Bottom line: a privacy mask at the camera, an operator permission in the VMS, and redaction applied to an exported clip solve different problems. A design should identify when information must be hidden, who may reveal it, and whether an unmasked original may exist.
\nThe Axis white paper Privacy in surveillance describes privacy options that include blocking selected image areas, masking people, using non-visual technologies, and applying controls across capture, recording, viewing, and export. It distinguishes static masking, dynamic masking, access controls, and redaction rather than presenting privacy as one camera setting.
\nThat lifecycle view matters. A permanent source mask can prevent sensitive pixels from entering a stream. A dynamic mask may permit an authorized role to reveal information. VMS permissions can restrict who sees a camera or recording. Export redaction creates a disclosure copy while leaving the evidentiary original subject to separate controls.
\nThe paper describes Axis approaches and does not establish legal compliance, authorize recording, or prove that a particular third-party VMS preserves a mask. Privacy requirements depend on jurisdiction, purpose, notice, labor agreements, retention, public-record obligations, and the people or spaces captured. Product and version support must be verified.
\nThe following steps are DSE recommendations based on the cited source.
\nCreate a matrix with lifecycle stages as rows and each viewing or export workflow as columns. For every cell, name the allowed roles, expected masked state, location of any unmasked original, audit event, and approval required to reveal information. Prefer source masking when pixels have no legitimate operational purpose. Where an original is necessary, restrict the reveal path with least privilege, a documented reason, and reviewable logs.
\nInclude every stream and derivative, not just the primary desktop client. Test live and recorded video, low- and high-resolution streams, snapshots, bookmarks, evidence packages, third-party integrations, and administrative previews. Treat any unlogged bypass or unexpectedly unmasked derivative as a design defect.
\nRetain the approved privacy matrix, screenshots of configured regions, role and permission exports, test clips from each workflow, redacted and original file hashes where applicable, reveal-event audit logs, and sign-off from privacy or legal owners. Re-test after camera replacement, firmware or VMS upgrades, layout changes, or integration changes.
\n