There Is No Single Correct Number of Days
Camera footage counts as personal data because it makes people identifiable. So there is no one-size-fits-all answer to "how many days should recordings be kept?"; the period should be set according to the purpose of the recording. This article offers a general framework, not legal advice.
Core Principles of Türkiye's Data Protection Law (KVKK)
- Purpose limitation: Recording must serve a specific, legitimate purpose (for example site security).
- Proportionality: No more area, time or people should be recorded than the purpose requires.
- Retention only as long as necessary: Personal data is kept only as long as needed for its purpose and deleted or destroyed afterwards.
- Notice: Recording should be announced with visible signs in the area.
- Data security: Only authorised people should access recordings, and access should be logged.
Questions to Ask When Setting the Period
- What risk is the recording meant to prevent?
- When an incident is noticed, how many days back do you need to look?
- How does your organisation's retention and destruction policy define the period?
- Are expired recordings deleted automatically?
The Technical Side: The Period Sets the Disk
The longer the retention period, the more disk capacity is needed. The number of cameras, resolution, recording mode (continuous or motion-based) and the number of days kept together set the disk requirement. Configuring the recorder to overwrite old footage automatically when the period ends makes both disk use and the destruction obligation easier.
Our Recommendation
Set the retention period first on the basis of purpose and risk, write it into your organisation's policy and seek legal advice where needed. Then design the technical infrastructure for that period.
If you would like a concrete figure for your own business, see our security camera systems page and contact us for a free quote.
Related article: IP Security Camera System Prices