Condominium CCTV Footage Requests: What a JMB May Release.
QUESTION ANSWEREDA resident, an insurer or the police has asked the building for CCTV footage: who may be given it, on what basis, and what should be in writing?
When the police ask a Malaysian condominium for CCTV footage, the Personal Data Protection Act 2010 allows disclosure needed to prevent or detect a crime or for investigations, so ask for a written request citing the investigation. A resident’s request is harder when the clip shows other people: the Act lets a copy be refused where it cannot be given without identifying them. Settle both routes in writing before the next request.
- 01PDPA 2010, section 39: disclosure is allowed where necessary to prevent or detect a crime, or for investigationsPOLICE
- 02PDPA 2010, section 31: a data access request must be met within twenty-one days, extendable by fourteen with written noticeCLOCK
- 03PDPA 2010, section 32(1)(d): a copy may be refused if it cannot be given without identifying another personOTHERS
- 04Whether the Act reaches a JMB or MC is not settled, so act as though it doesSCOPE
- 05Singapore Police Force standard: an audit trail should record file retrieval from recordersRECORD
Does the Personal Data Protection Act apply to a JMB’s CCTV?
Whether Malaysia’s Personal Data Protection Act 2010 reaches a condominium’s cameras is not settled. Section 2(1) applies the Act to “any personal data in respect of commercial transactions”, and no provision says whether a Joint Management Body (JMB) or Management Corporation (MC) running cameras for residents is doing that. The prudent course is to handle footage as though the Act applies.
Securing the recording first is covered in When a Building’s Security System Starts Failing, and the scope question in who is the data controller for the recordings.
The Personal Data Protection Department’s FAQ lists an “image in closed circuit recording (CCTV)” among its examples of personal data. Since section 2 of the Personal Data Protection (Amendment) Act 2024 (Act A1727) took effect on 1 April 2025, the Act calls the holder of such data a data controller.
Can condominium management give CCTV footage to the police?
Yes, where the disclosure is needed for a crime or an investigation. Section 39(b) of the Personal Data Protection Act 2010 allows personal data to be disclosed where it “is necessary for the purpose of preventing or detecting a crime, or for the purpose of investigations”, or where disclosure is required or authorized by law or by a court order. Ask for the request in writing, citing that basis.
The Personal Data Protection Code of Practice for licensees under the Communications and Multimedia Act 1998 binds those licensees, not buildings, but is a workable model. It tells them to “only release the requested personal data on a formal written request being made, citing the relevant legal basis of the request being so made”. Whether the footage then holds up is covered in will the footage hold up with the police or in court.
Can a resident get a copy of CCTV footage?
A resident who appears in footage can ask for it through a data access request. Section 30(2) of the Personal Data Protection Act 2010 says the request is made in writing, on payment of a prescribed fee, for “a copy of the personal data in an intelligible form”. Section 31 gives the data controller twenty-one days to comply, or fourteen more if it gives written notice with reasons before then, and section 32 lists the grounds on which it may refuse.
Section 33 requires written notice of the refusal and the reasons for the refusal, within twenty-one days of receiving the request.
An insurer, lawyer or neighbour asking about someone else is not making an access request. Section 8 says “no personal data shall, without the consent of the data subject, be disclosed” for another purpose, subject to section 39, whose circumstances include consent and a reasonable belief in a legal right to disclose.
What if other people appear in the CCTV clip?
When other people appear in a CCTV clip, section 32(1)(d) of the Personal Data Protection Act 2010 lets the data controller refuse a copy it cannot give “without disclosing personal data relating to another individual who can be identified from that information”, unless that person consents or it is reasonable in all the circumstances to comply without consent.
Section 32(2) lists what decides reasonableness: any duty of confidentiality, the steps taken to seek consent, whether the person can consent, and “any express refusal of consent by the other individual”.
| Who is asking | Basis in the PDPA 2010 | What to have on file |
|---|---|---|
| Police or an investigating authority | Section 39(b) | A written request citing the investigation |
| A court, or an officer citing a law | Section 39(b) | The order, or the law relied on |
| A resident, for footage of themselves | Section 30(2); section 31(1) sets the clock | A written request naming date, time and camera |
| A resident, where others are identifiable | Section 32(1)(d) and 32(2) | Consent from those shown, or a written reason under section 32(2) |
| An insurer, lawyer or neighbour | Section 8, subject to section 39 | The data subject’s consent, or the basis relied on |
What should the recorder show when footage leaves the building?
The recorder should show who exported which footage, and when. The Singapore Police Force’s standard for buildings says: “Audit trail should be provided to record all physical and network access to the VSS’ recorders, e.g. file retrieval transaction performed on the system.” That is a Singapore benchmark, not Malaysian law, but it lets a committee show who retrieved which files, and when.
The Act’s Security Principle in section 9(1) asks for practical steps against unauthorized or accidental access or disclosure, and the recorder (the head end) is where those steps live. On one common recorder, Hikvision’s DS-7600NI series, the administrator creates operating accounts and sets their permissions, “which includes the limit to access any channel”; log search and playback are separate permissions, and quick export is capped at 24 hours of footage and 4 channels at a time.
Writing view and export rights into a tender is covered in the tender is also a personal-data specification.
What should a condominium footage release policy say?
A condominium footage release policy should say who decides, who may export, how a request is made and answered, what happens when others are in the frame, and what is logged, so the answer never depends on who is on duty. By-law 23(2) of the Third Schedule to the 2015 Regulations says CCTV cameras on the common property are “provided for the safety and convenience of all proprietors”, a sound purpose to start from.
- N01Who decides a request, by roleNAMED
- N02What a request must state: date, time window, cameras, reasonWRITTEN
- N03Police requests in writing, citing the legal basisREQUIRED
- N04Others in the frame: consent sought, or the reason recordedRECORDED
- N05Which recorder accounts may view or exportLIMITED
- N06Each release: file, date, recipient, conditions of useLOGGED
Keep recorder accounts in the building’s hands and their upkeep in what a security maintenance contract must cover. This is not legal advice.
Occhio Tec is an Extra Low Voltage contractor established in 2010. It designs, installs and maintains CCTV, access control, video intercom and structured networking, and takes over systems another contractor installed. Request a site survey or send a WhatsApp message to +60 11-6494 4931.
Questions about condominium CCTV footage requests
Q-01How long does a JMB have to answer a request for CCTV footage?
Section 31(1) of the Personal Data Protection Act 2010 requires a data access request to be met within twenty-one days of receipt. If that is not possible, section 31(2) requires written notice with reasons, and compliance as far as possible, before the period ends, and section 31(3) allows up to fourteen more days to comply in full. A refusal needs written notice with reasons within twenty-one days (section 33).
Q-02Can management post CCTV footage in a residents’ group chat?
Posting is a disclosure to every member. Section 8 of the Personal Data Protection Act 2010 says no personal data shall, without the consent of the data subject, be disclosed for a purpose other than the one stated at collection or a directly related one, subject to section 39.
Q-03How do we stop the footage being overwritten while a request is decided?
Lock the recording, if the recorder allows it. Hikvision’s DS-7600NI manual describes locking recorded files or setting a disk read-only “to protect the record files from being overwritten”. How long footage is kept otherwise is the building’s decision; see how many days of footage a building must keep.