The request never arrives on a schedule. Somebody turns an ankle in the parking lot on a Saturday, and the letter asking about it shows up weeks later. A truck clips a bollard at the dock and the carrier’s adjuster wants the two minutes on either side of it. A door that keeps propping open turns into a disagreement, and somebody wants to see what the camera above it recorded. Three ordinary requests, and all three end at the same recorder in the same closet.
Those requests arrive at buildings with good equipment and good installers. What tends to give way is not the camera. It is whether the file that comes out of the recorder covers the right minutes, opens on a computer that is not yours, and carries a time anybody else can rely on.
I wrote a sentence about this six years ago that I have not been able to improve on: “The wrong time to find out that your system is not recording is after an incident has been reported.” I keep coming back to it because the checks that would answer it are not usually part of a service visit, so they tend to go unrun. I founded Verified Security in 2007 and have spent nearly two decades designing, installing, and servicing commercial security systems across metro Atlanta, so let me walk it the way I would walk it in your building.
The short version. Recorders hold a different number of days than the calculation predicted, and your busiest camera is usually the reason. Georgia’s rule for admitting security camera video evidence from an unattended camera asks that the date and time be on the recording, and Georgia courts treat a drifted clock as a question of weight rather than admissibility. The export is the step that gets tested least. Five checks cover it, and the first three take about twenty minutes.
How Many Days You Actually Have
The retention number on your proposal was a calculation, and the calculation made assumptions about your building that your building did not agree to keep.
Storage gets spent on movement. A camera pointed at a busy loading dock, or at a tree line that shifts every time the wind does, writes far more data per hour than one pointed at a quiet stockroom, because there is more changing in the picture for the encoder to describe. That does not give the busy camera a shorter window of its own. Most recorders record every camera evenly and overwrite the oldest video once the drives fill, so every camera on that recorder runs out on the same day. What the busy camera does is spend the disk they all share, which means it also sets the window for the quiet stockroom.
If your recorder is set to record on motion rather than continuously, that window moves around instead of holding still. A quiet month holds a longer stretch on the same drive than a busy one, with nothing about the equipment having changed, and an empty timeline is not proof that nothing happened there.
Then there is the wear item. I pointed this out in 2011 and it has aged well: as recorders get older, the hard drives are often the first parts to fail. A recorder with several drives can lose one and keep running. Whether that costs you your safety margin or quietly costs you days comes down to how those drives are arranged. The live view looks exactly the way it always has either way.
The failure I have seen most often over the years is the one where none of that arithmetic matters. Somebody has an incident, goes to pull the video, and finds the drive failed a while back and there is nothing recorded at all. The cloud-managed systems we install now will notify us and the customer when a drive fails, so it gets handled before there is an incident to miss. The older local recorders had no way to tell anybody.
So one number is worth trusting, and it is not on any spec sheet: the oldest recorded frame on your busiest camera today. The forensic best practice for acquiring video from a recorder (SWGDE 17-V-002, Version 1.4, June 2, 2026) lists that same earliest recorded date and time among the items to document, along with whether the recorder is set to overwrite or to stop when the disk fills.
Run this check: scroll your busiest camera back as far as its timeline goes and count the days between that frame and today. If your building has more than one recorder, do it once on each, because the recorder watching the busiest scene is the one that runs shortest.
What the Law Actually Requires You to Keep
Banking and healthcare are the two easiest places to check, and both are published.
The federal rule sets out what a national bank’s security program has to contain, including procedures that help identify who committed a crime against the bank and preserve evidence, and it lists “Maintaining a camera that records activity in the banking office” among the ways to do that. It never says how long the recording has to be kept. On the healthcare side, the HIPAA Security Rule’s physical safeguards name no camera and set no video retention period, and its six-year retention requirement is a rule about documentation.
The obligations that are real tend to come from a contract rather than a statute. If your business stores, processes, or transmits cardholder data on your own premises, the current payment card standard requires that individual physical access to sensitive areas inside that environment be monitored, with video cameras or physical access control mechanisms or both, and that the collected data be stored for at least three months unless a law says otherwise (PCI DSS v4.0.1, requirement 9.2.1.1). That is an agreement with your bank and the card brands, and its scope is the room where cardholder data lives, not the sales floor. Some business licenses carry camera conditions too, and there a rule requiring a camera and a rule setting how long you keep what it records are two different rules.
The one retention figure I have found from a standards body written for ordinary commercial institutions is a floor rather than a target. The forensic guidance for commercial video security systems (SWGDE 15-V-001, Version 1.0, September 29, 2015) recommends keeping recordings “for the longest time possible (minimum of 10 days)” with the least compression the system can manage, and then says the honest part plainly: institutional requirements dictate how long recordings must be kept.
Which puts the decision back where it belongs. Set the window by how long it takes an incident to actually surface in your business. A break-in surfaces Monday morning. A slip in the parking lot can surface after a season.
The call I get is the one where those two numbers never met. There was an incident, sixty days went by before anybody needed the video, and the recorder holds thirty. Nobody saved it the day it happened, and by the time the question arrives there is nothing left to save.
In Georgia, the Recorder’s Clock Is Worth Writing Down
Video from an unattended camera comes in under its own rule, and the rule mentions the clock by name.
Georgia’s provision for recordings made when the device “was not being operated by an individual person” admits them, subject to any other valid objection, when the court determines on competent evidence that they “tend to show reliably” what they are offered to show, “provided that, prior to the admission of such evidence, the date and time ... shall be contained on such evidence, and such date and time shall be shown to have been made contemporaneously with the events depicted.” The same Code section adds that this is not the exclusive route, so ordinary authentication by a witness with knowledge remains available.
That condition is narrower than it sounds. In Dawson v. State, 283 Ga. 315 (2008), decided under the materially identical predecessor of that Code section, Georgia’s Supreme Court upheld the admission of a hotel surveillance recording whose displayed time was off by more than an hour and a half, treating the discrepancy as going to the weight a jury gives the video rather than to whether it comes in. What the statute asks for is a recording whose time runs with the events, not a clock that is right to the second. A drifted clock does not throw your video out. It hands the other side an afternoon and makes your own reconstruction harder, which is reason enough to know the number. I covered why the clocks in a building drift apart in the post on integration.
Once a request is on the table, professionals stop correcting the clock and start writing the difference down. The acquisition best practice asks an examiner to record the recorder’s system time against government-standardized atomic-clock time, calculate the offset, and leave the recorder alone: “Do not change the time and date on the DVR system.” That is a rule about a live incident, not about maintenance. Before anything is pending, pointing your recorder at a reliable time source is the right move, and most equipment installed in the last several years can do it.
Run this check: stand at the recorder with your phone showing the time, write down both readings, and subtract. Keep the difference somewhere other than your memory.
The Export Is Where It Breaks
A system can hold ninety days, keep perfect time, and still hand a detective a file nobody can open. This is the most common failure I see.
We have watched it happen more than once. A customer exports the clip to a flash drive and hands the drive to a police detective, the detective takes it back to his own computer, and the file will not open. That is the entire failure. Nothing was wrong with the camera, the recording, or the timing.
Most recorders offer two ways out, and the acquisition best practice is clear about which is closer to the original. When both an open format and a native format are available, “A native file format or proprietary file format is likely to provide best evidence for legal authenticity purposes as it is closest to the original manner of recording,” and the proprietary player or codec should be acquired from the device or the manufacturer along with it. The familiar format is the second copy. Which means the player has to travel with the file, and somebody has to know where to get it.
Two things have gotten better since. Some systems will download the clip in the recorder’s native format and download a player that reads it in the same step, which solves the traveling-player problem at the source. Cloud-managed systems skip the drive entirely: you enter the recipient’s email address and the system sends a link to the clip. Not long ago I walked an owner with three restaurants through exporting and sharing an incident that way. It took about five minutes, and nobody drove anywhere.
A few traps live in that same best practice, and they all surface at the worst possible moment.
- Some recorders cap how much can be exported at once, and it notes this limit “may not be specified in the system manual or known to the manufacturer.” That is how an export that should take one pass turns into a dozen, on the afternoon somebody is waiting.
- The live monitor can flatter the system. A review of the live view “may appear to be of better quality than the actual recorded video because compression has not yet occurred.”
- Turning the quality up afterward does nothing for what is already on the disk. Adjusting settings during acquisition “will not improve the quality of the video that has already been recorded.” That was decided the day the recorder was configured and the day the camera was aimed.
Run this check: export five ordinary minutes from last week, put it on a flash drive, and open it on a laptop that has never touched your system.
What to Ask For in a Bid
Georgia’s rule asks that the date and time be on the recording. The federal export recommendation asks for something in addition: that the time also sit where a computer can read it. NIST, writing to the FBI’s minimum interoperability requirements for exported CCTV video, says that “Perhaps the most critical metadata associated with video recordings needed to support investigations is an accurate reference to the date and time of capture,” and that timestamps “must not be ‘burned’ into the pixel data of the video itself,” which is a rule about the exported file rather than about what Georgia will admit. The way I read it, a system that gives you both is the safer buy.
That NIST document is also the shortest set of questions to put in a bid: what container does an export come out in, does it export at the quality the system records at, does every frame carry a timestamp software can read, and does the export record the recorder’s clock offset. Few products answer all four today. Asking is how you learn which one you are buying, and what you will be handing somebody later.
When the Duty to Preserve Begins
In Georgia, the duty to hold onto video can begin before any letter arrives, and the standard is published.
The Georgia Supreme Court held in Phillips v. Harmon, 297 Ga. 386 (2015), that the duty to preserve relevant evidence “is triggered not only when litigation is pending but when it is reasonably foreseeable to that party,” and that notice “may also be derived” from circumstances including the type and extent of the injury and how often litigation follows similar situations. In a footnote it added a qualifier worth knowing: a defendant’s duty “does not arise merely because the defendant investigated the incident, because there may be many reasons to investigate incidents causing injuries, from simple curiosity to quality assurance to preparation for possible litigation.” An investigation is one circumstance among several.
In September 2025 the Court of Appeals applied this to surveillance video at a private school. In Hailu v. John Milledge Academy (Ga. Ct. App. No. A25A1130, Sept. 12, 2025), a visitor fell and the video was overwritten before it was requested. The court held that the plaintiff “did not have to prove the contents of the destroyed surveillance video,” noting there was evidence the location of the fall “would have been visible” to the school’s cameras, reversed summary judgment for the school on the underlying hazard, and sent spoliation back for the trial court to apply the correct standard. The practical read for an owner is narrow: a hold on one date range is the whole of it, and placing one is a phone call.
What I notice about cases like these is how ordinary the equipment story usually turns out to be. In Murphy v. Janilink (Ga. Ct. App. No. A24A1849, Mar. 3, 2025), a business produced forty-eight surveillance videos and there was still “a 42 second gap in the video that covers the time” the fall happened. The explanation it offered, in an employee’s sworn affidavit, was that the system “periodically went down due to power surges and overheating.” That company won its case. Getting there still took a motion to compel, a sworn employee affidavit, an opposing expert, and an appeal to defend. Power events do that to recorders, which is a large part of why I wrote about what a power outage does to a security system.
Run this check: find out who in your organization can put a hold on a date range, and whether your recorder can lock one.
Who Is Allowed to Hand Over the Video
There is a version of this that goes badly and it has nothing to do with the law. A detective arrives at four in the afternoon, the one person who knows the recorder password is on a job site, and there is nothing at the recorder that tells anyone else what to do.
The commercial-institution guidance treats this as a documentation problem with a boring answer. Adequate system documentation should be kept with the system, and among the things it asks for are the makes and models, the manuals, the retention schedule, and the instructions for downloading and outputting recordings. That information, it says, “should be verified monthly and made available to responding law enforcement officials upon their arrival at the scene.”
That is a one-page sheet in a drawer, not a policy project. Two lines are worth adding that it leaves out. The acquisition best practice supplies one: among the items it asks an examiner to consider documenting is how many microphones are connected. Some cameras ship with a microphone built in and some do not, and on the ones that have it, recording the audio is usually a checkbox in the recorder. We leave it off. A customer can turn it on, which means it can be on in your building without anyone having treated it as a decision. Put that microphone list on the sheet, because audio is a separate legal question from video and it belongs with your attorney rather than your installer. Then name the two people authorized to release video. Two, because one is a single point of failure and a list of twelve is nobody.
One place I disagree with that same commercial-institution guidance, and I would rather say so than split the difference. It wants the password kept with the system. I do not put a recorder password on a sheet in a drawer. Put who holds the credential on the sheet instead, and keep the credential where your business keeps credentials, which is the argument I made in the post on camera cybersecurity. Name two people who can get into the recorder and the afternoon in that opening scene resolves itself.
Who may receive video is also a different question from who may retrieve it, and a police officer at the counter, a subpoena, an adjuster, and a private party asking a favor are four different situations. Decide that with your attorney once and put the answer on the sheet.
Run this check: name the two people who may release video and the two who can log in, and put the sheet where the recorder is.
Where This Is Not the Right Answer
I would rather draw these lines myself than let a proposal draw them for me. If you already have an incident, a demand letter, or an open claim, stop reading and call your attorney. Nothing here is legal advice, and once a matter is live, decisions about preserving and producing video belong to counsel.
We also do not pull, package, or certify evidence. Every recorder has its own retrieval procedure, and the day-of retrieval belongs to you, your attorney, or a forensic examiner. What a security company is genuinely useful for is the part before that: verifying what your system holds, rehearsing the export with your people so the day of an incident is not the first attempt, and writing it down.
Days of storage is a measurement rather than a formula. The standards explain the mechanism and decline to publish arithmetic, because the number depends on your building. The only figure worth writing down is the one on your own timeline.
Thirty days is not a law. Neither is sixty or ninety. If a number reaches you as a requirement, ask which statute it comes from. Longer is not automatically better either: more days is more cost, and more video somebody can ask you to produce.
Securing the network all of this rides on is your IT provider’s work, and I am not going to pretend to be your IT company. What I will do is tell you what the equipment needs and hand that to whoever runs your network.
Five Checks to Run This Week
The first three take about twenty minutes. The last two take a conversation. This is the version to print, and each one tells you what passing looks like.
- Find the oldest frame. Count the days between the oldest frame on your busiest camera and today, and repeat it on every recorder in the building. It passes when that count is larger than the longest an incident has ever taken to reach you.
- Write down the clock offset. Compare the recorder’s displayed time to your phone and subtract. It passes when the difference is written down with the date. If the recorder can synchronize to a time source, ask your IT provider to point it at one and your integrator to confirm it took.
- Run a test export. Pull five ordinary minutes and open the file on a computer outside the system. It passes when the video plays there and you know where the player comes from.
- Decide who can place a hold on a date range, and find out whether your recorder can lock one. It passes when the name is on paper and the person answering your phone knows it.
- Decide who may release video, name two of them, and put it all on one page in the drawer by the recorder. It passes when somebody who is not you can find the sheet and use it.
Frequently Asked Questions
How long should a business keep security camera footage?
Long enough to cover how long it takes an incident to surface in your business, which is usually longer than the window a proposal assumes. A break-in surfaces Monday morning. A parking lot injury can surface after a season. Forensic guidance recommends the longest time a system allows, names ten days as a floor, and leaves the real number to the institution.
Is a business legally required to keep security camera video in Georgia?
Generally no. No broad Georgia or federal rule sets a retention period for an ordinary commercial business. Narrower obligations exist, including the payment card requirement that monitoring data for sensitive areas in a cardholder data environment, whether from video cameras or physical access control mechanisms, be kept at least three months. Check your own license conditions and your card processing agreement.
What makes security camera video evidence usable in a Georgia court?
Georgia admits recordings from unattended cameras, subject to any other valid objection, when the court determines on competent evidence that they tend to show reliably what they are offered to show, and the statute asks that the date and time be on the recording and be shown to match when the events happened. Georgia courts have treated an inaccurate time stamp as a question of how much weight the video gets, not whether it comes in.
What should I do when someone asks my business for security camera video?
Preserve the window first, because it is closing while the question is being discussed. If your recorder can lock or protect a date range, lock it. If it cannot, export that window in the recorder’s native format, with its player, before anything else. Note the time of the request and who made it. If a claim or a demand letter is involved, call your attorney before you release anything.
Can I record audio with my security cameras in Georgia?
Treat audio as a separate legal question from video. Georgia’s rules on recording conversations are not the same as its rules on recording images, and the answer turns on facts your attorney should weigh. Start by getting a written list of which cameras have a microphone and whether audio recording is switched on in the recorder, then take that list to counsel. It is normally off, and it is normally one checkbox away from being on.
Find Out Before Somebody Asks
Run the first three yourself. If they pass, you have the answer in writing and it cost you nothing.
If any of them fails, or if you would rather have the answers documented than remembered, contact us and we will put it on paper. We will count real retention recorder by recorder and date what we measured, so you have a number instead of a spec sheet. We will note the recorder’s clock offset and tell you and your IT provider what the equipment needs to stay synchronized. And we will walk your people through a test export. On a system we installed, that is usually a phone call, and on a cloud-managed one nobody has to drive out. On a system we did not install, I will tell you straight whether we know it well enough to help that way, and if we do not, we can schedule a technician to try it. Either way you end up with a written description of what your recorder can and cannot produce, in language you can put in front of the next bidder.
We have protected Atlanta businesses since 2007, and the answers above take an afternoon whether we run them or you do. Reach my team at 678-924-7480.
Current as of August 2026. We review this post annually.
Scott Hightower founded Verified Security in 2007 and has spent nearly two decades designing, installing, and servicing commercial security systems across metro Atlanta. Verified Security is an authorized Honeywell security provider and specializes in access control, video surveillance, intrusion, and fire alarm systems. Reach Scott’s team at 678-924-7480.