Reviewing site-specific privacy, audio and retention requirements

What you should be able to do

Prepare a site-specific requirements record for video privacy, audio and retention, then plan checks that demonstrate the approved configuration. This nationwide lesson teaches a review workflow, not a fifty-state legal determination or a universal retention period.

Begin With The Actual Site

Record the physical location, property use, system owner and intended purpose. Ask the designated owner or privacy/legal reviewer to identify the applicable federal, state, local and sector-specific requirements. A school, workplace, healthcare facility, residential property and public agency can raise different issues. A contractor's experience on a previous site does not establish approval for the next one.

Separate a legal requirement from an owner preference, contract term, manufacturer limitation or engineering assumption. Write the source, effective/review date, approving authority and affected cameras beside each requirement. If requirements conflict or are incomplete, refer them for resolution before enabling the affected feature. Do not select whichever interpretation is easiest to configure.

Why Audio Needs A Separate Decision

California Penal Code section 632 addresses intentionally eavesdropping on or recording confidential communications without all parties' consent, subject to the statute's definitions and exceptions. Its confidentiality definition depends on circumstances. This is one jurisdiction-specific example of why an apprentice should not generalize a simple consent slogan across all sites. It is not a nationwide rule, nor a determination that any particular camera or room falls within that provision. Primary source: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=632. Accessed 2026-09-30.

The lesson does not determine whether a particular sign, conversation or notice procedure satisfies applicable law. Have the authorized reviewer resolve that question. Owning the camera, having a microphone available or obtaining a manager's informal request is not a substitute for that determination.

Original Training Case

A fictional site approves silent video of an entrance. Audio has not been approved. Write "audio not approved" in the requirements record and verify that capture is disabled through the relevant supported controls. Do not merely mute the viewing laptop's speaker: muted playback is not proof that audio was never captured.

In a sanctioned training environment, inspect the camera and recorder settings relevant to audio, then verify the resulting test recording using harmless training material. Record what was checked and what could not be established. If the platform has edge recording, alternate stream profiles or a separate intercom, include the paths that are actually in scope. Never conduct a covert conversation-recording experiment to find out whether sound is enabled.

Retention Is A Requirement, Not Disk Size

The FTC's business guidance recommends limiting sensitive information to legitimate needs and maintaining a written retention policy that addresses what is retained, protection, duration and secure disposal. This is general guidance; it does not prescribe one camera-recording period for every organization. Primary source: https://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business Accessed 2026-09-30.

For the exercise, the owner must supply the approved duration and any exceptions. Do not invent "30 days" merely because it is a familiar example. Storage calculations from Lesson193 help determine capacity; they do not decide the applicable retention requirement. A configured duration is also not proof that the oldest required recording remains available under actual load.

List recorder storage, camera memory cards, cloud copies, backups and exported clips that are in scope. Document how the approved policy applies to each. A recorder's automatic overwrite schedule does not necessarily delete a separate exported copy.

Preservation And Changes

When the authorized owner identifies footage for preservation, follow the approved hold instructions and controlled handling process. Record the scope, owner and release authority. Do not shorten retention, overwrite identified material or remove a hold simply to clear space. Refer uncertainty to the responsible records or legal owner; the apprentice does not decide legal preservation obligations.

For a retention check, use the sanctioned test method and record configuration evidence, available oldest footage and capacity limitations separately. A new installation may not yet have operated for the full period. State that verification is pending rather than claiming the elapsed duration has been demonstrated.

Worked through

Site and approved purpose: Requirement source and review date: Applicable jurisdiction/sector review owner: Camera coverage and excluded areas: Audio decision and affected paths: Access/export restrictions: Retention duration and storage locations: Preservation instructions and release authority: Approved configuration: Expected and observed test result: Unresolved issue, owner and next action:

Knowledge Check