Who regulates CCTV in Dubai?
Security systems in Dubai are regulated by the Security Industry Regulatory Agency (SIRA), established under Law No. (12) of 2016. The law defines security services to include selling and installing security equipment and systems, and requires anyone providing security services in the emirate to hold a licence.
The detailed technical rules sit in SIRA’s Preventive System Manual, issued as Administrative Resolution No. (13) of 2025. It sets out camera, recording and coverage requirements for the types of premises it covers.
This guide summarises the official texts in plain English. It is not legal advice; for a specific site, confirm the current requirements with SIRA.
Which premises have formal CCTV requirements?
The law and its implementing bylaw focus on three groups:
- Vital sectors: the bylaw lists categories such as banks, hotels, shopping malls, restaurants, nightclubs, gas stations and places of worship, and SIRA can designate others.
- Major compounds: residential or office compounds, including buildings, towers and villa compounds.
- Public events, such as festivals and shows open to the public.
If your business falls into one of these groups, the CCTV system has to meet the Preventive System Manual for that premises type, including where cameras go and what each camera must be able to see.
What does the Preventive System Manual specify?
For covered premises, the manual sets minimum technical standards. Examples from the general requirements include:
- Colour cameras with at least 1080p (Full HD) resolution, and digital recording at 1080p.
- A defined set of view types (from wide monitoring to close identification), with a minimum target size on screen for each.
- A recorder backed by a UPS and spare recording capacity.
- An annual maintenance contract with a SIRA-registered company, with SIRA-licensed technicians.
Some features need SIRA approval, such as wireless connections, hidden cameras, or external cameras whose view extends beyond the property boundary.
How long must recordings be kept?
Retention depends on the premises type. The manual sets a minimum of 31 days for on-site cameras in several cases, and longer periods for some categories; for example, 75 days for ATM cameras at financial institutions.
Because periods differ by activity, check the requirement for your exact premises type and size storage for it, with some margin.
What about a private villa or apartment?
The visible requirements of the manual target the premises groups above. A standalone private home is not listed in the same way. Villa compounds and residential buildings managed as compounds are covered.
Even where formal rules do not apply, good practice still matters:
- Point cameras at your own property, not at neighbours’ homes or windows.
- Check community or building rules before fixing cameras to external walls.
- Protect access to the recorder and the app with strong passwords.
CCTV and personal data
CCTV footage can identify people, so it can count as personal data. The UAE’s federal data protection law (Federal Decree-Law No. 45 of 2021) sets general rules on processing personal data. For businesses, sensible steps include limiting who can view and export footage, keeping it only as long as needed, and displaying signage where required.
How ALPHA CCTV approaches compliance
At the start of every commercial project we ask about the activity and premises type, so the design accounts for any requirements that apply. For homes, we focus on privacy-conscious camera placement and secure access.
FAQ
Does every CCTV installer in Dubai need a SIRA licence?
Law No. 12 of 2016 requires a licence to provide security services, and its definition of security services includes installing security systems. Check that your installer can show the licence relevant to your project.
Is 31 days the retention period for everyone?
No. 31 days appears as a minimum in several parts of the manual, but some categories have different periods. Confirm the period for your premises type.