The compliance baseline for video surveillance in Dubai
If you operate a commercial premises in Dubai, your CCTV system is not a private matter. The Security Industry Regulatory Agency (SIRA) sets the technical, operational and privacy standards for every surveillance installation in the Emirate, covering commercial spaces, industrial sites, hotels and residential buildings alike. SIRA approves equipment, licenses installers, and enforces adherence to both technical and privacy requirements. Non-compliant footage is a liability, not an asset: if your cameras cannot identify a subject or your recordings fall short of retention requirements, you hold evidence that fails under scrutiny. Treat this briefing as your compliance checklist.
Resolution and equipment standards
SIRA has raised the benchmark for commercial spaces. The current requirement for most commercial premises is a minimum of 4K Ultra HD resolution, a standard set to ensure individuals can be easily identified even under challenging lighting conditions. Where 4K is not mandated, the floor remains colour cameras at no less than Full HD 1080p on analogue systems. Monochrome units do not qualify; all surveillance cameras must be colour.
Two further equipment rules apply. First, cameras and all associated equipment, including recorders, must appear on SIRA’s list of approved devices. Buying off that list, however attractive the price, means your system cannot be certified. Second, outdoor cameras must carry an IP66 weatherproof rating to withstand Dubai’s heat, dust and humidity. For high-security sites, systems must be approved by SIRA and connected to Dubai Police systems, which imposes additional integration and reliability obligations on your infrastructure.
Retention, monitoring and maintenance obligations
Retention is where most operators fail. Systems must retain footage for a minimum of 31 days. Licensed premises face a stricter bar: CCTV recordings of the immediately preceding ninety (90) calendar days must be available in the system at a minimum, and must be producible if the police or other competent authorities request them. Size your storage accordingly, and verify that retention settings have not been reduced during storage upgrades or equipment swaps.
Operational discipline matters as much as hardware. Licensed premises must be under CCTV monitoring at all times, and the system must meet the requirements of the police or other competent authorities of the respective Emirate. Rule 13.4.5 requires the CCTV system to be checked daily to confirm it is properly recording before opening and after closing of business hours, with the results of each check logged in a separate register. Rule 13.4.6 requires the system to be held under an Annual Maintenance Contract from a recognised service provider in the respective Emirate. A maintenance contract is not optional housekeeping; it is a standing condition of compliance.
Camera placement follows defined priorities: critical operational areas, cash counters, parking areas, corridors and staircases. Coverage plans should be mapped against these zones before installation, not improvised afterwards. At Almas Aman we audit coverage against these exact categories when designing and maintaining surveillance programmes for Dubai premises.
Privacy law overlays: PDPL and GDPR
Technical compliance with SIRA does not discharge your data-protection duties. The UAE’s Personal Data Protection Law (PDPL) governs the processing of personal data captured by your cameras. You must operate proper camera placement, clear signage informing people that surveillance is in operation, and access controls ensuring footage is available only to authorised personnel. Every one of these is a stated element of SIRA’s privacy standards as well as PDPL obligations.
If your business handles the data of EU citizens, GDPR applies alongside local law. This affects retention discipline, access logging, and your ability to demonstrate lawful processing. The practical synthesis is straightforward: signpost your cameras, restrict who can view or export footage, keep an access log, and never extend retention beyond what your documented purpose requires while remaining above the SIRA minimum. Where PDPL, GDPR and SIRA retention rules intersect, build your procedures to satisfy the strictest applicable standard.
Common failure points we see
The recurring faults are predictable. Systems specified at purchase and never upgraded fall below the 4K commercial benchmark. Storage is sized for 31 days but licensed premises overlook the 90-day obligation. Daily recording checks are performed informally, with no register, which means no evidence the checks occurred. Maintenance contracts lapse or are held with providers lacking recognition in the Emirate. Signage is absent, exposing the operator under PDPL. Cameras are positioned for general coverage rather than at the mandated critical points: cash counters, entries, corridors, staircases and parking.
Each fault is correctable, and each is discoverable in an inspection. A documented compliance file containing your equipment approvals, retention configuration, daily check register, maintenance contract and signage plan is your strongest defence. If you have not compiled one, contact our team and we will assess your current system against SIRA requirements line by line. Our services cover system design, approved equipment sourcing, installation through SIRA-licensed channels, and ongoing maintenance contracts.
Decision checklist for operators
Before you sign an installation contract or renew a maintenance agreement, confirm five things. One: every camera and recorder is on SIRA’s approved device list. Two: commercial premises meet the 4K benchmark, with colour cameras at no less than 1080p elsewhere and IP66 rating on all outdoor units. Three: retention is set to 31 days minimum, or 90 days if you hold a licence requiring it. Four: daily recording checks are logged in a dedicated register and an Annual Maintenance Contract is in force with a recognised provider. Five: signage, authorised-access controls and PDPL or GDPR procedures are documented. If any answer is uncertain, you have an exposure. Contact us for a compliance review rather than waiting for an inspection to find the gap.
Frequently asked questions
What resolution does SIRA require for CCTV in Dubai?
Most commercial spaces must operate at a minimum of 4K Ultra HD resolution so individuals can be easily identified even in challenging lighting. Where that benchmark does not apply, cameras must be colour and no less than Full HD 1080p on analogue systems. Monochrome cameras are not permitted.
How long must CCTV footage be retained in Dubai?
The general SIRA minimum is 31 days of retention. Licensed premises face a stricter requirement: recordings of the immediately preceding ninety calendar days must be available in the system at minimum, and producible to police or competent authorities on request.
Can I install any camera brand I choose?
No. Cameras and associated equipment must be on SIRA’s list of approved devices, and installers must be licensed by SIRA. Equipment outside the approved list cannot be certified regardless of specification.
Do outdoor cameras in Dubai need a weatherproof rating?
Yes. Outdoor cameras require an IP66 weatherproof rating to endure Dubai’s heat, dust and humidity. Indoor cameras are exempt from the IP66 requirement but must still meet the colour and resolution standards.
Is GDPR relevant to CCTV in Dubai?
Yes, if your business handles EU citizens’ data. GDPR applies alongside the UAE’s Personal Data Protection Law, requiring clear signage, restricted access to footage, and demonstrable lawful processing. Build procedures to the strictest applicable standard.
Must high-security sites connect CCTV to Dubai Police?
Yes. For high-security sites, CCTV systems must be SIRA-approved and connected to Dubai Police systems. This adds integration requirements that should be planned at design stage, not retrofitted later.