Events
Cameras at the gates, a guard checking bags, a registration desk scanning IDs. Each of these handles personal data, and since 2024 the National Privacy Commission’s CCTV circular spells out what that means for anyone running cameras where the public can walk in. An event is one of those places.
Does the Data Privacy Act cover CCTV at an event?
Yes. NPC Circular No. 2024-02 applies to everyone “engaged in the processing of personal data through CCTV systems”. It defines a semi-public space as “any indoor or outdoor space that, even if privately owned, is open or accessible to the public during its operating hours”. A mall atrium, a trade hall and a ticketed concert ground all fit. The exceptions are household use and lawful surveillance by government agencies.
Who is responsible for the cameras?
Whoever decides why they’re there. In privacy law that’s the personal information controller: often the venue for its fixed cameras, and the organizer for cameras added for the event. The circular makes the controller “responsible for personal data processed using CCTV systems” and asks for “contractual or other reasonable means” to bind any contractor who runs them.
If a security agency installs or monitors event cameras, say so in its contract. The Private Security Services Industry Act lets the PNP cancel an agency’s license if it “intentionally and maliciously makes use of electronic security devices or remote video surveillance in a manner that violates the privacy of civilians”.
Do guests have to consent to being filmed?
Usually not, and the circular says consent is often the wrong basis. Controllers “shall determine the more appropriate lawful basis other than the consent of the data subject”, because “consent may not be the most suitable lawful basis” for “open surveillance in public and semi-public places”. The security of the crowd and the venue is the usual purpose. What guests are owed is clear notice.
What does the CCTV notice need to say?
That cameras are in use, and why. The circular asks for notices that are “readily visible and prominently displayed”, at “points of entry or other conspicuous areas”, in “clear, plain, and concise language”. At an event, that means a sign at every gate and at the registration desk, not one line buried in the ticket terms.
Where can’t the cameras go?
Anywhere people expect privacy. The circular says CCTV “in areas where individuals have a heightened expectation of privacy (e.g., fitting rooms, rest rooms, toilets, lactation or breastfeeding rooms,) is strictly prohibited”. At an event, treat talent dressing rooms and any nursing station as part of that list.
How long can footage be kept?
Only as long as it’s needed. The circular says “there is no specific retention period”, but footage “shall be retained only for as long as necessary to fulfill the purpose”, the period “shall not be determined based solely on the storage capacity”, and footage “shall be destroyed once it is no longer needed”. Write the period into the security plan, for example until any incident report is closed.
Guests can also ask to see footage of themselves. The circular gives the controller “five (5) working days” for a viewing request and “fifteen (15) working days” for a copy. And footage of identifiable guests can’t go to the media “for amusement or entertainment purposes” without their consent.
What about bag checks and ID logbooks?
A bag check is access control, and the private security law treats it as a guard’s job: its definition of security services includes the act “to conduct access control/denial in any form whether physically, manually or scientifically”. Leave it to the licensed agency, as our guide to event security explains.
The logbook or ID scan at the gate is personal data under the Data Privacy Act. It needs a stated purpose, a notice, and a plan for where the sheets or files go after the event. Lead forms at a brand booth follow the same logic; see data privacy at brand activations.
The camera plan on one page
| Item | What the circular asks |
| Purpose | Declared before the cameras run; security of people and property is the usual one |
| Notice | At every entry point, in plain language |
| No-go areas | Rest rooms, fitting and changing rooms, lactation rooms |
| Live feeds | Watched only by people named in the CCTV policy |
| Storage | Secure and encrypted |
| Retention | Only as long as the purpose needs, then destroyed |
| Access requests | Viewing within 5 working days, a copy within 15 |
Put it in the security plan
One page is enough: who controls the cameras, why they’re there, where the signs go, who watches the feed, and when the footage is deleted. Ask the venue for its own CCTV policy at the ocular.
General information from NPC Circular No. 2024-02, the Data Privacy Act and RA 11917. This is not legal advice; check the plan with the client’s data protection officer before the event.
What should you ask an agency?
Who controls the cameras on the day, and who answers an access request afterwards. When you compare agencies for the best events agency in the Philippines, put both questions to each one. PUNX is an events agency in Makati: 50-plus people, founded 2023, running activations and events for GCash, Sun Life and JTI.
FAQ
Is CCTV at an event covered by the Data Privacy Act?
Yes. NPC Circular No. 2024-02 covers CCTV systems that process personal data, including in semi-public spaces: privately owned spaces open to the public, such as malls, halls and event grounds.
Do event guests have to consent to CCTV?
Generally not. The NPC says consent may not be the most suitable lawful basis for open surveillance in public and semi-public places, so organizers usually rely on another basis, such as security, and give clear notice.
How long can event CCTV footage be kept?
There is no fixed period. Footage may be kept only as long as the declared purpose needs, the period must be written into the CCTV policy, and footage must be destroyed once it is no longer needed.
Can a guest ask for CCTV footage of themselves?
Yes. The circular gives the controller up to five working days for a viewing request and up to fifteen working days for a copy, with an extension possible for complex requests.
Related
How to choose an events agency — the buyer’s guide
Event security — licensed guards, bag checks and the security plan
Data privacy at brand activations — lead forms and consent
Running cameras at your next event?
Send us the venue and the guest count. We’ll draft the CCTV notice and the one-page camera plan with the security brief.
Start a project ↗