How Long to Keep Security Camera Footage Retention Requirements, the Business Default, and the Regulated Exceptions That Set a Minimum
Almost every answer to this online is either a guess or a sales pitch for more storage. The honest answer has two parts: for most US businesses there is no law that sets a minimum, and for a short list of regulated activities there very much is. This page separates the two, and cites the rule when a rule exists.
There is no general US federal law telling an ordinary business how long to keep security camera footage. Most businesses default to 30 days, which is a reasonable choice because the majority of incidents surface within a few weeks. The exceptions are specific and regulated. Licensed cannabis operators in California must keep recordings at least 90 calendar days under state rule. Businesses that use cameras to monitor cardholder data areas retain that video at least three months under PCI DSS. Gaming and casino floors, and some other licensed sectors, carry their own state-set minimums that can run longer. If none of those apply to you, the driver is your own risk and your insurer, not a statute.
Three Questions That Set Your Retention Period
Instead of hunting for a single number, work through three questions in order. The first one that applies sets your floor, and you keep footage for the longest period any of them demand.
1. Does a regulation cover your specific activity?
Cannabis, gaming, financial services, firearms dealing, and cardholder data handling can each carry a mandated minimum. If you are in one of these, that rule is your floor and it overrides everything below. If you are a typical retailer, office, warehouse, or restaurant, no such rule applies and you move on.
2. What does your insurance policy or lease require?
Some commercial policies and commercial leases specify a retention period, or condition a claim on producing footage. Read the policy before you size storage, because an insurer that expects 60 days of video will not care that the law only implied 30.
3. How long do your incidents take to surface?
This sets the practical minimum. Inventory shrinkage, an employee dispute, or a slip-and-fall claim can surface weeks after the event. Thirty days covers most of it, sixty is comfortable, and ninety is common for businesses that have been burned by a late-arriving claim.
Security Camera Footage Retention Rules
Where a mandated minimum exists, it is cited. Where none exists, the entry says so plainly rather than inventing a number. Regulated sectors vary by state, so confirm your own state and license before you rely on any single figure.
| Who | Minimum retention | Source or basis |
|---|---|---|
| Typical US business (retail, office, warehouse) | No legal minimum; 30 days is the common default | Industry practice, not statute |
| Licensed cannabis (California) | 90 calendar days | Cal. Code Regs. tit. 4, § 15044(h) |
| Licensed cannabis (other states) | Varies, commonly 45 to 90 days | State cannabis regulator (confirm your state) |
| Cameras monitoring cardholder data areas | At least 3 months | PCI DSS Requirement 9 |
| Gaming and casino floors | State-set, among the longest | State gaming commission (confirm your state) |
| Insurer or lease requirement | Whatever the contract states | Your policy or lease |
This is general information, not legal advice. Rules change and vary by jurisdiction; confirm the current requirement with your regulator, insurer, or counsel.
The Rules That Actually Set a Minimum
Two of these are specific enough to cite verbatim. California's Department of Cannabis Control rule (Cal. Code Regs. tit. 4, section 15044) requires licensed premises to record continuously, at a minimum frame rate, and to keep those recordings for at least 90 calendar days. That is a hard floor for a California dispensary or cultivator, not a suggestion.
PCI DSS, the payment card security standard, is the other one people get wrong. It does not require you to have cameras at all. But where a business chooses to use video to monitor sensitive areas that handle cardholder data, such as a server room, that footage must be retained for at least three months. If you do not have three months of video, you can meet the intent with three months of access control logs instead. So the three-month figure is real, but it is narrower than the blanket rule it is often quoted as.
Everything else in the regulated column is genuinely state-specific. Cannabis retention outside California ranges roughly from 45 to 90 days depending on the state program, and gaming retention is set by each state's gaming commission. Because these move and differ, the safest habit is to track which obligations actually apply to your business rather than assume, which is the kind of thing a compliance obligation tracker exists to keep straight.
Retention Is a Storage Decision, Not Just a Legal One
However long you decide to keep footage, that number is what sizes your storage and your bill. Doubling retention roughly doubles storage. The variables are camera count, resolution, frame rate, and whether the cameras record continuously or only on motion. A local recorder overwrites its oldest footage once the drive fills, which is why a business that thinks it has 30 days often discovers, after an incident, that a busy month quietly cut it to nine.
Cloud recording changes the failure mode: instead of silently overwriting, retention becomes a setting you choose and pay for, and the footage survives even if the on-site recorder is stolen along with everything else. If you are deciding how to store and watch it, our breakdown of security camera monitoring covers the recording and monitoring layers and what each costs.
Numbers We Will Not Print
A confident-looking 50-state retention table is the most common thing published on this topic, and most of them are wrong, because they treat industry norms as if they were laws.
- 01 A specific mandated retention period for ordinary businesses in a given state. For most states and most businesses, no such mandate exists, and presenting 30 or 60 days as the law would be false.
- 02 A single federal retention requirement for security cameras. There is no general one. Sector rules (cannabis, gaming, PCI) exist, but there is no across-the-board federal minimum for cameras.
- 03 Exact day counts for every state's cannabis or gaming program. These vary and change; we cite California's 90-day cannabis rule because it is verifiable, and tell you to confirm your own state rather than trust a copied table.
Footage Retention Questions
How long is a business required to keep security camera footage?
For most US businesses, there is no legal requirement at all, and 30 days is the common default. Requirements only kick in for specific regulated activities: California licensed cannabis must keep 90 days, cameras monitoring cardholder data areas retain at least three months under PCI DSS, and gaming floors follow state-set minimums.
Is there a federal law on security camera footage retention?
No, there is no general US federal law setting how long an ordinary business must retain security camera footage. Retention rules come from specific sector regulations, from state law, and from private contracts like insurance policies and leases, not from a single blanket federal statute.
How long should a small business keep security footage?
Thirty days is a sensible default for a small business with no sector rule, because most incidents surface within a few weeks. Sixty to ninety days is worth it if you have ever had a claim arrive late, or if your insurer or lease asks for more. Check those two contracts before you settle on a number.
How long does PCI DSS require you to keep camera footage?
At least three months, but only for video used to monitor sensitive areas that handle cardholder data. PCI DSS does not require you to install cameras; if you use them for that control, you retain the footage three months, or you can meet the intent with three months of access control logs instead.
How long do cannabis dispensaries have to keep video?
In California, licensed cannabis premises must keep surveillance recordings for at least 90 calendar days under Cal. Code Regs. tit. 4, section 15044. Other states set their own cannabis retention rules, commonly in the 45 to 90 day range, so confirm the exact figure with your state cannabis regulator.
What happens if you delete footage too soon?
If a rule applies to you, deleting early can mean a compliance violation or a lost license, and in litigation, destroying footage after a claim arises can count as spoliation of evidence. Even with no rule, overwriting too soon means the footage is gone exactly when an incident finally surfaces, which is the most common and most avoidable loss.
Keep the footage as long as you actually need it
Cloud retention you set on purpose, not a local drive that quietly overwrites itself. Connect one camera free and choose how long the footage lives.