How Long Should Security Camera Recordings Be Stored? KVKK and Legal Retention Periods

How many days security camera recordings should be stored is one of the most frequent questions faced by businesses installing CCTV systems, apartment managements, public institutions, and residential users. While 15 or 30 days of recording may be deemed sufficient in some applications, some sectors may require retention periods of 90 days, one year, or longer due to specific regulations.

However, in Turkey, there is no single mandatory recording period applicable to all security camera systems. The retention period should be determined based on the business's field of activity, any special regulatory provisions, obligations regarding the protection of personal data, and the purpose for which the images are recorded.

Security camera footage where individuals can be identified may constitute personal data under the Personal Data Protection Law (KVKK) No. 6698. Therefore, it is not appropriate to store images indefinitely or to create a storage policy based solely on the recording device's capacity.

Two fundamental questions must be answered together when determining the security camera recording period:

1. Is there a recording retention period specified in the legislation for the relevant business or facility?

2. If there is no specific period, what is the necessary and proportionate retention period for the purpose of processing the images?

The answers to these two questions directly affect the technical capacity of the recording system and the data retention policy.

How Long Should Security Camera Recordings Be Stored?

The ability of security cameras to record for 7, 15, 30, 60, or 90 days is a technical feature. However, not all of these durations are legally appropriate or mandatory for every use case.

For example, in a business, the quick detection of security incidents may make a limited retention period sufficient. Conversely, a business explicitly required by legislation to retain recordings for a longer period must comply with this obligation.

Key factors determining the recording period:

• Relevant legislation and sectoral obligations.

• Purpose of the camera system's use.

• Time required to detect security incidents.

• Risk profile of the business.

• Operational need for reviewing images.

• Principles of necessity and proportionality under KVKK.

• Security of the infrastructure where recordings will be stored.

Important distinction: A 30-day recording period may be a common technical preference; however, it cannot be said that KVKK mandates 30-day recording for all businesses or automatically deems 30 days appropriate.

How Many Days Can Camera Recordings Be Stored According to KVKK?

Article 4 of the Personal Data Protection Law No. 6698 regulates the general principles to be followed in the processing of personal data.

One of these principles is that personal data must be retained for the period stipulated in the relevant legislation or for the period necessary for the purpose for which they are processed.

This approach also applies to security camera recordings.

Does KVKK Mandate 30 or 90 Days of Storage?

No. KVKK does not directly specify a general period of 30 or 90 days for all security camera recordings.

The public announcement of the Personal Data Protection Authority regarding the use of security cameras in workplaces explicitly states that images should not be stored longer than necessary.

The Authority recommends determining the shortest possible sufficient retention period and using automatic destruction mechanisms.

Therefore, it is not appropriate to store images indefinitely merely on the assumption that they might be needed in the future.

How Should Security Camera Recordings Be Deleted?

When the period requiring the storage of recordings ends and there is no other legal reason for retention, the images must be deleted, destroyed, or anonymized using appropriate methods.

In this process:

• The retention period must be determined in advance.

• The automatic deletion or overwriting behavior in the recording system must be controlled.

• Separate backups and exported images must be evaluated.

• Deletion and destruction processes must be carried out in accordance with relevant legislation.

• Access to recordings must be limited to authorized personnel only.

Detailed procedures for the deletion and destruction of personal data under KVKK are regulated by the Regulation on the Deletion, Destruction, or Anonymization of Personal Data.

The periodic destruction periods specified in this regulation do not mean that security camera images can be stored for six months for everyone. Retention periods and periods for carrying out destruction processes are different concepts.

Camera Recording Retention Periods by Sector in Turkey

In some businesses, the retention period for security camera recordings is regulated by special legislative provisions.

Therefore, a general period should not be applied without correctly determining the business's field of activity.

The periods in the table are based on regulations reviewed as of November 2026. All applicable obligations must be checked separately for facilities subject to multiple regulations.

How Long Should Camera Recordings Be Stored in Jewelers?

Annex-1/R of the Regulation on Opening and Operating Workplaces contains special security requirements for businesses engaged in jewelry trade.

According to the regulation, camera recordings must be stored for 90 days.

Additionally, the camera system must:

• Display the entrances and exits of the workplace.

• Display the interior of the workplace.

• Clearly show the faces of individuals conducting transactions.

• Meet the number and standards determined by the relevant responsible organizations.

Limitations on sharing recordings with individuals and organizations other than authorized authorities are also included in the regulation.

How Long Should Camera Recordings Be Stored in Currency Exchange Offices?

For authorized currency exchange offices, the camera recording period has been extended to at least two years with the amendment to Communiqué No. 2025-32/73 published in the Official Gazette dated March 6, 2025, and numbered 32833.

The regulation includes not only the retention of local recordings for two years but also specific backup obligations.

Authorized institutions must back up camera recordings weekly to a location different from the workplace or using a cloud computing service with the same image quality, and these backups must also be stored for at least two years.

Therefore, simply installing sufficient disk capacity in the recording device at currency exchange offices does not fulfill all recording obligations.

GüvenlikOnline's technical guide How to Maintain 2 Years of Camera Recordings in Currency Exchange Offices? can be reviewed on this topic.

Recording Period for Commercial Internet Mass Usage Providers

The regulation concerning commercial internet mass usage providers stipulates that workplace entrances and exits must be monitored by an appropriate camera system and recordings must be stored for 90 days.

This regulation does not mean that all businesses offering internet connections or all commercial workplaces are subject to the same obligation.

It must be determined separately whether the business falls within the scope of the relevant regulation.

Recording Period in Hospitals, Schools, Hotels, and Factories

For hospitals, educational institutions, hotels, and factories, a single general number of days applicable to all cameras should not be stated merely by looking at the type of business.

In these areas:

• Relevant sectoral regulations.

• Special permits and security requirements.

• Purpose of the camera system's use.

• Personal data processing conditions.

• Risk and storage requirements.

must be examined together.

Especially in health and educational institutions, privacy is too important to be evaluated separately from security needs.

How Long Should Apartment and Residential Complex Camera Recordings Be Stored?

In apartment and residential complex managements, security cameras are typically used at building entrances, in parking lots, and in designated common areas.

However, there is no general KVKK provision stating that camera recordings in apartments and residential complexes must be stored for 15, 30, or 90 days.

The Personal Data Protection Authority's announcement regarding the use of security cameras in apartments highlights the following principles:

• Camera use must have a specific and legitimate purpose.

• The legal basis for the imaging activity must be evaluated.

• Personal data should not be stored longer than necessary.

• Images should not be shared with unauthorized persons.

• Access to recordings must be restricted.

• When the justification for storage ceases, appropriate destruction processes must be carried out.

For example, in an apartment, the time frame within which security incidents are noticed, the process of accessing recordings, and actual security risks can be examined when determining the retention period.

However, it should not be assumed that longer recording always provides higher security.

How Long Should Security Camera Recordings Be Stored in Homes?

For security cameras used in private residences, there is no single recording period applicable in all cases.

Cameras used purely for personal or family activities may be evaluated under the relevant KVKK exception in certain circumstances.

However, if the camera systematically records neighboring properties, common areas, or public spaces, this exception should not be automatically assumed to apply.

When determining the technical recording period in residences, the security purpose, the likelihood of an event being noticed, privacy, local recording capacity, and appropriate legal scope must be evaluated together.

Therefore, while a 7 or 30-day recording option is technically possible, it should not be recommended as the single correct period for every residence.

How Is the Camera Recording Period Determined?

When there is no explicit period in special legislation, a justified and proportionate retention period must be determined by the data controller.

This process can be evaluated in five stages.

1. Purpose of Recording Must Be Determined

The purpose for which the security camera is used must be clearly defined.

For example, the security of a building entrance and the investigation of a work accident in a production area may constitute different processing purposes.

2. Special Legislation Must Be Checked

Sectoral regulations applicable to the business must be examined.

Special storage obligations in areas such as jewelry or authorized currency exchange offices must be considered.

3. Event Detection Time Must Be Evaluated

How quickly security incidents are typically detected can help assess the need for storage.

However, hypothetical and uncertain event possibilities alone do not justify unlimited storage.

4. Necessary Period Must Be Justified

The reason why the determined retention period is necessary must be documented in the institution's data processing and storage procedures.

5. Automatic Deletion and Control Process Must Be Established

System behavior must be created to prevent unnecessary storage of images after the period ends.

The camera recording period is a management decision determined by legal obligations and data processing purposes, rather than merely a disk capacity preference.

How Many Days Does a Security Camera System Record?

How many days a security camera system can technically store recordings depends on the NVR/DVR recording capacity and the data volume of the camera images.

The main factors affecting the recording period are:

• Number of cameras.

• Camera resolution.

• H.264, H.265, or other supported video compression methods.

• Average video bit rate.

• FPS, i.e., frames per second.

• Continuous or event-based recording method.

• Motion intensity of the image.

• Presence of audio recording.

• Available capacity of disks.

• RAID configuration.

• File system and system reserve.

For example, two cameras operating at the same resolution may generate different amounts of data when recording different scenes.

Therefore, the recording period cannot be calculated solely based on whether the camera is 4 MP or 8 MP.

How to Calculate Camera Recording Period and HDD Capacity?

When calculating camera recording capacity, the primary parameter is the average video bit rate.

Simplified formula for 24-hour continuous recording:

Recording capacity (TB) = Number of cameras × Average bit rate (Mbps) × 10.8 × Days / 1,000

This formula provides the theoretical video data amount calculated using decimal TB and GB units.

Example: 8 Cameras and 4 Mbps Bit Rate

Let's consider a system consisting of eight IP cameras, where each camera generates an average of 4 Mbps of data.

Daily data amount for one camera:

4 × 10.8 = 43.2 GB

Daily data amount for eight cameras:

8 × 43.2 = 345.6 GB

Accordingly, the theoretical data amounts for different retention periods are as follows:

For example, if 90 days of recording is targeted, approximately 31.1 TB of raw video data will be generated.

However, this value is not the total disk capacity that needs to be purchased directly.

In a real project, the following should also be considered:

• File system and recording metadata.

• Unusable space due to RAID.

• Disk capacity shown differently by the operating system.

• Variable bit rate.

• Available capacity reserve.

• Future camera or setting changes.

For example, if a 20% capacity buffer is added merely to illustrate the calculation, approximately 37.3 TB of usable space could be targeted for 31.1 TB of theoretical video data. This buffer is an example; RAID losses and actual project design are calculated separately.

If recording is planned within the camera, GüvenlikOnline's guide Security Camera SD Card Selection and Recording Duration Calculation can also be reviewed.

Does H.265 Extend Camera Recording Time?

H.265/HEVC is a video compression standard that can offer similar visual quality at a lower bit rate compared to H.264 under suitable conditions.

A reduction in the average bit rate can allow for longer recording in the same storage space.

However, it cannot be guaranteed that the same level of savings will be achieved with every camera.

Specifically:

• Noise in night vision.

• Scenes with intense motion.

• High frame rate.

• Very high image quality settings.

• Camera manufacturer's specific compression methods.

can affect the average data volume.

Reducing image quality excessively to achieve longer recording times can lead to the loss of necessary details during post-incident review.

Therefore, compression settings and actual recording duration should be tested together.

Continuous Recording or Motion-Activated Recording?

The recording method in security camera systems directly affects storage capacity.

Event-based recording can reduce data volume in some applications.

However, if continuous recording or specific image coverage is stipulated in special legislation, it should not be assumed that this obligation is met solely with motion-activated recording.

Additionally, pre- and post-detection recording duration should be correctly configured on supported devices.

Do Old Recordings Get Deleted When DVR or NVR Disk Is Full?

Many recording devices support cyclic recording (overwrite) functionality.

When this feature is enabled, new images can be written over old video data as the storage space fills up.

However, the default behavior is not the same on all devices.

In some configurations, recording may stop when the disk is full, or user intervention may be required.

The important thing is that the recording device meets the required retention period before reaching its capacity limit and that data is managed according to the defined policy thereafter.

Does Overwriting Recordings Mean Secure Deletion?

Not in all cases.

Cyclic recording can help remove old images from the normal recording flow. However, it must also be evaluated whether images exist in other storage areas, backups, or exported copies.

Especially in systems using cloud, NAS, VMS, and central archives, the deletion and destruction policy must cover all copies.

Can Camera Recordings Be Stored Longer If an Incident Occurs?

When a security incident, theft, work accident, or legal dispute occurs, legal reasons may arise that require the relevant recordings to be stored for a longer period.

However, this does not mean that all images in the recording system can be retained indefinitely.

The Personal Data Protection Authority's announcements emphasize that when an incident occurs, only the relevant recordings should be stored throughout the legal process.

Steps to Preserve Incident Recordings

1. The date and time range of the incident are determined.

2. Relevant cameras and images are identified.

3. Necessary recordings are separated by authorized personnel.

4. The integrity of original recordings is ensured.

5. Access and export operations are documented.

6. Necessary recordings are securely stored within the scope of the legal process.

7. When the justification for storage ceases, appropriate destruction processes are carried out.

In supported systems, file integrity verification, access logs, and secure export features can be used.

GüvenlikOnline's article Camera Recording Backup can be reviewed for information on how to separate and protect recordings.

RAID, NAS, and Cloud Backup for Camera Recordings

Long-term storage of camera recordings and keeping recordings secure and accessible are different requirements.

Local Recording on NVR and DVR

Local recording devices can record images even without an internet connection in an appropriate system architecture.

However, the physical security of the recording device, disk health, and backup power requirements must be evaluated.

RAID Storage

RAID, in appropriate configurations, can help maintain recording service against certain disk failures.

However, RAID is not a backup solution against all risks regarding deleted or unauthorizedly modified recordings.

NAS and Central Archiving

NAS or central storage systems, in appropriate configurations, can enable the management of larger recording archives.

In these solutions, network capacity, access security, and data backup processes are important.

Cloud Recording and Remote Location

Cloud or remote location recording solutions can reduce certain physical failure and device loss risks.

However, data responsibility, data transfer abroad, security, and retention period requirements must be evaluated separately.

In a system where recordings must be stored for 90 days, it is not only important to have 90 TB of disk space, but also that the relevant recordings are reliably accessible when needed.

Deletion of Camera Recordings and Access Security

Data security in the storage of camera recordings is as important as the retention period.

Especially in businesses with a large number of employees or visitors, access to recordings must be controlled.

Applicable measures:

• Permission-based user access.

• Strong authentication.

• Restriction of recording viewing and export operations.

• Maintenance of access logs.

• Physical protection of storage devices.

• Appropriate backup and data destruction policy.

• Software updates for recording systems.

• Regular control of the recording retention period.

Under KVKK, not only the retention period of images but also who can view them and for what purposes they can be used is important.

Technical and Legal Checklist for Camera Recording Period

• Has the purpose of the camera system's use been determined?
• Has special legislation applicable to the business been checked?
• Has the legal processing condition under KVKK been evaluated?
• Has the recording retention period been justified?
• Have the recording period and destruction procedures been documented?
• Have the number of cameras and actual average bit rates been measured?
• Has the HDD/NVR capacity been calculated according to the targeted period?
• Have RAID and capacity reserves been evaluated?
• Has the continuous or event-based recording method been determined?
• Has cyclic recording and automatic destruction behavior been checked?
• Have cloud, NAS, and exported recording copies been evaluated?
• Has a separate preservation procedure for incident recordings been established?
• Have user permissions and access logs been arranged?
• Have power outage and disk failure scenarios been tested?
• Have access to recordings and image export functions been tested?
• Has it been verified that the determined recording period is actually provided?
• Has the retention policy been periodically reviewed?

This list is for general technical and legal preliminary assessment purposes. Specific obligations to be applied in certain sectors must be verified separately.

Frequently Asked Questions

How many days should security camera recordings be kept?

In Turkey, there is no single general period for all camera systems. The period should be determined according to sectoral legislation, if any; otherwise, according to the processing purpose and the principles of necessity and proportionality of KVKK.

According to KVKK, should camera recordings be stored for 30 days?

No. KVKK does not impose a general 30-day storage obligation for all camera recordings.

Is it mandatory to store camera recordings for 90 days?

Not for all businesses. There are special regulations for 90 days in certain activities such as jewelry businesses and commercial internet mass usage providers.

What is the camera recording period in currency exchange offices?

In authorized currency exchange offices, recordings must be stored for at least two years. The relevant regulation also includes obligations regarding weekly remote location or cloud backup.

How many days can apartment camera recordings be stored?

No single general period has been determined for apartments under KVKK. The retention period must be justified in line with legitimate security purposes and relevant obligations.

Can 60 days of camera recording be kept in workplaces?

It can be justified under certain conditions. Indeed, in the Personal Data Protection Board's decision No. 2024/540, a 60-day retention was evaluated within the specific characteristics of the concrete case. However, this decision does not mean that 60 days is automatically appropriate for all workplaces.

What is the maximum number of days security camera recordings can be stored?

There is no single maximum number of days applicable to all businesses. The retention period is limited by relevant legal obligations and the purpose of personal data processing.

Are camera recordings automatically deleted?

Many DVR and NVR devices can overwrite old images with cyclic recording functionality. However, its effectiveness and the management of other recording copies must be verified separately.

How many days does a 1 TB hard disk record?

It depends on the number of cameras and bit rate. Since a single camera generating an average of 4 Mbps of data records approximately 43.2 GB/day for 24/7 recording, 1 TB of raw capacity theoretically contains approximately 23 days of data. Usable capacity and system overheads can reduce this period.

How many TB are needed for 8 cameras recording for 30 days?

If eight cameras each record continuously at an average of 4 Mbps, approximately 10.37 TB of theoretical video data is generated. RAID and capacity reserves must be calculated separately.

Are camera recordings deleted if the internet is cut off?

In appropriate local recording systems, an internet connection outage does not automatically delete existing recordings. However, cloud recording services and remote access may be affected by the outage.

Can deleted camera recordings be recovered?

This depends on how the recordings were deleted, the storage device, and whether new data has been written over them. Recovery of recordings cannot be guaranteed.

Can the police or prosecutor's office request camera recordings?

Authorized authorities can request camera recordings in accordance with relevant legislation and procedures. In this case, the data sharing and retention process must be carried out according to legal requirements.

How to Correctly Determine Security Camera Recording Period?

How many days security camera recordings should be stored should not be determined solely by the NVR device's disk capacity or camera resolution.

First, the legislation applicable to the business and the purpose of using camera recordings must be evaluated. Then, the necessary retention period must be determined, and the recording system must be designed to reliably meet this period.

While there are special obligations such as 90 days for jewelers and at least two years for authorized currency exchange offices, it is not correct to mandatorily apply the same number of days to all applications in general workplaces and apartments.

Furthermore, it is as important to be able to find recordings when needed, protect them against unauthorized access, and destroy them using appropriate methods when the legal justification for storage ceases, as it is to retain them for a long time.

A correct security camera recording policy is created by ensuring legislative compliance, data minimization, sufficient technical storage capacity, and reliable recording management together.

References

1. Personal Data Protection Authority — Public Announcement on Issues to Be Considered in the Use of Security Camera Systems in Workplaces — Legal basis, storage, and security requirements for camera recordings.

2. Personal Data Protection Authority — Use of Security Camera Systems in Apartments — Camera recording in common areas of apartments and residential complexes.

3. Personal Data Protection Authority — Regulation on the Deletion, Destruction, or Anonymization of Personal Data — Storage and destruction obligations.

4. Personal Data Protection Authority — Board Decision No. 2024/540 — Evaluation of 60-day storage in a concrete workplace camera application.

5. T.C. Ministry of Justice — Regulation on Opening and Operating Workplaces — Camera recording requirements for jewelry businesses under Annex-1/R.

6. Official Gazette — Communiqué No. 2025-32/73 Dated March 6, 2025 — Extension of the recording period to two years in authorized currency exchange offices.

7. Official Gazette — Regulation on Commercial Internet Mass Usage Providers — Regulation regarding the storage of camera recordings for 90 days.

8. Personal Data Protection Authority — Deletion and Destruction of Personal Data — Deletion, destruction, and anonymization of recordings.