India's new CCTV rules: what buyers and installers need to know
Since April 2026, internet-connected CCTV cameras must meet security requirements and be certified before they can be sold or installed. The change affects every company, building and public body that buys surveillance equipment.
CCTV cameras are everywhere: offices, factories, housing societies, highways, railway stations. Most are now connected to the internet. That makes them useful, and it also makes them a security risk. A badly secured camera can be a doorway into a network, or a way for footage to leave the country without anyone noticing.
India has responded with one of the stricter regimes in the world. The Ministry of Electronics and IT brought CCTV cameras under its Compulsory Registration Order in April 2024, built around a set of Essential Requirements for security. After a transition period, the relaxation ended in January 2026, and from 1 April 2026 non-compliant internet-connected cameras can no longer be imported, manufactured, sold or installed.
What the rules require
- Testing at an authorised laboratory and certification by STQC, the government's testing and quality agency, against the Essential Requirements
- BIS registration, which dealers must check alongside STQC certification
- No default or hard-coded passwords, strong encryption and secure, updatable firmware
- Disclosure of where critical components such as chipsets and firmware come from, with source-code review and factory inspection possible in some cases
Who is affected
Government buyers face the strictest test. Tenders now expect certified equipment and suppliers who meet public procurement rules. A non-compliant bid will simply be rejected.
Companies and institutions need to check what they buy and what their installers fit. Non-compliant systems can cause problems in audits and insurance claims, not just with regulators.
Existing users do not have to rip out cameras already installed. The practical risk is different: if a brand leaves the Indian market, its cameras may stop receiving security updates. An unpatched camera is exactly the risk the rules were written to prevent.
A practical checklist
- Ask every supplier for the STQC certificate and BIS registration for the exact model, not the product family
- Make certification a condition in purchase orders and installation contracts
- List your existing cameras, and check whether each manufacturer still supports them with updates
- Plan replacement of unsupported cameras in critical locations first
Costs will rise in the short term as manufacturers absorb testing and compliance. But the direction is right. A country building smart cities and intelligent highways cannot afford a surveillance network that others can switch off, or switch on, from outside.