Footage of a person is personal information. POPIA has opinions about that.

The three obligations that actually bite

Purpose (§13). You must be able to say why you hold each kind of footage. "In case we need it" is not a purpose, and an auditor knows that sentence.

Retention (§14). You may not keep personal information longer than necessary. This is the one almost nobody executes: a policy that says ninety days, and a drive with four years on it.

Data-subject requests (§§23–24). Anyone may ask what you hold about them, or ask you to erase it. The request usually comes from a contractor or an ex-employee, and the clock starts when it arrives.

The part everybody gets wrong: erasure versus the record

Deleting an incident to satisfy an erasure request destroys evidence that belongs to somebody else — your client, their insurer, a case.

The correct answer is to remove the identifiers and keep the events. After an erasure the record should still show that a ground-team contact was alerted at 02:14 and acknowledged four minutes later, and should no longer show who they were.

The same logic applies to retention. When footage expires, destroy the bytes and keep the record of the bytes — digest, size, uploader, access history — so an export from last year still references something real instead of something you now deny existed.

What a defensible report contains

The time zone, stated. A digest for every attached file. The full access history, not just the incident. Severity in words a magistrate would use. And a plain statement of what the system does not do — because a report that quietly implies facial recognition invites a question you do not want.