A site has cameras everywhere. The system has run reliably for years. Then something happens — an incident, a dispute, a claim — and somebody goes to pull the footage.
It isn’t there. Not because the system failed. Because the event happened longer ago than the recorder keeps.
This is one of the most common serious failures in commercial CCTV, and it is almost never a fault. Everything worked exactly as configured. The configuration was simply set by how much disk was in the box rather than by how long the business might need to prove something.
How it actually plays out
The pattern is consistent enough to describe generically.
A claim arises. Somebody asks for footage of the incident. The recorders are checked, and the earliest available recording turns out to be more recent than the date in question. Retention across the site is around two months. The incident falls outside it.
The footage was recorded. It was then overwritten by newer footage, exactly as the system was told to do.
Nobody had done anything wrong. But the business now has a system that records everything and can prove nothing about the event that mattered.
Specifying it is not the same as having it
Here is the part that should worry anyone who assumes a good specification protects them.
That site had one. Two years before the claim, its retention had been set out in writing, properly, as part of a considered specification: a large channel-count recorder, a defined frame rate, cameras specified by area and environmental rating — and an explicit requirement that the recorder be sufficiently configured and licensed to store six months of footage.
Six months, specified. Roughly two months, in reality, when it was finally needed.
The records do not establish where that gap came from, and it would be wrong to assign blame for it. There are several ordinary explanations and no evidence for any one: cameras added after commissioning, streams running at higher bitrates than the calculation assumed, storage provisioned against a different figure, a setting that drifted, or drives quietly degrading over two years.
The mechanism matters less than the lesson, which is general and uncomfortable:
A retention specification is a statement of intent. Retention is a measurement. The two diverge silently, they diverge in the direction of less, and nothing announces it. The system does not warn anyone. It simply begins recording over the oldest footage a little sooner each month.
If retention matters, it has to be verified against the recorder periodically, not inferred from the document that specified it. That check takes two minutes and almost nobody does it.
Retention is a purpose and governance decision before it is a technical one
One operational question should inform retention before anyone calculates disks:
How long does it usually take for a problem at this site to become known?
Not how long footage is useful. How long before someone tells you there is a problem.
- A break-in is known within hours.
- A stock discrepancy might surface at the next count — weeks.
- A quality dispute with a customer surfaces when the customer opens the goods.
- An injury claim can surface months later, and the formal claim later still.
- An insurance query can arrive well after the underlying event.
If a legitimate claim surfaces after the recorded window has already rolled over, the recorder cannot supply that footage. A site must understand that exposure before choosing the window.
There is an equally important limit in the other direction. South Africa’s Protection of Personal Information Act requires records of personal information not to be retained longer than necessary for the purpose for which they were collected, unless a lawful exception applies. The Act does not prescribe one universal CCTV period.
The retention target therefore needs a documented purpose and lawful basis—not merely the largest disk the budget allows. Work backwards from realistic incident and claim timelines, test that reasoning against POPIA and any sector obligations, then engineer the system to deliver the approved period.
The arithmetic, and the honest trade-off
Storage is straightforward: bitrate per camera, multiplied by cameras, multiplied by seconds of retention. On a large site the numbers get big quickly, and doubling retention means roughly doubling storage.
When someone asks to extend retention without buying disk, there are three levers, and each costs something:
Frame rate. Often a useful lever, but not a free one. Many cameras are set higher than their purpose requires; others need temporal detail to show a fast movement, transaction or vehicle event. Test recorded evidence at the proposed rate rather than assuming a loading-bay camera can always be reduced safely.
Resolution. The dangerous lever. Reducing resolution reduces pixel density on target, which is the thing that determines whether footage can identify someone rather than merely show that a person was present. Halve resolution to buy days and you may keep footage that proves an event occurred but cannot establish who was involved — which, for a claim, can be no better than having nothing. If you pull this lever, pull it on wide contextual views and leave the identification cameras alone.
Compression, bitrate control and event recording. Modern codecs and scene-adaptive bitrate can extend retention, but results depend on motion, lighting, noise and recorder compatibility. Event-only recording creates a different risk: if detection fails, no footage exists. Verify the retained video under day, night and busy-scene conditions instead of relying on a nominal codec setting.
The pattern worth remembering: spend frame rate before you spend resolution, and never spend resolution on the cameras that exist to identify people.
“We back up off site” is not the same as having a backup
This is the trap worth naming, because it is very common and it feels safe.
A site can have a genuine, working, scheduled off-site export — and still have almost nothing to fall back on. If the export copies a rolling window (say, the last day of general and event footage per channel) then off-site storage holds a moving snapshot, not an archive. When the incident is six weeks old, the off-site copy is as empty as the recorder.
The distinction to be clear about:
- A rolling export protects against the recorder being stolen, burnt or destroyed today. It is a disaster measure.
- An archive protects against needing something old. It is an evidence measure.
They are different requirements and they need different provision. A site that assumes the first gives it the second has a retention gap it does not know about.
Ask the plain question: if we needed footage from eight weeks ago, where exactly would it come from? If the answer is only “the recorder”, the off-site arrangement is not doing what people think it is doing.
The failures that erase footage that hasn’t expired
Two more worth planning against, both seen on the same large site.
Water. Camera housings opened for a routine check can turn out to be holding water — sometimes entering from above rather than through the housing, a roof or ceiling leak finding the camera rather than the camera failing. The camera is dead until someone opens it, and depending on the system, the fact that it stopped recording may not be obvious. On a large site with dozens of cameras, nobody notices two missing channels until they are needed.
Power. Recorders shut down when standby generators fail to start during an outage. The cameras may be protected; the recorder is what has to survive. And a recorder that loses power repeatedly and ungracefully is also a recorder whose drives fail early.
Both create the same outcome as short retention: the footage you need does not exist. Worth treating them as the same problem.
What to actually do
- Ask how long incidents take to surface at this specific site. Set retention from that answer, with margin.
- Confirm what retention actually is right now, by looking at the earliest recording on each recorder — not by reading the setting. They frequently disagree.
- Compare that against what was specified. If a figure was ever written into a specification or contract, check the recorder against it — this is where intent and reality are found to have parted company.
- Check every recorder separately. They drift apart. One can be weeks behind another.
- Establish whether the off-site copy is a rolling window or an archive. Assume rolling until proven otherwise.
- Alarm on cameras that stop recording, so a dead channel is known in hours rather than at claim time.
- Protect the recorder’s power, and treat generator start-up as part of the CCTV system, because it is.
- Re-check after any camera is added. More cameras on the same storage means fewer days, silently.
The short version
Nobody buys CCTV to watch it. They buy it so that one day, when something has gone wrong, they can prove what happened.
That day is the audit. Retention set by disk size passes every day except that one.
Based on fault and review correspondence from a large industrial site in KwaZulu-Natal, 2021–2022. The operator is not identified. Storage figures are illustrative; any real site should be calculated against its actual stream settings.