In a rental building, a camera policy should not be something that evolves informally from a new camera, a staff request or an incident that happened last week. Owners and management companies have different responsibilities, and both need to know where decision-making authority begins and ends.
The owner usually sets the building’s governance framework and approves significant surveillance decisions. The management company puts that framework into practice: managing access, responding to requests and ensuring routine procedures are followed. The precise division depends on the management agreement, ownership structure and applicable law, so it should be confirmed rather than assumed.
A useful starting question is: What security question does this camera answer? If no one can give a clear answer, the camera may not be necessary. A sound rental building camera policy defines the purpose, limits what is recorded, sets retention periods and names the people authorised to make decisions.
The short answer: governance and day-to-day operation are different jobs
“Who sets the policy?” can mean several things: who approves a camera installation, who decides what it records, who can view footage, or who handles a request for a clip. Those decisions should not be bundled together under a vague instruction such as “management handles CCTV”.
This is a practical division of responsibility, not a substitute for legal advice. In the UK, organisations using CCTV should consider their data protection obligations, including the UK GDPR and Data Protection Act 2018. Who is the controller, who acts as a processor and what notices or procedures are needed will depend on the actual arrangement and purpose of the system.
What should the owner decide?
The owner, landlord or authorised board should set the boundaries: why surveillance is used, which areas may be covered, what is off limits, how long footage is kept and who can authorise exceptions. Those are governance decisions because they affect residents, staff, visitors and sometimes the public.
The owner should also decide who has authority to approve changes. A management company may be empowered to arrange maintenance or replace faulty equipment, for example, without having authority to add a new camera, turn on audio or broaden the recording area. That distinction should be explicit in the management agreement and the camera policy.
Approve a purpose before approving hardware
“For security” is too broad to guide a proportionate decision. Identify the specific problem a camera is intended to address: for example, repeated unauthorised access at a controlled entrance, or damage to a shared garage gate. Then ask whether a less intrusive measure could address it, such as improved lighting, a lock repair, access-control changes or staff procedures.
Do not install cameras “just in case”. A defined purpose makes it possible to decide whether a proposed location is justified and later assess whether the system is still useful.
Give clear approval for locations and limits
Owner approval for camera locations should identify more than a floor or building zone. The approval should state the intended coverage and any areas that must remain outside the view. A camera aimed at a lobby entrance may unintentionally record a reception desk, neighbouring property, a window or a space where people reasonably expect more privacy.
Where possible, use camera positioning, privacy masking and access restrictions to reduce unnecessary capture. Avoid cameras in private spaces and do not use them to monitor residents or staff as a substitute for ordinary management or employment processes.
What should the management company do?
The management company’s role is to implement the approved rental building camera policy consistently. Its management company CCTV procedures should explain who can view footage, when viewing is permitted, how incidents are logged and how footage is handled when someone asks for it.
Management should not treat possession of a login as permission to browse. Access should be limited to named, trained people with a work-related reason. Curiosity, convenience or a request to “see what happened” without a defined incident is not a proper reason to view recordings.
Control access and keep an audit trail
Each authorised viewing, export or disclosure should be recorded. A useful log includes:
- the date and time of the activity; the person who viewed or exported the footage; the specific incident or authorised purpose; the camera and time period involved; who received a copy, if anyone, and why; the storage location and planned deletion date for an export.
Ask the practical question every time footage leaves the CCTV system: Where will the exported clip end up, and who can open it? Avoid emailing raw clips around or placing them in a broadly accessible shared folder. Use a controlled transfer method, restrict permissions, record the recipient and set a deletion date. A clip preserved for a genuine investigation should be separated from routine footage and kept only as long as necessary for that purpose.
Manage suppliers and system changes
Installers and monitoring providers should receive only the access they need to perform their contracted work. Their responsibilities, security measures and restrictions on using footage should be addressed in the service arrangements. Change default passwords, remove access when a contract ends and review accounts when staff roles change.
Management should also record configuration changes. A camera repositioned after maintenance can capture a different area, even if the equipment itself has not changed. Test the field of view after work is completed, confirm privacy masks still operate and update the location record.
Data minimisation: record only what is needed
Data minimisation is a practical design rule: capture the least information needed to meet the stated security purpose. A camera should not record a whole area simply because its lens can. Narrowing the angle, lowering image detail where appropriate, using privacy masking or choosing a different location may reduce unnecessary collection.
Check the live view from the perspective of the camera, not just the floor plan. A drawing can suggest that a camera covers a doorway while the actual image also captures people waiting, a neighbouring entrance or a staff workspace. Recheck after installation and whenever the layout, furniture or camera position changes.
Audio recording is particularly intrusive and should not be enabled by default. If someone proposes it, require a specific justification and review the legal and privacy implications before proceeding. The same applies to analytics or features that identify or track individuals: they need a clear, assessed purpose, not merely a technical possibility.
Retention periods and routine deletion
There is no single retention period that suits every building. Set a period based on the purpose, the time needed to identify and report an incident, system capacity and relevant legal requirements. Keep it no longer than necessary, and explain the period in the policy and privacy information.
Routine deletion should happen automatically where the system allows it. A retention rule that exists only in a written policy but is not configured in the recorder is easy to overlook. Management should check that routine footage is overwritten or deleted on schedule and keep evidence of the settings and periodic checks.
If footage is needed for a specific incident, preserve only the relevant segment where practicable. Record why it was retained, who authorised the hold, where it is stored, who can access it and when it will be reviewed or deleted. “Keep it until further notice” is not a retention plan.
A practical approval and review process
Define the problem. Record the security issue and the outcome the proposed camera is intended to support. Consider alternatives. Check whether lighting, access control, repairs or staffing changes could address the issue with less intrusion. Assess the location. Map the intended field of view, identify privacy risks and decide whether masking or a narrower angle is needed. Obtain the right approval. Follow the owner’s governance rules and the management agreement. Record who approved the purpose, location, budget and any conditions. Configure and test. Have an authorised person verify the actual image, privacy masks, user permissions and retention settings before the camera is put into service. Publish the procedures. Tell relevant people how the system operates, who to contact and how access requests or complaints are handled. Review and delete. Check whether the camera remains necessary and effective. Remove or reconfigure it if the purpose no longer applies; confirm routine deletion is working.Common mistakes to avoid
- Letting a contractor decide the purpose. A supplier can advise on equipment, but governance belongs to the owner or authorised decision-maker. Approving a camera without approving its view. The location and field of view should be reviewed together. Giving every manager access. Limit access by role and keep an audit trail. Watching live feeds casually. Viewing must have an authorised purpose; cameras are not a source of entertainment or general observation. Sharing unredacted footage informally. Before disclosure, assess what is needed and whether third parties can be obscured. A checklist should cover more than faces and number plates: consider screens, documents, access codes, door-entry panels, reflections, audio and identifying details in the background. Keeping exports indefinitely. Name the storage location, restrict access and set a deletion date for every exported clip. Failing to review the system. A camera installed for a past problem may no longer be necessary or may now capture something unintended.
Make the policy usable, not just compliant on paper
A strong policy makes responsibility easy to understand. It should name the owner or governing body responsible for approvals, the management contact responsible for operations, the authorised users, the permitted purposes, approved camera locations, access and disclosure rules, retention periods and review arrangements.
There is also a basic procurement lesson: a policy page or scraped article that lists no prices does not provide enough information to compare equipment or services. Do not invent or assume a price from an incomplete listing. Request a written, itemised quote covering hardware, installation, maintenance, storage, monitoring, data migration and any ongoing service charges. Cost is only one part of the decision, but it should be transparent before approval.
Conclusion: owners set the boundaries; management makes them work
In https://realtytimes.com/new-headlines/cctv-in-elevators-and-common-areas-property-manager-responsibilities most buildings, owners or their authorised governing bodies should decide why CCTV is used, where it may be installed and what limits apply. The management company should operate the system within those limits, maintain access and disclosure records, enforce routine deletion and raise any proposed change for proper approval.
When responsibility is unclear, pause before adding a camera or sharing a clip. Ask what security question the camera answers, whether it records more than necessary, and where any exported footage will live and who can open it. Those questions turn a vague CCTV arrangement into accountable building governance.
Share this article
Share on Facebook | Share on X (Twitter)