What retention policy should be used for surveillance footage?

• A. Keep indefinitely
• B. Delete after 1 day
• C. Retain footage only as long as necessary for security and compliance; follow policy and laws.
• D. Never delete

Answer: (C)

Retain footage only as long as it’s needed for security purposes and to satisfy applicable policies and legal requirements. This approach minimizes privacy risks, storage costs, and exposure to data breaches while still enabling investigations and compliance. Indefinite retention isn’t necessary and increases risk and cost; deleting after a fixed short period (like one day) may prevent needed investigations or audits; never deleting ignores privacy rights and data minimization principles and can conflict with laws. In practice, set a retention schedule based on purpose, regulatory obligations, and potential need for incident response, then delete securely when the period ends.