The short answer
Until the disk fills, and then it starts overwriting
Almost every commercial camera system records in a loop. It writes continuously to a fixed amount of storage, and when that storage is full it begins overwriting the oldest material with the newest. The retention period is not a setting somebody chose so much as an outcome: it is however many days the system happens to fit before the loop comes round.
That is why the honest answer to "how long do security cameras keep footage" is a question back. It depends on how much storage the recorder has, how many cameras are writing to it, what each of those cameras is set to, and how much movement is in the scenes they are watching. Change any one of those and the number changes, without anybody touching a retention setting.
You will not find a figure like "the industry standard is 30 days" anywhere on this page. We could not trace that claim, or any of its variants, to a source worth citing, and a number invented to sound authoritative is worse than no number. What follows is the four things that actually move it, and how to find out where your own system currently sits.
What moves the number
Four things decide your retention, and three of them drift
None of these is a setting called "retention". They are the inputs, and the retention period is what falls out of them.
How much storage is in the recorder
The only one of the four that is fixed until somebody deliberately changes it. It is also the one people reach for first, and often the least efficient fix: adding disk to a system whose real problem is three cameras writing far more data than the view justifies buys days at the highest possible cost per day.
How many cameras are writing to it
This is the one that drifts most, because it drifts by addition. Every camera added to a system after handover divides the same disk further. A building that expands, takes an adjacent suite or adds a yard usually adds cameras without anybody revisiting what that does to the window.
What each camera is set to
Resolution and frame rate both multiply the data a camera produces. Higher is not automatically better here: a view whose job is to show that a door opened does not need what a view whose job is to identify a face needs, and setting every camera to the same maximum is how a retention window quietly halves.
How much movement is in the scene
The one nobody predicts. Modern encoding produces much less data from a still scene than a busy one, so a camera on a quiet corridor and an identical camera on a loading bay do not consume the same storage. Change what happens in front of a camera and its consumption changes with it.
What the system does when a disk fails
Disks in a recorder run continuously and eventually fail. Whether the system tells anybody when one does is a design decision, and where it does not, the first time a failure is noticed is the day somebody goes looking for footage that was never written.
Whether anyone has checked since handover
Not a technical input, but the reason the other five matter. The retention figure quoted at handover describes the system as it was configured that day. Nothing keeps it true, and no system announces that it has drifted.
The one case where the law decides
California cannabis: a 90-day minimum, fixed by regulation
For most commercial premises there is no statute setting a retention period for your own camera system. The clearest California exception is cannabis. The Department of Cannabis Control's regulations, at California Code of Regulations, title 4, section 15044, require a licensed premises to keep recordings for a minimum of 90 calendar days.
That single number changes the whole design, because 90 days is a long window and everything else in the same regulation pushes storage upward at the same time. The rule also requires recording to run continuously, 24 hours a day, and sets minimum resolution and frame rate. A system cannot meet the 90 days by recording only on motion or only during opening hours, which is the usual way of making a storage figure work.
Two further parts of the same regulation matter to anyone sizing a system against it. There is a requirement for a failure-notification system, so the licensee is told when the system is interrupted or fails, which is the point above about disk failure written into law. And copies must be provided to the Department on request within the time specified, so the footage has to be retrievable and exportable, not merely present.
One narrow carve-out is worth stating because operators misread it: the requirement does not apply to a premises authorised exclusively for cultivation. That is genuinely narrow. A microbusiness or a mixed site is not covered by it.
The full set of obligations, including which areas have to be recorded, is on our dispensary and cannabis security page. We are not a cannabis licensee and there is no such thing as a Department-approved camera vendor: the obligations sit with you as the licensee, not with your installer. What we can do is design to them.
Verified as of 25 August 2026. Regulatory text changes. Every regulatory statement on this site carries the date it was checked, and if you are making a decision on this one, check it again or have your counsel do it.
What we will not tell you
The numbers this page refuses to publish
Retention is a topic where confident figures circulate freely and almost none of them survives being asked for a source.
"The industry standard is 30 days"
There is no body that sets such a standard and no publication we could cite for it. It circulates because it sounds plausible and because 30 days is roughly what a lot of systems happen to achieve. That is not a standard, it is a coincidence of typical disk sizes.
Gigabytes per camera per day
You will see this quoted as though it were a property of cameras. It is a property of a specific camera, at a specific setting, watching a specific scene, and we will not state one for a product we have not configured on a site we have not surveyed.
What your insurer requires
Insurers differ, policies differ, and the requirement lives in your policy instead of in a general rule. If yours specifies a period, that figure is the design input and we will build to it. We are not going to tell you what it says.
What a court or the police will need
Not our determination to make, and it varies by matter. What we can say is that footage which has been overwritten is gone regardless of who asks for it, which is the practical argument for exporting anything relevant as soon as you know it matters.
A retention figure over the phone
We do not quote one before seeing the building, for the same reason we do not quote a camera count. Every input above is site-specific, and a number given without them is a guess wearing a suit.
That more days is always better
It is not. Retention past the point at which anybody would actually look is storage spent on a problem you do not have, and it is routinely bought instead of fixing a camera position that cannot identify anyone at any retention.
What to do about it
Find out where your loop actually sits
The useful exercise is not choosing a target period. It is finding out what you currently have, because that is the number that will be true on the day something happens. Open the recorder's playback and go back as far as it will go. The oldest material still on the system is your real retention window, whatever the handover paperwork said.
Then ask whether anything has changed since it was set up. Cameras added, settings raised, a scene that got busier, a disk that has been running for years. Each of those moves the number, and none of them announces itself.
If you want to work the arithmetic in either direction — days from the disk you have, or the disk a target retention needs — there is a storage and retention calculator that does it. It asks you for the bitrate instead of assuming one, for the reasons set out on this page.
If the window is shorter than you need, the fix is not automatically more disk. It is usually cheaper and better to look at what each camera is set to against what its view actually has to prove, which is the same exercise as designing the system properly in the first place. That work is described under commercial camera installation, and where a system is already in place and nobody has looked at it since handover, it is what a CCTV service and repair visit is for.
Where footage is being kept because it may be needed as a record rather than for day-to-day operations, the separate question is what makes a recording usable afterwards, which is covered under liability and incident documentation. Retention keeps the material; it does not make it legible.
Two boundaries, as on every page here. We work on commercial premises only and not on private residences. And we do not hold a C-10 or a C-16, so we do not work on fire alarm systems; that is coordinated with your own licensed fire alarm contractor.