Body cameras are now common equipment for security guards, construction supervisors, and field staff across mainland China. But unlike many Western markets where recording law mostly comes down to consent between two people talking, China regulates body camera footage as personal information, and sometimes as sensitive personal information, under a completely different legal structure.
For employers, that distinction matters. Getting it wrong under China’s Personal Information Protection Law isn’t a civil dispute risk the way it is in some other countries. It can trigger administrative penalties, forced suspension of the processing activity, and fines calculated as a percentage of company revenue. Here’s what actually governs body camera use in China, and what employers need to have in place before deployment.
The Legal Framework Behind Body Camera Use in China
There isn’t a single “body camera law” in China. Instead, several overlapping rules apply depending on what the camera captures and how the footage is used.
The Personal Information Protection Law (PIPL), effective since November 2021, is the primary statute. It governs how any organization collects, stores, and uses personal information tied to an identifiable person, which includes video footage showing someone’s face or other identifying features.
The Regulations on the Administration of Public Security Video Image Information Systems, effective April 1, 2025, set rules for where cameras can be installed and how footage from public and quasi-public areas must be managed.
The Security Management Measures for the Application of Facial Recognition Technology, effective June 1, 2025, apply specifically when body camera footage is run through facial recognition, whether for identity verification, incident tagging, or access control.
Layered on top of these are the Cybersecurity Law and Data Security Law, which govern how footage is stored, secured, and transferred, particularly if it ever leaves mainland China.
When Body Camera Footage Becomes “Personal Information”
Under PIPL, any recording that identifies a specific person counts as personal information, and that includes an employee’s own face captured on their own body camera, as well as anyone else who appears in the footage. This means employers are personal information processors the moment a camera starts recording, not just when footage is reviewed or shared.
Plain video without facial recognition is treated as ordinary personal information. It still requires notice and a lawful basis for processing, but the bar is lower than for sensitive categories.
The moment facial recognition is applied to that footage, whether built into the camera or added later through software, it becomes sensitive personal information. PIPL defines sensitive personal information as data that could cause harm to personal dignity or safety if misused, and biometric identifiers like face geometry fall squarely into that category. Processing sensitive personal information requires a specific, standalone legal basis and a higher standard of consent than routine video recording.
Notice and Consent Requirements for Employers
PIPL requires employers to give employees a clear privacy notice before processing their personal information, including through workplace cameras. That notice needs to explain who is collecting the footage, why, what categories of data are involved, how long it will be kept, and how an employee can exercise their rights over it.
For ordinary video recording, employment necessity can often serve as the legal basis for processing, provided the notice requirement is met and the monitoring is proportionate to a legitimate business purpose. Employers still need to inform employees that cameras are in use, ideally through a written policy and visible signage.
For facial recognition specifically, the bar is higher. PIPL requires separate consent, meaning consent obtained specifically for that use and not bundled into a general employment agreement or a broader HR policy. Employers cannot rely on an employee simply having signed an employment contract as proof they agreed to facial recognition processing. If an employee declines, the employer generally needs to offer an alternative way to achieve the same purpose, such as manual verification instead of face-based check-in.
Public and Semi-Public Space Recording Rules
The video surveillance regulation that took effect in April 2025 governs how footage is captured in areas the public accesses, which is relevant for body cameras used by security staff in shopping centers, transit hubs, construction sites open to visitors, or similar environments.
Cameras used in these settings need to be installed for a legitimate security purpose, and the area being recorded should be reasonably scoped rather than capturing more than necessary. Certain areas remain off-limits for recording regardless of the justification, including changing rooms, restrooms, and other spaces where individuals have a clear expectation of privacy. Employers whose staff carry body cameras into these mixed public-private environments should build these restrictions directly into their recording policy and, where the hardware supports it, into the device’s operating settings.
Cross-Border Data Transfer: A Real Consideration for Manufacturers and Buyers
Because much of the body camera hardware and cloud infrastructure used in China involves international vendors, cross-border transfer of footage is worth flagging separately. If body camera footage or the personal information tied to it is transferred outside mainland China, PIPL requires the transferring organization to meet one of several conditions, such as passing a security assessment through the Cyberspace Administration of China, obtaining a recognized certification, or signing a standard cross-border transfer agreement with the receiving party.
This is a common point of confusion for organizations that assume domestic hardware automatically means domestic-only data handling. If footage is stored on servers outside China, or accessed by a parent company or vendor abroad, that cross-border transfer requirement applies regardless of where the recording device itself was manufactured or purchased.
Retention, Access, and Employee Rights
PIPL gives employees a defined set of rights over their own data, and body camera footage is no exception. Employees can request access to footage that identifies them, ask for correction of inaccurate records, and request deletion once the stated retention period has passed, the purpose has been fulfilled, or they’ve withdrawn consent where consent was the legal basis for processing.
Employers should set a specific retention period tied to a genuine business reason, document it in the privacy notice, and actually delete footage once that period expires rather than keeping it indefinitely by default. An unwritten or open-ended retention practice is one of the more common gaps regulators flag during review.
Penalties for Getting This Wrong
PIPL violations carry meaningful financial exposure. Regulators can order corrections, confiscate unlawful gains, and suspend the processing activity. For serious violations, fines can reach up to RMB 50 million or 5% of the organization’s revenue from the prior year, whichever is higher, along with potential penalties for the individuals directly responsible. Given that scale, treating body camera compliance as a documentation exercise rather than an afterthought is a reasonable investment for any employer deploying the technology at scale.
A Practical Compliance Checklist
- Issue a written privacy notice to employees before deploying body cameras, covering purpose, data categories, retention period, and how to exercise data rights.
- Post visible signage in any area where recording, and especially facial recognition, is taking place.
- Obtain separate, specific consent before enabling any facial recognition feature. Don’t bundle it into a general employment agreement.
- Offer a non-biometric alternative wherever facial recognition is used for identity verification.
- Confirm with your camera vendor whether facial processing happens on-device or in the cloud, and where that cloud infrastructure is physically located.
- Set and document a clear retention schedule, and actually enforce deletion once it expires.
- If footage or related data crosses China’s border at any point, confirm which PIPL cross-border transfer mechanism applies.
Manufacturers like Grandtime design body-worn cameras with configurable recording and storage settings, which gives compliance teams more control over exactly how footage is captured and where it’s processed before it becomes a regulatory question.
Frequently Asked Questions
Is it legal for employers in China to require employees to wear body cameras?
Generally yes, provided employees are given proper notice and the monitoring serves a legitimate, proportionate business purpose. The requirement becomes more demanding if the camera system includes facial recognition, which needs separate consent.
Does body camera footage count as personal information under PIPL?
Yes. Any footage that identifies a specific person, including the wearer or anyone captured on camera, is personal information under PIPL. If facial recognition is applied to that footage, it becomes sensitive personal information with stricter requirements.
Do employers need separate consent for facial recognition on body cameras?
Yes. PIPL requires separate, standalone consent for facial recognition and other biometric processing. General consent to an employment contract or a broad HR policy is not sufficient on its own.
Can body camera footage be stored on servers outside China?
It can, but doing so triggers PIPL’s cross-border data transfer requirements, which typically involve a security assessment, a certification, or a standard contractual agreement with the receiving party.
What happens if a company doesn’t comply with PIPL for body camera data?
Regulators can require corrections, confiscate unlawful gains, and suspend the processing activity. Serious violations can result in fines of up to RMB 50 million or 5% of the company’s prior-year revenue, along with liability for responsible individuals.
How long can employers keep body camera footage in China?
There’s no single fixed period set by law. Employers should define a retention period tied to a specific business justification, disclose it in the employee privacy notice, and delete footage once that period or purpose has been fulfilled.
