Security

Destroying and erasing CCTV footage: how it really disappears

7 July 2026 · 12 min read · DeSnipperaar

CCTV footage must not be kept longer than needed. But knowing when footage should go is one thing, actually making it disappear is another. Erasing on the recorder, secure overwriting and, at the end of the line, destroying the hard drive are three different actions. Anyone who just presses reset thinks the footage is gone, while in fact it is often still recoverable.

This article is not about how long you may keep footage, but about what must happen afterwards. How does footage technically disappear, where are the pitfalls and why must the drive from the DVR go into the shredder at end of life? First run through these questions:

• Do you know whether your recorder really overwrites old footage within the retention period?
• Can you keep an incident clip separately without keeping the whole archive?
• Do you know what happens to the hard drive when the recorder is replaced?
• Do you have a certificate with the serial number for that drive?
• Can you show that the footage is irreversibly gone?

If you hesitate on any of these, the sections below show how to erase and destroy CCTV footage properly.

Erase or destroy, what is the difference?

The two words look the same but describe different things. Erasing means you remove footage from a carrier you keep using afterwards. The recorder runs on, the drive stays in place, only the old recordings are gone. Destroying means you make the carrier itself illegible. The drive is physically broken up so nothing can be read from it. During daily use you erase, at the end of life you destroy. Both belong to the job. Anyone who does only the first keeps a risk for the moment the equipment leaves the building. This difference is the thread running through this article.

How CCTV footage normally disappears: the overwrite cycle

Most footage disappears on its own. A DVR or NVR works with a ring buffer. The drive fills up and the oldest recordings are overwritten by the newest. With that cycle set correctly, footage disappears exactly when it is past its retention period. For most organisations four weeks is the guideline of the data protection authority. Make sure the overwrite period is set to that, not to the maximum capacity of the drive. How long you may keep footage exactly is in the retention and destruction of CCTV footage. The beauty of this cycle is that erasing happens automatically without anyone having to do anything.

The limits of automatic overwriting

Overwriting sounds watertight, but it has limits. A larger drive or a smaller number of cameras means it takes longer before the buffer comes round. Then footage sometimes stays for months while you thought it was gone after four weeks. Many systems also keep a separate folder for flagged clips or alarm recordings that fall outside the normal cycle. Those are not overwritten and so stay indefinitely. So check whether the set period matches the actual fill level and whether no shadow archive is running alongside. Automatic overwriting only works if it actually comes round within your term.

Exporting an incident clip safely

Sometimes you do want to keep something. In a theft, an accident or a complaint you need a piece of footage as evidence. The mistake many organisations make is to extend the whole retention period or put the complete archive on a drive. That is keeping more than needed. Better to export only the relevant clip. Cut out the section that shows the incident, save it as a separate file with date and time in the file name and store it securely. The rest of the footage you simply let be overwritten. That way you hold exactly what is needed and nothing more. Also record briefly why you keep this clip and for how long, so it does not sit forgotten in a folder.

Erasing the incident clip afterwards too

A kept clip is not a forever clip. As soon as the reason has passed, the case is settled or the legal claim is concluded, that separate file must go too. Many people forget this, because it sits apart from the normal cycle and so is not overwritten automatically. So set an end date right when you export. If the clip is on a USB stick or a separate drive, treat that as a data carrier with personal data. At the end the file goes, or with a retired stick the carrier goes into the destruction. That way no scrap of footage is left to live on out of your sight.

Reset or format is not erasing

Here lies the biggest misconception. Many people think a factory reset or a quick format removes the footage. It does not. A reset mainly clears the settings and the references to the files, not the footage itself. The raw data stays on the drive until it is overwritten by new recordings. With standard recovery software a surprising amount of that can be retrieved, even by someone without special knowledge. A formatted DVR drive that you sell or throw away can therefore still hold weeks of recognisable footage. For a drive that stays in use that is no disaster, but for a drive that leaves the building it is a leak. Reset is reassurance, not destruction.

Securely erasing a drive you keep

If you want to reuse a drive, for example in another recorder, secure erasure is the right method. That is different from a quick format. In secure erasure the whole drive is overwritten according to a recognised method, so the old footage can no longer be recovered. For magnetic drives, which most DVR drives are, overwriting works well. An SSD needs a built-in secure-erase function, because overwriting is less reliable there. Bear in mind that secure erasure takes time and that you must be able to show it happened. For retired drives this is often more trouble than it is worth, and organisations choose the safe route of physical destruction.

The end of the recorder's life

A DVR or NVR lasts about five to eight years. After that a new one arrives and the old one goes. It is precisely at that moment that the risk arises. The old recorder disappears into a corner, goes back to the supplier or ends up with the scrap metal, with the drive still in it. That drive holds weeks of footage of visitors, employees and passers-by. So at replacement, agree that the installer does not simply take the old drive away. The data is yours, so you decide what happens to it. Remove the drive or have it removed, and treat it as a data carrier with personal data. The same goes for a move or for closing a site, because then too equipment is easily left behind.

Why the hard drive from the DVR must be physically destroyed

Once the drive leaves the building, overwriting is no longer the practical choice. You cannot overwrite for hours on the spot, and you want to be sure nothing comes back. The only guarantee is that the drive itself is made illegible. In physical destruction the drive goes into the shredder and only a heap of metal particles is left. No sector can be read any more, no recovery software can reach it. For the sensitivity of CCTV footage that is appropriate, because it concerns recognisable people. Have the drive shredded to DIN H-4 or H-5. How that works and what it costs is in having hard drives shredded. The same approach applies to all data carriers, as described in our overview of data destruction.

Do not forget SD cards and loose storage

Not all footage sits in a central recorder. Many IP cameras have their own SD card as local storage, and that is often forgotten in a clear-out. A loose camera that is replaced or thrown away can go out the door card and all, while it just as easily holds recognisable footage. So make a list of every place where footage is stored, not only the main recorder but also loose cards, backup drives and any export sticks. An SD card is not reliably erased by a format, so have those physically destroyed too. Small size does not mean little data, because a card easily holds several weeks of recordings.

Cloud footage: erasing via the supplier

More and more camera systems store footage in the cloud. Then you have no drive in hand to destroy, but depend on your supplier. Arrange in the contract what happens at termination. Ask for a written confirmation that the footage has been deleted, including backups and log files. Also ask how the physical layer at the supplier is cleared when their drives are retired. Without those agreements you do not know whether your footage is really gone or sits somewhere on a backup copy. With cloud the destruction shifts from your hands to the contract, so it must be well arranged there.

The certificate as proof

For the drives and cards you have physically destroyed you receive a certificate of destruction. It states the date, the level applied and the serial number of each carrier. That serial number matters, because it links the proof to exactly that one drive from your recorder. At an inspection or a question you can then show that the footage is not wandering around but demonstrably destroyed. Keep the certificate with your record of processing, together with the note of which camera system it concerned. Without that paper there is no difference between a proper destruction and a drive you supposedly erased.

Demonstrability and the GDPR

CCTV footage is personal data, so the accountability principle of the GDPR applies here too. You must not only clear out in time, you must be able to show you did. For the automatic cycle you record the set retention period in your record of processing. For the drives that leave the building you keep the certificate. Together they form the proof that footage disappears properly both during use and at the end of the line. If it ever comes to a data breach, demonstrability helps you straight away. A lost recorder with a drive made illegible is something very different from a lost recorder full of usable footage. How to report a breach is in reporting a data breach in 72 hours.

What does destroying the drive cost?

Destroying data carriers is settled per item, with serial-number registration and certificate included. You hand over the drive or card and you get a fixed price in advance, with no surprises afterwards. We work with a pickup service within 20 km of Amsterdam, with no call-out fee and no walk-in on site. If you have several drives from different systems, they can come at once. Paper and other carriers can come in the same collection too, each destroyed to the right level. That way you arrange the whole clear-out of your camera system in one go, with conclusive proof for every part.

Common mistakes

• Treating a reset as erasing. A factory reset simply leaves the footage on the drive.
• Leaving the drive in at replacement. The old recorder disappears with weeks of footage still in it.
• Keeping the whole archive over one incident. Export only the relevant clip.
• Forgetting SD cards. Loose cameras hold recognisable footage just as much.
• Not asking for a certificate. Without proof with a serial number you can show nothing.

Step by step: from erasing to destroying

1. Set the overwrite cycle to your retention period, not to the drive capacity.
2. Export an incident as a separate clip with an end date.
3. Inventory all storage: recorder, SD cards, backups and cloud.
4. At replacement remove the drive and do not let it simply be taken away.
5. Have drives and cards shredded to DIN H-4 or H-5.
6. Keep the certificate with the serial number in your record of processing.

Frequently asked questions

What is the difference between erasing and destroying CCTV footage?

Erasing removes the footage from a drive you keep using. Destroying makes the carrier itself illegible. At the end of the recorder's life the hard drive should be physically destroyed, because a reset leaves data behind.

Is a reset or format enough to erase CCTV footage?

No. A factory reset or quick format only clears the references, not the footage itself. Much of it can be recovered with standard software, so for retired drives physical destruction is the safe route.

Must the hard drive from the DVR or NVR be destroyed?

Yes, at end of life. That drive holds weeks of recognisable footage. Have the drive shredded to DIN H-4 or H-5 and keep the certificate with the serial number as proof.

How do I keep an incident clip before the footage is erased?

Export only the relevant clip to a separate file with date and time, store it securely and let the rest of the footage simply be overwritten or erased.

Does this also apply to SD cards and cloud footage?

Yes. SD cards you have physically destroyed, because a format does not reliably erase them. For cloud footage you arrange in the contract that the supplier deletes everything, including backups.

Conclusion

Making CCTV footage disappear is more than pressing reset. During use you erase through a correctly set overwrite cycle. An incident you keep as a separate clip with an end date. And at the end of life you physically destroy the hard drive from the recorder, because a reset or format simply leaves the footage in place. Do not forget the SD cards and the cloud. Have drives shredded to DIN H-4 or H-5, keep the certificate with the serial number and record the retention period in your register. That way the footage really disappears, and you can show it too.

See also: the pillar on retention and destruction of CCTV footage, plus how long to keep CCTV footage, CCTV footage and GDPR rights and the CCTV camera rules for business and home.

---

Camera system due for replacement? Request a quote via desnipperaar.nl for collecting and shredding the hard drive, with a certificate as proof.