A buyer's guide to CCTV in the UAE and Saudi Arabia: SIRA and MCC rules, the Saudi surveillance cameras law, IP systems and storage, Gulf heat ratings, US restrictions and the main brands.
To buy a CCTV system for a commercial site in the UAE or Saudi Arabia, start with the regulator, not the camera. In Dubai, security devices and the companies that trade, install and inspect them are licensed by SIRA; in Abu Dhabi, the Monitoring and Control Centre sets the rules; in Saudi Arabia, a 2022 law makes cameras compulsory for many facilities. Then pick CCTV and IP surveillance cameras rated for the heat, choose the recorder and storage, and only then compare brands.
This guide is for facility managers, ELV contractors, security managers and procurement teams buying surveillance for commercial and residential buildings, hotels, warehouses and plants. It covers the Dubai, Abu Dhabi and Saudi rules, IP systems and storage, Gulf enclosure ratings, cybersecurity, privacy, US restrictions on some brands, the main brands and an RFQ checklist.
The short answer: in Dubai, CCTV is a regulated security activity. Both the equipment and the people who sell, install, inspect and monitor it need a licence from the Security Industry Regulatory Agency (SIRA), and many types of premises must meet SIRA's technical requirements.
Law No. (12) of 2016 Regulating the Security Industry in the Emirate of Dubai establishes SIRA as the government entity responsible for regulating the security industry. Under Article 7, SIRA sets and updates the specifications, standards and requirements of the industry, licenses the security devices and equipment named in the implementing bylaw, and ensures that preventive systems are in place in vital sectors, major compounds and public events. Article 17 says no person may provide security services in the emirate without first obtaining a licence. Article 21 sets fines of no less than AED 10,000 and up to AED 500,000 per violation, doubled for a repeat within one year, to a maximum of AED 1,000,000.
The detail sits in the implementing bylaw, Executive Council Resolution No. (1) of 2018. The points that matter to a buyer:
Neither the 2016 law nor the 2018 bylaw states a retention period or a minimum resolution for CCTV. The figures are in SIRA's Preventive Systems Guide, approved in 2025, which requires recordings to be kept for no less than 31 days at no less than 10 frames per second, and for 75 days for cameras covering ATMs; our guide to SIRA CCTV approval covers the details. SIRA sets those technical requirements in its manuals and approvals, and they can differ by premises type. Installer websites quote figures we could not find in SIRA's published text, so we do not repeat them. Have your SIRA-licensed installer state the retention, image and coverage requirements for your premises in writing, and make them part of the contract.
SIRA's website, sira.gov.ae, has a search for licensed security companies: check that your providers of CCTV installation services, and your inspection company, appear there before you sign.
In Abu Dhabi, the authority is the Abu Dhabi Monitoring and Control Centre (MCC). The Abu Dhabi Media Office describes the MCC as part of the Supreme Council for National Security, developing the rules for monitoring and control systems used by public and private entities. An MCC official told Khaleej Times in November 2019 that there were 301,798 certified cameras installed at 7,029 entities in the emirate; the MCC issues permits and approvals for camera installation, and its officials visit facilities to recommend camera locations.
In March 2026 Abu Dhabi Police, working with the MCC, ran an awareness campaign reported by Gulf News. The advice: use licensed companies to install and maintain systems, do not post footage on social media, do not point cameras at neighbours' homes or private areas, store recordings securely, and protect and regularly change system passwords. On a commercial project, appoint an MCC-approved contractor; do not assume Dubai approvals carry over.
Other emirates have their own authorities; check locally before you award a contract.
Saudi Arabia regulates CCTV through a dedicated law. The Saudi Central Bank rulebook cites it as the law on the use of surveillance cameras, Royal Decree No. (M/34) dated 7/3/1444 H, with implementing regulations issued by the Ministry of Interior under Resolution No. (22688) dated 3/11/1444 H. The Ministry of Interior also published a document on security conditions and requirements for installing surveillance systems and general technical specifications for camera systems, as Ajel reported in June 2023.
Saudipedia's summary of the law gives the main obligations:
The penalties are per device, which adds up quickly on a large site: SAR 500 for each camera or device that does not meet the technical specifications, SAR 1,000 for each camera not installed to the specification, up to SAR 5,000 for failing to keep recordings, and up to SAR 20,000 for transferring or publishing recordings unlawfully or damaging equipment or recordings. In January 2025 the Ministry of Interior restated the ban on transferring or publishing recordings and the SAR 20,000 fine, as Arab News reported.
Banks have an extra layer: SAMA classes financial institutions as highly sensitive entities, requires cameras according to each site's sensitivity classification, and adds its own security and safety guide for the financial sector on top of the law and the Ministry's documents.
The law summary gives no fixed number of days for routine retention: take retention, camera positions and recording specifications from the Ministry's requirements document for your facility type. Suppliers of CCTV cameras in Saudi Arabia and installers should be able to show their Ministry of Interior approval.
CCTV footage of identifiable people is personal data. In the UAE, Federal Decree-Law No. 45 of 2021 on personal data protection came into force on 2 January 2022, with the UAE Data Office as the federal regulator; the DIFC has its own Data Protection Law (DIFC Law No. 5 of 2020). In Saudi Arabia, the Personal Data Protection Law issued by Royal Decree M/19 on 16 September 2021 and amended in March 2023 came into force on 14 September 2023, with the transition period ending on 14 September 2024 and SDAIA as regulator, according to Morgan Lewis.
In practice: control and log who views and exports footage, and check where any cloud service stores it, since both laws regulate transfers abroad.
For new commercial projects, IP is the default: each camera streams over the network to a network video recorder (NVR) or video management system (VMS), takes power over Ethernet and can run analytics. Analogue HD over coax still suits upgrades on sites with good existing coax.
| Option | How it works | Suits | Watch for |
|---|---|---|---|
| IP camera + NVR | Cameras stream over the LAN to a recorder with built-in disks | Shops, offices, residential compounds, small warehouses | Camera count and bitrate limits of the NVR; same-brand lock-in |
| IP camera + VMS on servers | Software on standard servers records and manages many cameras, often from mixed brands | Malls, hotels, campuses, plants, multi-site estates | Licences per camera, server and storage sizing, IT support |
| Analogue HD + DVR | Cameras send video over coax to a digital video recorder | Retrofits on existing coax | Fewer analytics, longer cable runs need checking, limited future growth |
| Cloud or hybrid | Footage or management in a hosted service, sometimes with local storage | Distributed small sites | Data location under PDPL, internet bandwidth, whether the regulator accepts it |
If you want to mix camera brands with one VMS, specify ONVIF conformance. ONVIF lists Profiles S, T and G for video systems (a camera with local storage can conform to both T and G), and Profile M for metadata and events for analytics applications. Profile Q was deprecated in April 2022, so do not write it into new specifications.
Put the structured cabling and network racks and enclosures in the same tender as the cameras, or the interfaces fall between contractors.
Resolution is only useful if it gives enough pixels on the target. Decide what each camera must do (detect a person, recognise a known person, identify a stranger, read a plate) and ask the designer to show pixel density at the required distance for each view.
The arithmetic: storage per camera = average bitrate × seconds recorded ÷ 8. A camera averaging 4 Mbit/s and recording continuously writes 4 × 86,400 ÷ 8 = 43,200 megabytes, about 43 GB a day. Over a 30-day period that is about 1.3 TB per camera, and 32 such cameras need about 41 TB before any RAID overhead.
The bitrate depends on resolution, frame rate, compression codec, scene activity and night-time noise, so take it from the manufacturer's calculator for your cameras and settings. Size for the retention period the regulator sets for your premises, add redundancy (RAID or failover recorders), and protect the recorder with a UPS.
The UAE's National Center of Meteorology recorded 51.8 °C in Sweihan, Al Ain, on 1 August 2025, as Gulf News reported. That is shade air temperature; a camera on a sun-facing wall or pole runs hotter.
The upper operating limit varies between models from the same maker. Axis, for example, rates its P3277-LVE dome for -40 °C to 50 °C and its P1387-LE box camera for -40 °C to 60 °C. Both carry IP66, IP67 and IK10 ratings. Read the operating range on every datasheet, ask for sunshields on exposed cameras, and put recorders and switches in cooled rooms or cabinets.
Two enclosure ratings matter:
On coastal sites, ask how housings and brackets resist salt, and use stainless fixings.
A networked camera is a computer on your network. Put the following into the specification, not into a later change order:
If your project has a US government link, or a client whose procurement policy follows US rules, check two restrictions before you specify Hikvision or Dahua.
First, Section 889 of the US National Defense Authorization Act for fiscal year 2019, implemented in FAR clause 52.204-25. Its definition of covered equipment includes video surveillance and telecommunications equipment produced by Hytera, Hikvision or Dahua (and their subsidiaries and affiliates) for the purpose of public safety, security of government facilities and other national security purposes. From 13 August 2019, US executive agencies may not buy such equipment as a substantial or essential component of any system; from 13 August 2020, they may not contract with an entity that uses it.
Second, the US Federal Communications Commission's Report and Order of 25 November 2022, summarised by the Congressional Research Service: the FCC stopped issuing new equipment authorisations for Hikvision and Dahua video surveillance equipment unless the companies submit an approved plan showing it will not be marketed or sold for those security purposes. The order did not revoke earlier authorisations.
These are US rules, not UAE or Saudi ones; locally, the regulator's approval is what counts.
Brands are listed alphabetically, not ranked. The right one depends on the regulator's approvals, the client's vendor list, the VMS and local support.
Avigilon describes itself as a Motorola Solutions company. Its range covers dome, bullet, PTZ and 360-degree cameras, Avigilon Unity on-premises and Avigilon Alta cloud security software, access control and analytics. Its customer stories include Deep Dive Dubai and Moro Hub.
Axis is headquartered in Lund, Sweden, was founded in 1984 and has been part of the Canon Group since 2015, according to its own company page, which also says it launched the world's first network camera in 1996. It makes network video, access control, intercom and audio products and works with third-party VMS platforms.
Bosch's security and communications product business, including its intelligent video systems, was sold to the investment firm Triton and became independent as KEENFINITY Group on 1 July 2025, according to KEENFINITY's press release. Products continue under the Bosch brand alongside Electro-Voice, Dynacord, RTS and Telex, and manufacturing sites are in Germany, Portugal, Mexico and China. Confirm the current product line and support channel with the supplier.
Dahua (Zhejiang Dahua Technology) describes itself as a video-centric AIoT solution and service provider and dates its in-house technology development to 1993, in its 30th anniversary release from Hangzhou. See the US restrictions above if your project has a US link.
Genetec is a software-first company: founded in 1997 and headquartered in Montreal, its Security Center platform unifies video surveillance, access control, licence plate recognition and communications, according to its corporate fact sheet, which lists Dubai among its experience centres. Choose it as the VMS layer when you want to run cameras from several makers on one platform.
Hanwha Vision is the former Hanwha Techwin, which changed its name on 1 March 2023 in an announcement from Seongnam, South Korea, describing itself as a video surveillance company expanding into vision solutions.
Hikvision was founded in 2001, is based in Hangzhou and has been listed on the Shenzhen Stock Exchange since 2010, according to its Wikipedia entry. It is the most searched CCTV brand name on Google in both countries, and its range covers cameras, recorders and integrated security products. See the US restrictions above for US-linked projects.
Pelco lists dome, bullet, PTZ, panoramic and specialty cameras, with capabilities including thermal, explosion-proof, extreme-weather and licence plate recognition, and its VideoXpert video management software. Its explosion-proof and heavy-duty lines are relevant to oil, gas and industrial sites.
Uniview was founded in 2011, according to its company profile, which lists network, analogue, PTZ, thermal and explosion-proof cameras, recorders, storage, VMS, access control and intelligent traffic products.
A complete RFQ gets you comparable bids. To have licensed suppliers come to you, post a requirement on ListGCC with your camera schedule attached. For wider systems, browse security systems and services in Saudi Arabia or read our guide to sourcing suppliers in the UAE and Saudi Arabia.
Each of these guides takes one question from this page further.
Dubai regulates CCTV under Law No. 12 of 2016 and its implementing bylaw, Resolution No. 1 of 2018. SIRA licenses surveillance devices and the companies and people that trade, install, inspect and monitor them. Vital sectors such as hotels, banks, malls, restaurants and fuel stations must meet SIRA's Preventive System Manual. Sending footage to unauthorised persons needs a special licence. Fines run from AED 10,000 up to AED 500,000, doubled for repeats.
The retention period is not written in Dubai's 2016 security industry law or its 2018 bylaw. SIRA's 2025 Preventive Systems Guide sets it: at least 31 days at 10 frames per second or more, and 75 days for ATM cameras. It is a technical requirement that SIRA sets for each type of premises through its manuals and approvals. Ask your SIRA-licensed installer to confirm the period that applies to your premises in writing, size storage for it, and test retrieval of the oldest footage at handover.
The Saudi surveillance cameras law covers government bodies, power and desalination plants, oil and petrochemical facilities, commercial complexes, residential buildings, banks, mosques, healthcare facilities, schools, fuel stations and public transport, and the Ministry of Interior can add more. Cameras must be in place before an activity licence is issued or renewed. Cameras inside private residential units and complexes are excluded.
The law bans cameras in operating rooms, medical examination and inpatient rooms, physiotherapy rooms, changing rooms, toilets, women's salons and clubs, and residential units in tourist accommodation, and the implementing regulations can add more places. Publishing or transferring recordings without approval from the authorities, a court order or an investigator's request can bring a fine of up to SAR 20,000.
No brand is best for every job. Compare models on the job they must do: pixel density at the target distance, low-light performance, operating temperature, IP and IK ratings, ONVIF support and firmware support. Then check regulator approval for that model, your client's vendor list and any procurement restriction, such as US Section 889.
US restrictions on Hikvision and Dahua apply to US federal procurement and to new US FCC equipment authorisations; they are not UAE or Saudi rules. In both countries, what counts is approval of the model and the installer by the local regulator. If your client, funder or end user follows US procurement rules, Section 889 compliance may still be required,.
Featured image: Photo: Punit Rajpal, CC0, via Wikimedia Commons
Steel and composite toe caps pass the same 200 joule test. The choice comes down to heat, weight, metal detectors, electrical work, bulk, cost and cap quality. A buyer's comparison for UAE and Saudi sites.
The Saudi surveillance cameras law in practice: which spots must be covered, sensitivity classes and deadlines, the Public Security certificate, privacy masks, audio and thermal limits, recordings and fines.
Ladies' safety shoes carry the same EN ISO 20345 ratings as men's. What a women's last changes, how to size and trial, which class suits healthcare, labs, logistics and sites, and what employers must provide.
