Dubai’s 2026 CCTV law: what SIRA now demands from your business
Dubai’s 2026 CCTV regulatory framework has raised the technical floor for every commercial surveillance system in the Emirate. The Security Industry Regulatory Agency (SIRA) now mandates higher camera resolution, extended footage retention, and integration with government monitoring infrastructure. If you operate a hotel, retail premises, bank branch, warehouse, logistics centre, or entertainment venue, your existing system may already be non-compliant. This briefing sets out the requirements as they stand, the exposure created by non-compliance, and the corrective actions available to you.
Resolution and camera specifications
The 2026 baseline is 4K Ultra HD, defined as 3840 x 2160 pixels, recorded at a minimum of 25 frames per second. Cameras must carry infrared night vision for round-the-clock coverage and Wide Dynamic Range to handle Dubai’s harsh contrast conditions, from glare at glass entrances to low-light service corridors. Placement matters as much as hardware. The highest-grade cameras are expected at entrances, exits, and cash-handling points, where the operational requirement is clear identification of faces and, where relevant, licence plates.
SIRA’s tiered expectations remain in force beneath this baseline. Standard areas have historically required a minimum of Full HD, 1080p or 2MP, while high-risk zones, including ATMs, cash counters, entrances, and parking areas, are pushed toward 4MP minimum cameras, with 8MP for high-risk or facial-capture applications. Read the 2026 rules as follows: 4K is the general baseline, and nothing below it should be specified for new installations or system upgrades. Anything less risks failing inspection and requiring a second capital outlay within the same budget cycle.
We assess existing installations against these thresholds before recommending replacement, because selective upgrading of identification-critical camera positions is often more cost-effective than a full rip-and-replace. Our services page details the survey and design process.
Storage, retention, and cybersecurity obligations
Retention requirements have tightened significantly. The general commercial standard requires CCTV recordings from the immediately preceding ninety calendar days to be available in the system at a minimum, and where police or other competent authorities in the Emirate require longer retention, the licensed operator must comply. Treat 90 days as your planning floor, not a target. High-security facilities face extended retention expectations under the 2026 framework, and systems specified at 30 days of storage, the previous norm in many sectors, will not pass.
Storage must be encrypted and audited. The Dubai Electronic Security Centre’s information security and business continuity policies govern retention and handling, and where the relevant government entity is involved, recordings must be stored electronically by that entity with a maintained database of authorised users and access levels. In practical terms, this means your recorder must support encryption at rest, access logging, and defined privilege levels for operators. A network video recorder left on default credentials, with shared admin logins and no audit trail, is a cybersecurity failure regardless of how good the cameras are.
SIRA’s enhanced cybersecurity protocols also touch network design. Cameras and recorders should sit on segregated network segments, with firmware maintained and remote access controlled. Under Resolution No. 13 of 2026 and related enforcement provisions, licensed premises must be under CCTV monitoring at all times, with systems meeting the requirements of Dubai Police and other competent authorities. Cybersecurity is now part of that compliance picture, not an optional add-on.
VideoGuard integration and remote authority access
The most consequential 2026 change is structural. Most commercial buildings in Dubai must now integrate their CCTV network video recorder with VideoGuard, SIRA’s telemetry portal. This integration gives SIRA inspectors the ability to verify system compliance remotely rather than through scheduled site visits, and it gives authorities instant access to live footage during emergencies and criminal incidents. The effect is that your system’s health, uptime, and configuration are visible to the regulator continuously.
Assume inspection is constant. A camera offline for two weeks, a recorder that has silently dropped below its retention window, or a failed integration feed are all detectable without an inspector setting foot on your premises. This shifts the maintenance question from reactive to operational: verified uptime, monitored storage health, and documented response to faults are now baseline disciplines. Businesses that treat CCTV as fit-and-forget hardware will discover failures at the worst possible moment, during an audit or after an incident when footage is needed as evidence.
Coverage requirements and privacy limits
SIRA’s coverage rules are explicit about where cameras must point. At a minimum, CCTV must cover all entrances and exits, and customer service areas, including reception, service counters, and visitor seating areas. Cash-handling points, ATMs, and parking areas carry elevated expectations for resolution and identification capability. Commercial establishments such as hotels, shopping malls, banks, and entertainment venues are required to install and maintain CCTV systems, and industrial zones, including warehouses, logistics centres, and energy facilities, fall under the same compliance regime.
The law cuts both ways. Businesses must install night vision cameras and must avoid monitoring private areas. Pointing cameras into toilets, changing rooms, residential dwellings, or other private spaces creates legal exposure independent of any security benefit. Camera placement should be documented during the design phase, with a camera schedule that records each device’s position, field of view, and purpose. This documentation serves you twice: it demonstrates intent to comply with privacy limits, and it speeds up SIRA plan approval because the survey is unambiguous.
The cost of non-compliance
Non-compliance in Dubai carries consequences across several fronts. SIRA approval is a precondition for operating licensed premises, and a surveillance system that fails the resolution, retention, or VideoGuard requirements places that licence at risk. Insurance claims following theft or incident can be undermined where footage does not meet evidential standards. Beyond enforcement, there is the operational cost: a system that cannot identify a face at the entrance or produce 90 days of footage on demand has failed at its core function, whatever it cost.
The rational posture is to audit first. A structured compliance survey against the 2026 baseline, covering camera resolution, placement, storage capacity, encryption, access control, and VideoGuard connectivity, will tell you exactly where you stand and what remediation is required, before a regulator or an incident tells you instead. If your system predates 2026, contact our team to arrange an assessment.
Frequently asked questions
What camera resolution does Dubai law require for CCTV in 2026?
The 2026 baseline is 4K Ultra HD, 3840 x 2160, at a minimum of 25 frames per second. Below that, SIRA’s tiered standards push general surveillance toward 4MP minimum and high-risk or facial-capture areas such as entrances, ATMs, and cash counters toward 8MP. For new installations or upgrades, specify 4K across the estate to avoid rework.
How long must CCTV footage be stored in Dubai?
Recordings from the immediately preceding 90 calendar days must be available at a minimum, and authorities can require longer. Storage must be encrypted and audited under the Dubai Electronic Security Centre’s information security policies. Systems built to the older 30-day standard will fail current requirements.
What is VideoGuard and is it mandatory?
VideoGuard is SIRA’s telemetry portal, and most commercial buildings in Dubai must now integrate their CCTV recorder with it. The integration allows SIRA inspectors to verify compliance remotely and gives authorities instant access to footage during emergencies. Treat it as mandatory for any commercial premises falling under SIRA’s scope.
Which areas of my premises must have camera coverage?
At a minimum, all entrances and exits plus customer service areas such as reception, service counters, and visitor seating. Cash-handling points, ATMs, and parking areas require higher-specification cameras for identification. Cameras must not monitor private areas such as toilets or changing rooms.
Do all Dubai businesses need CCTV, or only certain sectors?
Hotels, shopping malls, banks, and entertainment venues are explicitly required to install and maintain CCTV systems. Industrial zones, including warehouses, logistics centres, and energy facilities, must also comply. Licensed premises specifically must be under CCTV monitoring at all times.
Can I upgrade an existing system or must I replace it entirely?
It depends on the survey findings. Where cameras meet resolution thresholds but storage or integration falls short, upgrading the recorder, storage, and network side is often sufficient. Where cameras fall below specification at identification-critical positions, targeted replacement of those units is the efficient route. A compliance audit against the 2026 baseline will establish which path applies to your premises. To arrange one, contact Almas Aman directly.