |
| F&B with staff tips and cash handling | 30 days | Roster and cash disputes often surface at month end |
| Shop with insurance claims history | 30–60 days | Insurers may ask for footage weeks later |
Whatever you choose, three things must be true: the period is written in your privacy policy, the recorder is actually configured to overwrite on that schedule, and the notice states the period. A policy that says 30 days next to a recorder holding 90 days is worse than no policy — it is a documented inconsistency.
Retention drives hardware sizing. A 2TB disk holds about 3.9 days with 8 cameras at 6 Mbps — far short of 30 days. The arithmetic is in CCTV cost for a small shop in Singapore.
What happens when someone asks for the footage?
Individuals can make access requests, and your obligation is to respond — with masking where the footage shows other people. This is the operational gap in most shops: the request arrives at the counter, staff do not know who handles it, and the shop either refuses flatly (a breach) or hands over a raw file containing other customers' faces (also a problem).
A workable process, small enough to actually be followed:
- One named person receives requests — usually the manager, not the counter staff.
- Log it: date, time window requested, requester, ID sighted, decision.
- Export only the relevant window, then mask other individuals' faces before release where feasible.
- Do not release footage of a third party's incident to an unrelated requester — that is disclosure, not access.
- Keep the log — it is your evidence that you handled the request reasonably.
Staff monitoring: the camera people forget to document
Monitoring employees is lawful but must be disclosed and proportionate. Three practical rules:
- No cameras in rest areas, locker rooms or toilets. If a camera incidentally covers a staff break corner, re-aim it.
- Say it in the employment terms不仅要张贴在墙上——员工应在开始工作前就知情，而不是事后才发现。
- 不要将店内摄像头用于绩效监控除非该目的已明确说明且符合比例原则。比如，告示写的是防损，却使用安保录像来调查某人的收银速度，这就属于目的不一致。
这样做到底需要多少实际成本？
合规工作本身不产生费用；但要支持 30 天的录像保留期限，就需要相应的硬件。这就是政策与采购订单衔接的地方：一块 2TB 硬盘在 8 个摄像头、6 Mbps 码率下只能保存 3.9 天，因此，明确规定保留 30 天就需要大约 16TB——或者减少摄像头数量，或将 4 个过道摄像头的码率调低，同时保持收银台和入口摄像头的高码率。
| 规定的保留期限 | 摄像头数量 | 所需硬盘空间（6 Mbps） | 实际建议 |
|---|---|---|---|
| 14 天 | 8 | ≈7TB | 购买一块 8TB 硬盘，或将过道摄像头降至 4 Mbps，同时保留 2TB |
| 30 天 | 8 | ≈16TB | 两块 8TB 硬盘，或全部采用 4 Mbps，约需 8TB |
| 30 天 | 4 | ≈8TB | 较小的店铺使用一块 8TB 硬盘即可保存 30 天 |
| 60 天 | 8 | ≈32TB | 对店铺而言通常没有必要；应先重新考虑设置该期限的目的 |
计算方式：1 GB = 8,000 Mbit，H.265 采用 6 Mbps。实际数值会因画面动态和智能编码而上下浮动 ±30%。一套配备 8 个摄像头的 2TB 方案价格约为 S$1,498——其容量按保存数天而非数周设计；请参阅明细清单.
这与市镇理事会审批有什么关系？
这是两个独立的审批环节，通过其中一个并不代表满足另一个。市镇理事会授权针对的是安装在公共物业上的实体设备；PDPA 针对的是你之后如何处理录像。摄像头即使获得了完全合法的授权，如果没有告示和录像保留政策，仍然可能不合规。
可行的流程是：先批准安装位置（参见HDB 商铺 CCTV 审批），然后在系统上线前设定告示和保留期限——不要等到上线后才处理。同时确认安装人员持有许可证；相关检查方法请参阅如何检查安装人员的许可证。
常见问题
只张贴“CCTV 正在运行”告示就够了吗？
我需要征得每位顾客的同意吗？
我可以为了“以防万一”而无限期保留录像吗？
如果顾客要求查看涉及其本人的事件录像，该怎么办？
如果我只有一个门铃摄像头，这些规定也适用吗？
相关文章
- HDB shop CCTV approval — Town Council steps, timelines and a letter template
- CCTV cost for a small shop in Singapore — hardware basket and storage math
- How to check your CCTV installer's licence — before you pay a deposit
- Hong Kong version — PDPO notice duties and Hong Kong building rules
Sources and method
- Obligations, premises categories, notice content and access-request handling: SingaporeLegalAdvice summary of PDPA requirements for CCTV.
- Statute: Personal Data Protection Act 2012. Regulator: Personal Data Protection Commission — check the current advisory guidelines before finalising your policy.
- Retention figures are our operational recommendations for shop scale, not regulatory limits; the PDPA sets no fixed number.
- Not legal advice. Have your policy reviewed if you handle large volumes of footage or monitor staff.