Home and building CCTV in the UAE: the rules

A camera bolted above a front door, or wired to the boom gate of a residential tower, does not exist in one legal space. It sits inside two systems that rarely get discussed together: a licensing and technical rulebook run by Dubai's Security Industry Regulatory Agency for buildings the agency classifies as regulated, and a general federal law on recording people without their knowledge, which applies whether or not the building is licensed at all. Mixing the two together is the most common way an owner gets this wrong.

SIRA, the Security Industry Regulatory Agency, was created by Law No. (12) of 2016 Regulating the Security Industry in the Emirate of Dubai, issued by the Ruler of Dubai on 25 September 2016. Its authority under that law covers what the legislation calls Vital Sectors, meaning "sectors and establishments that are highly exposed to risks or threats due to the type or value of the commodities in which they trade", and it names banks, money exchange establishments, gold and jewellery shops, hotels, shopping malls and hospitals. It also covers Major Compounds, which Article 2 defines as "a compound of residential or office units, including buildings, towers, and villa compounds".

Who has to comply, and with what

A single villa standing alone, with no compound around it, is not named in that definition at all. You are left to infer the boundary rather than read it off the page, and SIRA's own enforcement in practice tracks buildings, towers and compounds rather than one household's doorbell camera. Article 20 of Law No. (12) of 2016 leaves the detail to the Implementing Bylaw, and the document that actually does the work is SIRA's Standard and Technical Specifications of the Security Systems, now in its fourth version, released on 14 February 2022. That is the rulebook a licensed installer follows on any Vital Sector or Major Compound site, and it goes well past the count and placement of cameras.

The hardware standard

Every camera on a covered site has to record in colour, at a resolution of at least Full HD 1080p, whether the system is analogue or IP-based. The signal-to-noise ratio must sit at 48 decibels or above. A camera facing a light source, natural or reflected off a polished surface, needs wide dynamic range with a gain ratio of at least 110 decibels, so headlights and glare do not wash the image out. Outdoor units need housing rated IP66 or better, built for Gulf heat, humidity and dust. A camera mounted four metres up or higher needs remote zoom and focus, because nobody is climbing a ladder to refocus it after the fact. Wireless links between cameras and the recorder are barred outright unless SIRA has given prior written approval.

Recording and retention

Retention is where most confusion sits. The figure people repeat is not always the one in the standard. SIRA's rulebook sets the floor at 31 days for motion-triggered, non-continuous recording, provided that recording runs for at least 70% of each day per camera and captures no fewer than 10 frames per second. A continuous feed clears that bar without needing to be measured this way. Storage has to carry a margin of 20% above the calculated minimum, and the recorder has to keep working, and keep saving automatically, if it loses power and restarts badly.

Where the camera may not point

The standard's clearest language sits in a section it titles Prohibitions. None of the following are outright bans. Each is an approval gate, and the paperwork sits with SIRA in advance, not with an installer's judgement on the day.

• A camera installed outdoors on a roof may not have a detection range that crosses the boundary of the property it protects, unless SIRA has given prior written approval.
• Zooming a camera in on what the standard calls "places of privacy" is barred on the same terms.
• Hidden or covert cameras are barred by default: visible is the standard position, hidden only with SIRA's written consent beforehand.
• A camera with sound-capturing capability may not be installed or switched on without approval, though SIRA will grant it where clear signage at the entrance tells visitors that both audio and video are being recorded.

Recording a person, not a doorway

Everything above governs hardware and its licensing. Whether pointing that hardware at a person is lawful is a separate question, decided under general federal law rather than SIRA's building rules. Federal Decree-Law No. (34) of 2021 on Combating Rumours and Cybercrimes makes recording or photographing someone without consent, in a setting where they have a reasonable expectation of privacy, a criminal matter. That principle does not ask whether the camera sits on a SIRA-regulated tower or a garden wall with no licence attached to it at all. A building can meet every line of the technical standard and still have a camera angled in a way that falls foul of this separate law the moment it captures a person rather than a doorway.

Shared corridors, private balconies

Where the building itself is jointly owned, a second law draws the map of what counts as shared. Law No. (6) of 2019 Concerning Ownership of Jointly Owned Real Property in the Emirate of Dubai lists the halls, entrances, emergency exits, parking aisles, staircases and lifts among the Common Parts: areas designated under Article 7 for common use by every owner and occupant. Article 9 puts balconies on the other side of that line. They are named specifically as an integral part of an individual Unit, alongside bathrooms and the walls separating one home from the next. A lobby camera sits squarely inside the shared space the law expects it to cover. A camera whose field of view drifts onto a neighbour's balcony has crossed from a Common Part into somebody's Unit, which is exactly the crossing SIRA's roof-boundary rule and its privacy-zoom rule both exist to stop.

Who is allowed to look, and what it costs to get wrong

SIRA's standard requires signage as well as a working system. Warning banners approved by the agency have to sit at every main entrance and inside every lift, so that anyone entering a covered building knows recording is under way. Every time footage is copied off the system, the standard requires a record of who did the copying, where the copy went, and who received it. An establishment also has to hold an annual maintenance contract with a SIRA-registered company, running at least four visits a year, and has to notify SIRA by email the moment a fault takes the system down.

Breach the standard at a SIRA-regulated site and the exposure runs under Article 21 of Law No. (12) of 2016: a fine of not less than AED 10,000 and not more than AED 500,000, doubled if the same violation repeats within a year, capped at AED 1,000,000. That figure sits with SIRA's own licensing law. It has nothing to do with whichever fine a court sets under the separate federal law on recording a person without consent, and the two should never be quoted as if they were one number.