NVR, DVR or cloud CCTV recording: how to choose

What changes between DVR, NVR and cloud

A DVR takes cameras over coaxial cable and records digitally. The US trade magazine SDM names RG59 and RG6 cable and formats such as HD-TVI, HDCVI and AHD, with reach limited by cable length. An NVR takes IP streams from the network and stores them on its own drives, which can be added over time. Axis sells network systems, so it is not a neutral voice, but it writes that DVRs offer limited scalability and that networked DVRs store on proprietary equipment.

In the cloud the footage sits on a provider’s servers. Hybrid is the combination we usually propose: a local recorder plus a cloud copy of events or clips.

	DVR	NVR	Cloud	Hybrid
Camera connection	Coax	IP network	IP network and internet	IP network and internet
Where the footage sits	Recorder drives	Recorder drives	Provider’s servers	Recorder, plus a copy at the provider
Third party with access to footage	None, except maintenance	None, except maintenance	Yes, under contract	Yes, for the copy
Upload bandwidth	Remote viewing only	Remote viewing only	Full stream of every camera	Events or clips only
If the line drops	Records	Records	Does not record, unless the camera has memory	Records locally

The rows on third-party access, upload bandwidth and line failure are our own reasoning about the architecture, not a finding from a source.

Working out storage and bandwidth

Axis publishes a simple formula for H.264: bitrate divided by 8 and multiplied by 3,600 seconds gives KB per hour, then you multiply by recording hours per day and by retention days. The same article warns that its figures assume a lot of motion, and that with fewer changes in the scene they can be 20% lower.

Here is a case. These are our assumptions, not figures from a datasheet:

• 16 cameras of 2 megapixels, averaging 2 Mbit/s each;
• continuous recording, 24 hours a day;
• retention of 7 or 30 days;
• decimal units, as drives are sold.

One camera: 2 Mbit/s divided by 8 is 0.25 MB/s, so 900 MB an hour and 21.6 GB a day. Sixteen cameras make 345.6 GB a day.

Scenario	Storage
7 days, continuous	2.4 TB
30 days, continuous	10.4 TB
30 days with a 20% margin	12.4 TB
30 days, motion recording 35% of the time	3.6 TB

The margin is our choice, and Axis backs the idea: with variable bitrate the storage need is unpredictable and needs large margins. With a fixed maximum bitrate storage is predictable, but complex scenes lose information. In the same document an example with a 500 kbps average limit reaches about 4000 kbps during a short movement. Measure the 2 Mbit/s on the real site before ordering drives.

Bandwidth is what usually changes minds about the cloud. Sixteen streams of 2 Mbit/s are 32 Mbit/s of upload from the customer’s line, all day, without a break. An NVR absorbs them on the local network. A cloud-only setup asks the internet line to carry them.

For your own figures, use our CCTV storage calculator.

Retention and automatic deletion

The drive does not decide the retention period. The ICO says the purpose of the processing should determine it, and that you should not set it simply by the storage capacity of the system. Spain sets a different tone: the AEPD guide gives a maximum of one month, after which footage is deleted, unless it must be kept to prove acts against people, property or installations. Italy’s Garante asks for deletion preferably by automatic mechanisms. Our article on CCTV footage retention compares the three countries.

An NVR with a 12 TB drive that overwrites only when full keeps about 34 days of the continuous recording in our example (12,000 GB divided by 345.6 GB): more than the 30 planned, so deletion by days is needed to avoid exceeding the period chosen. If the documentation handed to the customer says three days, that is a mistake. Set deletion by days and do not leave it to the moment the space runs out.

With cloud, the rule goes through the contract. The European Data Protection Board gives the example of a municipality using a standard cloud service: it must make sure its instructions on storage periods and deletion are respected, whatever the service offers by default. Ask the provider where the period is set and how you can prove it.

Cloud recording and the UK GDPR processor

A company using a standard cloud storage service remains the controller. If the provider stores the footage only on the customer’s behalf and on its instructions, the EDPB treats it as a processor. If it uses the footage for its own purposes, its role changes.

Article 28 UK GDPR sets the frame. The controller may use only processors providing sufficient guarantees. The processor must not engage another processor without the controller’s written authorisation, and acts only on documented instructions. At the controller’s choice it deletes or returns the data when the service ends. A sub-processor does not dilute this: the first processor stays fully liable to the controller.

The ICO guidance on video surveillance says that for large volumes of footage you may consider storing data in a cloud computing system, provided it is secure. It adds that you should explore whether sharing data with a provider based abroad amounts to an international transfer. The rules changed this year: Article 44 was omitted on 5 February 2026 and Article 44A now says a transfer is allowed only if approved by regulations, made subject to appropriate safeguards, or made under a derogation. The ICO video surveillance guidance is itself under review after the Data (Use and Access) Act, so check it before citing it to a client.

Before signing, ask where the servers are, who the sub-processors are and in which countries. Our article on the DPIA for CCTV explains when the assessment has to be redone because footage leaves the site.

Spain and Italy add little on cloud. The Spanish regulator’s guide lists the minimum content of the processor contract and warns against copying the Article 28 clauses. The Italian Garante’s CCTV FAQs, as we read them, do not cover cloud or processors, so we do not claim an Italian rule beyond the GDPR.

Cybersecurity

The EDPB video guidelines ask for protection at each stage: at rest on the drive, in transit on the network, in use. The measures they list include secure channels against interception, encryption, firewalls and intrusion detection, and fault detection. They also ask for access procedures with authentication, password length and change, and a log of user actions.

For a DVR the equipment room matters most: the same guidelines say that for analogue systems physical security is the most important. An NVR adds everything that applies to a networked computer. The ICO points to manufacturer security updates and to controls where a system is connected to a network. The National Cyber Security Centre, in guidance for home users, advises changing the factory password and turning off remote viewing if it is not needed. For a professional installation we translate that as remote access only where the customer uses it, and then without open ports on the router.

The cloud adds another attack surface, the account. The ICO warns that without additional encryption files in cloud storage are not held in encrypted form, and that client-side encryption helps only if the key is not kept in the same cloud system. Our article on Wi-Fi versus PoE cameras covers the cabling side.

If the line drops or a drive fails

Article 32 UK GDPR asks for the ability to restore availability and access to personal data in a timely manner after a physical or technical incident. The EDPB lists tools to restore data availability among its measures.

The reasoning that follows is ours, not from a source. Cloud-only is weakest here. Six hours of dead line at 32 Mbit/s is 86.4 GB that never reached the provider. If the camera has no local memory, that stretch does not exist. If it has, recovering it needs more bandwidth than the normal stream. Restoring a whole archive has the same problem: 10.4 TB downloaded at 100 Mbit/s takes about 9.6 days.

The local recorder has the opposite flaw. A failed drive, a theft or a fire takes everything. So when the customer asks for cloud, we recommend an NVR that records everything and a cloud copy of events.

What EN 62676-1-1 says

We read only the BSI listing for the standard, not the text, which is paid. Part 1-1 specifies minimum requirements and recommendations for video surveillance systems. It does not include requirements for design, planning, installation, testing, operation or maintenance. Nothing in the listing distinguishes DVR, NVR and cloud. If a specification calls it up, read the full text before answering.

What to do in practice

• Measure the bitrate on site, not from the datasheet, and size drives with a margin.
• Set deletion by days and write it in the handover documents, as explained in our retention article.
• Before proposing cloud, check that the line carries the upload of every camera, day and night.
• Ask the provider for the Article 28 contract, the sub-processor list, the server countries and how data is deleted at the end of the service.
• Close remote access the customer does not use, change factory passwords and keep firmware current.
• Propose local recording with a cloud copy of events when continuity matters.
• Write in the design what happens when the line drops and when a drive fails.