California Body Camera Law: 8 Policy Areas Agencies Should Review
California Penal Code §832.18 identifies eight best-practice areas that law enforcement agencies must consider when establishing policies and procedures for a body-worn camera system. They cover who downloads recordings, when data enters the system, retention periods, storage, vendor safeguards and agency ownership.
This article walks through those eight areas so agencies can compare the statute against the policy they currently use. These are policy-review points, not a substitute for advice from the agency’s legal counsel.
What the California body camera law says your body camera policy and procedures should cover
Penal Code 832.18(b) says law enforcement agencies, departments or entities, including local law enforcement agencies, must consider eight best practices when establishing policies and procedures for a body worn camera system. That list has been on the books since 2015.
Walk your own document against them. Each one is a question about your policy, not a lecture:
Who downloads the data. Does your policy name the person responsible for downloading recorded data, by role rather than by name? If your system does not download automatically, the statute says the officer's supervisor should take immediate physical custody of the camera and handle the download after a use of force, an officer-involved shooting, or other serious incident.
When data gets downloaded. Does it say when body worn camera recordings come off the camera, so data enters the system in a timely manner and the camera is ready for its next use?
Tampering, deletion, and copying. Does it describe the measures that prevent body worn camera data from being tampered with, deleted, or copied, and say what law enforcement officers and other staff may do with it?
Categorizing and tagging at download. Does it require recordings to be categorized and tagged at the point of download, and does it list the categories your agency actually uses?
How long data is kept. Does it state retention lengths, by data type? See the table below.
Where data is stored. Does it say where recordings live? The statute contemplates two models: an internally managed in-house server, or an online cloud database managed by a third party.
Third-party vendor safeguards. If you use a vendor for storage, does your policy point at the safeguards in that arrangement?
Agency ownership and sanctions. Does it state that the agency owns the data, bar agency personnel from accessing it for personal use, and set out sanctions for misuse?
If you answer "not sure" to several of those, plan for a full review rather than a quick edit.
Recommended body-camera footage retention periods
Penal Code 832.18(b)(5) says a policy should specifically state how long recorded data is stored. It then identifies recommended minimum periods for body worn camera footage. When reviewing retention requirements, treat these periods as best-practice recommendations under Penal Code section 832.18(b)(5), not as universal mandates.
Data type | Recommended minimum under 832.18(b)(5) |
Nonevidentiary | At least 60 days |
Evidentiary (use of force by a peace officer, officer-involved shooting, arrest or detention, complaint-related) | At least two years |
Anything that may be relevant to a criminal prosecution | Longer, in the same manner the law requires for other evidence in that case |
Records and logs of access and deletion | Retained permanently |
The statute also notes that an agency may keep nonevidentiary video footage past 60 days so it is available if a civilian complaint comes in. Those periods can run longer when evidence rules, an investigation, litigation, a pending complaint, your own retention schedule, or related obligations require it.
The last row is easy to overlook. Access and deletion logs are not footage, and they are the record that tells an auditor or a court who touched the video evidence and when.
The two items that are really vendor questions
Two of the eight, storage location and third-party vendor safeguards, are questions your policy cannot answer on its own. They depend on what your evidence system does. If you cannot describe where the data sits and what protects it, you cannot write those two sections.
Penal Code 832.18(b)(7) lists six factors that agencies using a third-party storage vendor should consider. The statute does not require every policy to list all six. Weigh each one and document what you decided:
An experienced and reputable vendor.
Contracts that govern the vendor relationship and protect the agency's data.
A built-in audit trail.
Reliable automatic backup.
Legal counsel review of chain-of-custody concerns.
Technical assistance capabilities.
That is a procurement conversation as much as a policy one. For what it is worth on our side: LensLock evidence data is hosted in Microsoft Azure Government Cloud. Storage is FBI CJIS-compliant, access is limited to screened U.S. citizens, and data is encrypted in transit and at rest. If you want to see the body camera system your policy has to describe, or how evidence is stored, logged, and accessed, both are on the site.
To be straight about it: no vendor makes your agency compliant. Your agency writes the policy. A vendor supplies the system the policy describes, and answers the questions you need answered to write those two sections honestly. That is the real test of a vendor at this stage. Ask where the data sits and who can reach it. If you cannot get a straight answer out of them now, your policy cannot state one either.
Policy language and activation compliance are separate checks
A revised document does not change field behavior by itself. While the policy is open, confirm what it requires officers to record and evaluate actual activation separately. We will address activation compliance in a separate article.
How to review your body-camera policy
Legal review, policy approval, labor requirements, training and implementation may require substantial lead time. Three steps:
Pull the current policy. Find out who last touched it and when. If the answer is "the template we adopted in 2017," plan for a real pass rather than an edit.
Have counsel review the gaps. Work through the eight areas with your city attorney or legal counsel, then route any revisions through the agency’s normal policy-approval process.
Walk the eight-item list while the document is open. Reopening a policy twice in a year is harder than doing it once properly.
Got questions about where your evidence actually lives, or what your policy has to say about it? Call us. We answer. 866-536-7562. Or talk it through with someone who has written one of these.
Frequently asked questions
What does Penal Code 832.18 say a body-worn camera policy should address?
Penal Code 832.18(b) lists eight best-practice areas to consider: who downloads data, when data is downloaded, measures preventing tampering, deletion and copying, categorizing and tagging at download, retention lengths, storage location, third-party vendor safeguards, and agency ownership of data with sanctions for misuse. Agencies writing a policy from scratch can also work from the Bureau of Justice Assistance model body-worn camera policy. Agencies can also consult NCSL's Policing Legislation Database, using the Technology or Standards filters, for more recent state legislation involving police-worn body cameras and departmental policy requirements.
Are the eight policy areas mandatory requirements?
Penal Code §832.18(b) says agencies establishing body-worn camera policies must consider the listed best practices. Several details within the list use recommended language such as “should,” so agencies should have legal counsel determine how each provision applies to their policy and other governing requirements.
Who should be responsible for downloading body-worn camera data?
The policy should designate the person responsible for downloading recorded data from the camera. If the storage system does not download automatically, the statute says the officer's supervisor should take immediate physical custody of the camera and handle the download after a use of force, an officer-involved shooting, or other serious incident.
What should agencies evaluate when using a third-party storage vendor?
Section 832.18(b)(7) lists six factors to consider, not guarantees to demand: an experienced and reputable vendor, contracts that govern the relationship and protect the agency's data, a built-in audit trail, reliable automatic backup, legal counsel review of chain-of-custody concerns, and technical assistance capabilities.
How long does California recommend retaining body-camera footage?
Section 832.18(b)(5) gives recommended minimums, not universal mandates: at least 60 days for nonevidentiary data and at least two years for specified evidentiary categories. Recordings that may be relevant to a criminal prosecution should be kept longer, as the law requires for other evidence in that case. Records and logs of access and deletion should be retained permanently.
Does the California body camera law limit public-records requests?
No. Penal Code 832.18 states that the section is not to be interpreted to limit the public's right to access recorded data under the California Public Records Act. Public disclosure remains governed by the California Public Records Act and other applicable laws, together with the agency's established review process.
Who owns body-worn camera recordings under Penal Code 832.18?
Penal Code 832.18(b)(8) says a policy should require that all recorded data from body-worn cameras is the property of the agency and is not accessed or released for any unauthorized purpose. It should also prohibit agency personnel from accessing recordings for personal use or uploading them to public and social media websites, and include sanctions for violations.
This article reflects California Penal Code §832.18 as reviewed on November 4, 2026. It provides general information, not legal advice. Run policy language past your city attorney or legal counsel before adoption.
LensLock builds body cameras, in-car video, and evidence management for law enforcement agencies, and has former chiefs and officers on staff who have written and rewritten policy documents themselves.
Comments