CCTV in the UAE sits at an awkward intersection. Security regulation requires you to record. Data protection law governs what you may then do with the recordings. The two are not in conflict, but they are administered by different bodies with different concerns, and businesses tend to satisfy the first and overlook the second entirely.
The result is a fairly common situation: a system that would pass a SIRA inspection comfortably, and would struggle to answer basic questions about who has accessed footage, on what authority, and why it is still being kept.
This covers the data protection side — written for Dubai businesses that already have compliant CCTV and want to understand the second set of obligations.
The framework, briefly
The UAE’s federal data protection framework is Federal Decree-Law No. 45 of 2021, generally referred to as the PDPL. It applies to controllers and processors handling personal data of UAE residents, including entities outside the country processing that data.
Two important scope notes:
Free zones differ. DIFC and ADGM operate their own data protection regimes, which are more detailed and have established enforcement records. If your entity sits in either, that regime applies rather than the federal PDPL — though cross-border flows between mainland and free zone still need attention. Businesses operating across both need a unified framework rather than two disconnected ones.
CCTV footage is personal data. This is the point that surprises people. Recorded images of identifiable individuals are personal data. The moment your cameras capture recognisable people — staff, customers, visitors, contractors — you are processing personal data and the framework applies.
Lawful basis: why you are recording
Every processing activity needs a lawful basis, and this should be documented rather than assumed.
For CCTV, the realistic options are:
Legal obligation. Where a specific regulation requires the surveillance — and in Dubai, SIRA requirements do exactly this for many premises. This is the cleanest basis for the core security recording, and most Dubai businesses subject to SIRA requirements will rely on it.
Legitimate interest. Where surveillance is necessary for security or safety, balanced against individuals’ rights. This covers surveillance beyond what regulation strictly mandates. It requires an actual balancing assessment, documented — not simply an assertion that you have a legitimate interest.
Consent. Generally impractical for general surveillance. You cannot meaningfully obtain freely given consent from every person entering a retail space, and consent that cannot be refused without consequence is not really consent.
The distinction that matters: your basis for regulatory-mandated security recording is not automatically your basis for everything else you might do with the footage. Analytics, footfall measurement, staff performance monitoring, and marketing insight are separate processing activities that need their own basis. A system installed under a legal obligation to record for security is not thereby authorised to run behavioural analytics for commercial purposes.
Purpose limitation: what you may use it for
Footage collected for security may be used for security. Using it for something else — monitoring staff productivity, analysing customer behaviour for merchandising, resolving unrelated HR matters — is a different purpose and needs to be addressed separately.
This is where organisations most often drift. The camera was installed to deter theft. Eighteen months later someone is reviewing footage to check whether a particular employee is taking long breaks. That is a new purpose, and it was not covered by the original basis or the original notice.
Practical implication: decide and document your purposes up front, make sure your notices reflect them, and have a policy that governs access requests for purposes outside the original scope.
Retention: the point of genuine tension
Here is where security regulation and data protection pull in different directions, and where the resolution is less obvious than it looks.
SIRA sets minimum retention periods, varying by facility type. Data protection principles favour keeping personal data no longer than necessary for the purpose.
These are compatible. Your regulatory minimum is your floor; necessity governs whether you keep footage beyond it.
The practical position for most businesses:
- Retain for the period your applicable security regulation requires
- Do not retain general footage significantly beyond that without a documented reason
- Where footage is retained beyond normal retention for a specific incident, investigation, or legal matter, document why, segregate it, and set a review date
- Ensure automatic overwrite is actually functioning, rather than assuming it
That last point catches people. A system configured for automatic overwrite that has been quietly failing, or where footage has been exported to a share drive “just in case” and never deleted, is retaining personal data indefinitely without anyone deciding to.
Where does exported footage go? This is the retention gap nobody documents. Clips pulled for an incident three years ago, sitting in a folder on someone’s desktop or an email attachment, are still personal data you are still retaining. Include exported footage in your retention policy, not just the recorder.
Access logging: the most commonly missing control
If you cannot answer “who viewed footage of the loading bay on the 14th, and why,” you have a control gap.
What a reasonable position looks like:
Individual accounts. Every person with access has their own credentials. A single shared administrator password used by the security team, the IT provider, and whoever else needed it at some point makes access unattributable — and unattributable access cannot be logged meaningfully.
Access logging enabled and retained. Most modern NVR platforms log logins, playback sessions, and exports. Confirm this is switched on, and that the logs are retained for a useful period rather than rotating out in days.
Documented authorisation. A record of who is authorised to access footage, at what level, and who approved it. Reviewed periodically — people change roles and leave, and their access frequently outlives their need for it.
Export control. Exporting footage creates a copy outside your controlled system. Who may export, under what approval, to what medium, and what happens to the copy afterwards should all be defined.
Third-party access. Your CCTV maintenance provider almost certainly has access. That relationship should be documented, their access should be individually attributable rather than a shared account, and the contract should address their data protection obligations. If they are processing personal data on your behalf, that is a controller-processor relationship with contractual implications.
Law enforcement requests. Have a defined process. Who receives the request, who authorises disclosure, what is recorded about it. Disclosure to authorities is generally appropriate and expected — but it should be logged like any other access, not handled informally by whoever happened to be on site.
Signage and notices
Individuals should know they are being recorded before they enter the monitored area. This is a transparency requirement, and it is the cheapest element on this list to get right.
Adequate signage means:
- Positioned before entry to the monitored area, not inside it. A sign visible only once you are already on camera has not given anyone a choice.
- Legible at normal viewing distance, appropriately sized and lit.
- Bilingual — Arabic and English is the practical standard in the UAE.
- Informative, not just a camera pictogram. A sign should indicate that recording is taking place, who the operator is, the purpose, and how to obtain more information or contact the responsible party.
The pictogram-only sign is extremely common and does very little as a transparency measure. It tells people cameras exist; it does not tell them who is recording, why, or how to exercise any rights.
Beyond signage, a fuller privacy notice should be available — on your website, in your visitor policy, and in employment documentation where staff are within scope. The sign points to it; the notice contains the detail.
Where signage needs particular care: areas where people have heightened privacy expectations. Cameras should not cover changing areas, prayer rooms, or sanitary facilities. Coverage of break rooms and rest areas warrants a genuine necessity justification rather than a default yes.
Employee monitoring: a higher bar
Where CCTV captures employees, additional considerations apply, and expectations around proportionality and transparency are meaningfully higher than for general premises security
The relevant questions:
- Is the monitoring proportionate to an identified purpose, or simply comprehensive because it was easy?
- Have employees been informed clearly, in employment documentation rather than only via a sign at the door?
- Is footage used for performance management, and if so was that disclosed?
- Are there areas where monitoring is excessive relative to any security rationale?
General security coverage of a workplace that also happens to include employees is one thing. Surveillance directed at monitoring employee behaviour is another, and should be recognised as such rather than treated as an incidental byproduct of the security system.
Data subject rights
Individuals have rights over their personal data, including access. Someone may request footage of themselves.
Practical handling:
- Have a defined process and a named owner
- Verify the requester’s identity before disclosing anything
- Be prepared to redact or obscure third parties visible in the same footage — disclosing footage of one person often means disclosing footage of several others, whose rights also apply
- Have a realistic response timeframe and stick to it
- Document what was requested, what was provided, and what was withheld and why
The third-party redaction point is the practically difficult one. If your system has no capability to blur or obscure other individuals, fulfilling an access request may be technically awkward. Worth knowing before the first request arrives rather than during it.
Breach handling
If CCTV footage is exposed — a compromised recorder, unauthorised access, a lost export — that is a personal data breach.
- Have an incident process that explicitly includes CCTV systems, which are frequently overlooked in incident planning because they sit outside the main IT estate
- Understand your notification obligations and timeframes
- Be aware that a prompt notification standard has become the practical expectation in the UAE
Internet-exposed recorders with default credentials remain one of the most common findings in security assessments. An NVR reachable from the internet with an unchanged factory password is a breach waiting to be discovered by someone scanning for exactly that.
A practical review checklist
- Document your lawful basis for security recording, and separately for any analytics or secondary use.
- Map your actual retention — recorder, exports, backups, and anything sitting on individual machines.
- Confirm automatic overwrite is functioning.
- Replace shared credentials with individual accounts.
- Enable and retain access logging.
- Document who is authorised to view and export, and review it.
- Review signage — position, legibility, bilingual, informative content.
- Publish a fuller privacy notice and reference it from the signage.
- Address the third-party maintenance relationship contractually.
- Check camera coverage against areas of heightened privacy expectation.
- Define a data subject request process including third-party redaction capability.
- Include CCTV in your incident response plan.
- Verify no recorder is exposed to the internet with weak or default credentials.
Most of this is documentation and configuration rather than capital expenditure. It is largely a question of having decided things deliberately rather than by default.
Reviewing your CCTV compliance position?
KNH IT is a SIRA-approved provider in Bur Dubai. We design and maintain CCTV systems across Dubai, and can review your system configuration, access controls, retention behaviour, and recorder security as part of a compliance assessment.
We are IT specialists rather than legal advisers — for the legal position specific to your business, take advice from a UAE-qualified lawyer.
Contact: Al Raffa Building, Office 07, Bur Dubai , info@knhit.com , contact us
FAQ
? Yes. Recorded images of identifiable individuals constitute personal data, which means data protection obligations apply
alongside security regulations such as SIRA requirements.
Security regulation sets minimum retention periods that must be met. Data protection principles discourage retaining personal data longer than necessary for the purpose. In practice, businesses should meet their regulatory minimum and avoid retaining general footage substantially beyond it without a documented reason.
Yes. Signage should be positioned before entry to the monitored area, legible at normal viewing distance, presented in Arabic and English, and should identify the operator and purpose rather than showing only a camera symbol. A fuller privacy notice should be available separately.
Access should be limited to individually named and authorised users with their own credentials, with access logging enabled and retained. Shared administrator accounts make access unattributable and should be replaced. Third-party maintenance access should be documented and addressed contractually.
Yes. Analytics extract characteristics and behaviours rather than simply recording images, which constitutes a separate processing activity requiring its own lawful basis, and should be reflected in your privacy notices and signage.
