CCTV System Deep Buying Guide: Cameras, Storage & AI Features Explained

2026-10-09 | Ultimate Guide

CCTV buying guide: cameras, resolution, storage, PoE, AI and HK privacy rules.

The Most Expensive CCTV Mistake: Buy Wrong Once, Scrap the Whole System

CCTV differs from Wi-Fi — bad Wi-Fi can be fixed by adding access points, but wrongly positioned cameras, the wrong resolution, or miscalculated storage means missed footage with no remedy after the fact. This guide breaks down every purchasing decision: camera types, resolution and sensors, storage calculation, recorders and cloud, PoE, AI features, placement, and Hong Kong privacy compliance. It gives no prices and no fixed thresholds; every technical figure carries its applicable conditions.

Chapter 1: Camera Types — Different Positions, Different Cameras

Bullet: Directional, long range, visibly obvious form factor. Best for: entrances, corridors, car park entries. Downside: bulky, intimidating indoors.

Dome: Discreet appearance; unclear which direction it is facing. Best for: indoors, retail, offices. Downside: shorter range than bullets; dome covers need regular cleaning and inspection, as scratches or dust can affect image quality, especially infrared reflection at night.

PTZ: Remotely pan/tilt/zoom — one replaces several. But it views only one direction at a time — not magic. Best for: large areas (construction sites, car parks). Without a live operator, set preset patrols / preset positions and pair it with fixed cameras covering key positions; do not rely on a single PTZ.

Fisheye / 360°: One camera covers a large area. Best for: small shops, convenience stores, classrooms. But heavy edge distortion and little distant detail; positions needing detail should get an additional camera aimed at that position.

Before choosing a type, decide "conspicuous or discreet": bullets are visibly obvious, domes are more discreet — the choice depends on whether the site wants cameras to be seen or to blend in. Do not present camera appearance as having a proven deterrent effect.

Chapter 2: Resolution and Sensors — Megapixels Aren't Everything

Whether a person can be identified depends on the pixel density of the target in the frame and the distance, not on the megapixel figure alone. At the same megapixel count, the farther the shot and the wider the angle, the fewer pixels each face occupies. The table below is an arithmetic comparison of common pixel dimensions — note: a multiple in total pixels is not a multiple in storage use, nor a multiple in detail.

When choosing resolution, first fix the purpose (merely seeing whether someone is there, or identifying a person / reading a plate), then set pixel needs from distance and angle — do not chase megapixels blindly. Higher pixels may need a higher bitrate at the same bitrate setting to hold image quality, but storage use is ultimately decided by bitrate (see Chapter 3), not by a fixed multiple of pixel count.

Sensor Size: At the Same Pixel Count, Larger Generally Helps Low Light

At the same pixel count, a larger sensor generally helps low-light performance; check sensor size together with the datasheet's minimum illumination when buying — not pixels alone. For example, a 1/2.8" sensor is physically larger than a 1/3" sensor, and at the same pixel count its individual pixels are generally larger and collect more light. At the same sensor size, higher pixels mean generally smaller individual pixels, which may affect low-light performance; compare night vision from the datasheet's minimum illumination (lux) and on-site testing, not from marketing terms.

Focal Length: Decides the Angle of View

The shorter the focal length, the wider the angle and the fewer pixels the same target occupies; the longer the focal length, the narrower the angle and the larger a distant target appears. Choose focal length from installation distance and target position; do not state a fixed "how far it can see" distance — actual visible distance depends on light, target size and pixel density.

Night Vision: Check the Night Picture On Site, Not Only the Specification

Infrared distance is a manufacturer rating; actual results depend on the scene, wall reflections and mounting height; check the night picture on site before acceptance. Colour night vision needs sufficient ambient light or supplementary lighting, otherwise it switches to black-and-white infrared mode. Compare low-light performance from the datasheet's minimum illumination and on-site testing, not from marketing terms.

Chapter 3: Storage Calculation — Formula Plus a Labelled Example, No Fixed Tables

Storage formula: total storage (bytes) = sum of each camera's average bitrate (Mbps) × total recording seconds ÷ 8. Conversion reference: 1 Mbps of continuous recording for one day is about 10.8 GB. The key is to use the actual average bitrate, not the packaging's nominal bitrate; add audio channels, recorder overhead / indexing, and headroom.

Example (a stated assumption, not a typical system size): if 8 cameras each average 3 Mbps, recording 24 hours a day for 30 days, the pure video load is about 7.8 TB (excluding audio, recorder overhead and headroom). Actual use must be calculated by substituting your own system's measured average bitrate into the formula. Each camera's bitrate depends on resolution, frame rate, scene activity and encoding settings, and should be taken from the recorder's actual average bitrate — not from a fixed reference table.

Encoding: H.264, H.265 and Proprietary Extensions

H.264 (AVC) is the previous mainstream codec, with the widest compatibility. H.265 (HEVC) generally uses about half the storage of H.264 at the same picture quality (an approximation, depending on the scene). Before choosing H.265 for a new system, confirm that the recorder, players and export workflow support that codec. Individual vendors' smart codecs (for example Hikvision H.265+) claim up to 50% less storage in most scenes at the same maximum bitrate, with actual savings depending on scene activity. These codecs are vendor-proprietary extensions; a multi-brand system generally falls back to standard H.265, so do not count proprietary codec savings into capacity planning in advance.

Recording Mode: Continuous vs Motion-Triggered

Motion-triggered recording only records when there is activity, and the saving depends entirely on that position's activity — a busy entrance saves little, a rarely visited store room saves much; do not estimate with a fixed percentage. Motion detection may miss slow-moving targets or events at the edge of the detection zone; cashier and entrance positions should use continuous recording.

Drives: Surveillance-Grade; RAID Is Not Backup

Surveillance-grade drives are designed for 24/7 continuous writing (using WD Purple as an example, the workload rating reaches 180 TB/year, about three times a desktop drive's about 55 TB/year). Continuous recording should use surveillance-grade drives, with the workload rating confirmed against the vendor specification. RAID 1 (mirroring) keeps recording available when a single drive fails, and important systems may consider it. But RAID only protects against drive failure — not mistaken deletion, ransomware, fire or theft of the whole unit; key clips should be exported and kept separately. Planning must also count the capacity RAID redundancy consumes (RAID 1 mirroring leaves about half the total drive capacity usable).

Verifying Retention: Do Not Trust the Calculation Alone

After setup, once the system has run long enough, check the date of the oldest clip on site to confirm the actual retention period matches policy.

Chapter 4: NVR vs DVR vs Cloud

Two points the earlier article missed: first, DVR does not mean "maximum 1080p" — modern HD-over-coax (TVI / CVI / AHD) DVRs can also record high-definition and even 4K; new installations generally choose NVR + IP cameras, while extensions to existing coaxial wiring may keep a DVR or use a hybrid recorder. Second, cloud recording stores footage off-site, so footage survives local recorder theft / damage (depending on whether upload completed in time), but it depends on upload bandwidth and the cloud provider; during an outage it may not upload. Cloud recording is charged monthly / annually by camera count, resolution and retention days; long-term cost should be compared with the one-off cost of a local NVR + drives, with a written quotation from the supplier. Cloud upload bandwidth need = the sum of each camera's upload bitrate; calculate from each camera's actual bitrate before planning, and confirm upload bandwidth with the broadband supplier. Whether cloud recording suits a site depends on on-site upload bandwidth, fees and privacy arrangements — assess site by site, never generalise.

ONVIF: An Interoperability Framework, Not Full Compatibility

Cameras and recorders from different brands interoperate through ONVIF Profiles. Profile S covers basic video streaming, PTZ control, audio and motion-detection events; ONVIF has announced its phased withdrawal and recommends Profile T. Profile T covers advanced streaming, including H.264 / H.265, embedded analytics, tamper events and imaging settings, and is the baseline for current new projects. Profile G covers edge storage, search and playback; Profile M covers analytics metadata, object classification and event exchange. ONVIF is only an interoperability framework and does not guarantee that every feature is compatible; verify by model + firmware version on the ONVIF conformant products list, and test on site. Do not write "any ONVIF camera is guaranteed fully compatible with any recorder".

Chapter 5: PoE Power — One Cable Does It All, But Budget It

PoE (Power over Ethernet) carries data + power over the network cable, so no 220V run is needed at each camera position. For related network cabling planning, see our Office Network page.

The power a device actually receives is always lower than what the power sourcing equipment sends, the difference being line heat loss; selection must use device-end figures. Add up the device-end power of every PoE device, item by item, against the switch / NVR's total PoE budget and per-port limit; high-power devices must have their PoE grade confirmed against the datasheet, never guessed. Higher-power devices (for example some PTZ cameras, heated outdoor cameras) may need PoE+ or above, confirmed against the device datasheet. When buying PoE++, confirm whether it is Type 3 or Type 4.

Chapter 6: AI Features — Useful or Gimmick?

Human / vehicle detection: Traditional motion detection is triggered by non-target activity such as swaying leaves and changing light, producing many false alarms. Human / vehicle detection limits detection to people and vehicles, reducing false alarms from leaves, light and other non-target activity; the actual reduction depends on the scene and tuning, and should be tested on site before acceptance. Some NVRs / cameras have human / vehicle detection built in; confirm whether the required model supports it, and enable and test it for the scene.

Intrusion / line-crossing detection: Intrusion / line-crossing detection can trigger recording and push alerts on a defined zone or line, suitable for closed shops, warehouses and similar after-hours sites.

License plate recognition (LPR): License plate recognition has specific requirements on angle, pixel density, shutter and lighting: the camera should face the plate as directly as possible — the more angled or top-down the view, the more misreads; the plate must occupy enough pixels in the frame for reliable recognition; fast vehicles need a fast shutter to reduce motion blur; night-time needs infrared illumination. Use cameras and mounting designed for license plate recognition — do not assume an ordinary camera plus software will do it.

Facial recognition: Facial recognition involves highly sensitive personal data; the Privacy Commissioner for Personal Data guidance recommends disabling facial recognition unless there is a clear and justified need; if it is genuinely needed, first carry out a privacy impact assessment and state it clearly in the notice. See the next chapter.

Chapter 7: Placement Planning — Capturing Footage Is King

• Height: decide by purpose, not by a fixed figure: Cameras that must identify people should be mounted lower and facing faces more directly; coverage-only cameras may be mounted higher. Mounted too high, a camera sees only the tops of heads; mounted too low, it is easily damaged or blocked; check every feed on site before acceptance.
• Angle: Avoid pointing a camera directly at strong light or a window, or the subject becomes a silhouette; entrance cameras should capture the faces of people coming in, not their backs.
• Cashier position: The cashier position should have a dedicated camera covering the register and cash-handling process.
• Blind spots: After installation, check every feed on site to make sure no pillar or sign blocks the view.
• Collection scope: Adjust angles at installation to avoid unnecessarily capturing neighbouring shops, residential windows or other areas unrelated to the purpose.
• Common areas: Common corridors, external walls, lobbies and similar areas are building common parts; before installing, confirm the relevant requirements and procedures with the building management office / owners' corporation. This article only writes "confirm with the management office / corporation" — it does not state specific approval requirements or fees.

Chapter 8: Hong Kong Law — Privacy Compliance Checklist (Not Legal Advice)

The following is a compliance checklist compiled from the Privacy Commissioner for Personal Data's CCTV Guidance and the Personal Data (Privacy) Ordinance. It is not legal advice. If in doubt, seek independent legal advice. Do not write guarantees such as "following this means you will not break the law".

• Definition of personal data: Where CCTV footage can identify an individual, it is "personal data" under the Personal Data (Privacy) Ordinance, and all six Data Protection Principles (DPPs) apply.
• DPP1 — Collection: Personal data must be collected for a lawful purpose directly related to a function or activity of the data user; consider whether the CCTV is installed for a lawful purpose, such as security or crime prevention. The means of collection must be lawful and fair: do not collect where individuals have a reasonable expectation of privacy, such as changing rooms; covert surveillance or pinhole cameras should only be used with sufficient justification and as a last resort.
• Notice (DPP1(3)): People under surveillance should be clearly notified. Fixed CCTV should carry a conspicuous notice near the monitored area, especially where cameras are hidden or surveillance is not expected; the notice should state the data user's identity, a privacy enquiry contact, and the purpose of surveillance.
• Employee surveillance: Employee surveillance must comply with the Ordinance: employees must be notified in advance of the existence, purpose and scope of surveillance; covert surveillance should only be used with sufficient justification and as a last resort.
• Pre-installation assessment: Before installation, assess whether cameras are genuinely necessary and whether a less privacy-intrusive alternative can achieve the same purpose; where high-resolution facial detail is not needed, use lower-resolution recording; unless there is a clear and justified need, disable audio recording, facial recognition and personal tracking functions. The Privacy Commissioner encourages a privacy impact assessment before using a CCTV system.
• Audio recording: Audio is like video — if it can identify an individual, it is personal data under the Personal Data (Privacy) Ordinance and must comply with the Data Protection Principles. Privacy Commissioner guidance recommends disabling audio recording unless there is a clear and justified need; if audio is needed, state it in the notice and keep the collection scope no wider than the purpose requires. This article does not cite the Interception of Communications and Surveillance Ordinance (Cap. 589) for private CCTV audio — that Ordinance governs interception of communications / covert surveillance by public officers, and does not apply to CCTV audio in an ordinary private shop.
• Retention period (DPP2(2)): Hong Kong law sets no fixed retention period for CCTV footage. Under DPP2(2), footage must not be kept longer than is necessary for fulfilling the purpose of collection; where no security incident is found, it should be securely deleted on a regular basis. The retention period should be set by site policy for that site's purpose and enforced — do not copy another jurisdiction's rule (for example the mainland's "keep at least 30 days" rule is a mainland rule and does not apply in Hong Kong).
• Contractors (DPP2(3)): Where a third-party contractor is engaged to maintain or upgrade a CCTV system and can access footage containing personal data, use contractual or other means to prevent personal data transferred to the contractor from being kept longer than is needed for processing.
• Security (DPP4): Take all reasonably practicable steps to protect personal data held against unauthorised or accidental access, processing, erasure, loss or use. In practice: limit who can view footage, set account passwords, log access, and do not share footage casually.
• Use limitation (DPP3): Personal data may only be used for the purpose collected or a directly related purpose, unless the data subject gives express voluntary consent for a new purpose. CCTV footage must not be diverted to purposes unrelated to the original purpose.
• Openness and access (DPP5 / DPP6): Keep a written CCTV policy (purpose, retention period, who may view footage, how access requests are handled) and provide an enquiry channel; data subjects have the right to access and correct their personal data.
• Cloud storage location: Section 33 (restrictions on transfer of personal data outside Hong Kong) is still not in force; but where a data processor (including one outside Hong Kong) is engaged to process personal data, contractual or other means must still prevent the data from being kept longer than necessary and from unauthorised or accidental access, processing, erasure, loss or use. When cloud storage uses servers outside Hong Kong, understand the jurisdiction where the data is stored and ensure the data receives protection comparable to that in Hong Kong.
• Criminal law reminder: Secretly observing or recording in places with a reasonable expectation of privacy, or publishing AI-generated pornographic deepfake images, may constitute criminal offences. If in doubt, seek independent legal advice.

In One Sentence

CCTV is not about buying expensive — it is about buying right: the right camera types, the right resolution, enough storage, the right placement, plus privacy-compliant arrangements. Buy wrong and missed footage stays missed. Free on-site survey — we assess positions on site and provide a proposal for your premises; contact the company for details. For related school security solutions, see our School CCTV page.

免費上門勘查及報價 | 收費指南