The short version
A camera that records is not the same as a camera that complies
In Dubai, video surveillance is not left to the judgement of the business owner. It is regulated by SIRA, the Security Industry Regulatory Agency, a Dubai government body established in 2016 that licenses security companies, certifies the people who install and operate security systems, and publishes the technical standard every commercial CCTV system has to meet.
That distinction is where most businesses come unstuck. You can buy good cameras, mount them neatly, and still fail an inspection, because the SIRA CCTV requirements Dubai enforces cover the whole chain: who designed the system, whether the exact models are on the approved list, how long footage survives, whether the recorder reports its status back to SIRA, and whether a certificate was ever issued against the premises.
The practical trigger is usually commercial rather than criminal. A non-compliant system can hold up a trade licence renewal, a building completion certificate or a fit-out sign-off, which is why the topic tends to land on an office manager's desk with a deadline attached.
What compliance means
Seven things an inspector expects to find
Miss any one of these and the system is non-compliant, even if every camera on site is working perfectly.
- Designed and installed by a SIRA-licensed provider
- Cameras and recorders from the approved equipment list
- Coverage that identifies people at every entry and exit
- Continuous retention for your premises category
- A live VideoGuard connection back to SIRA
- A passed audit and a No Objection Certificate
- A maintenance agreement registered against the site
- Visible signage telling people recording is in progress
Which businesses in Dubai need SIRA-approved CCTV
The obligation is broader than the banks-and-jewellers reputation suggests. In practice, most premises that hold a Dubai trade licence and receive the public are expected to run a certified system, with the strictest conditions reserved for cash-heavy and high-value sites.
Shops, shopping malls, showrooms, offices and commercial towers.
Hotels, hotel apartments, restaurants, cafes and entertainment venues.
Banks, exchange houses, jewellers and gold traders, where longer retention applies.
Factories, warehouses, plants, open yards and distribution hubs.
Hospitals, clinics, pharmacies, schools and nurseries.
Apartment towers and gated communities, covering shared and common areas.
Private villas and individual apartments generally sit outside the approval regime. That is not the same as being unregulated: a camera on a private home still may not overlook a neighbour's property, a shared corridor or a public road without permission, and residents of a managed tower are covered by the building's system rather than their own.
Camera placement: coverage a reviewer can actually use
Coverage
Position is judged on evidence, not on camera count
Most failed inspections are not caused by too few cameras. They are caused by cameras that record something without capturing anything useful. If a face cannot be identified at the entrance, or a plate cannot be read at the barrier, the coverage does not do the job the rule exists for.
- Every entry and exit point, including fire exits and service doors
- Reception, lobbies, lift interiors and stairwell landings
- Tills, cash counters, safes and ATM positions
- Stock rooms, server rooms and other restricted areas
- Loading bays, delivery docks and goods-in doors
- Car parks, ramps and the external perimeter
Mounting height and angle matter as much as the plan view. A camera set too high returns the top of a head; a camera aimed straight at a glass entrance in Dubai's afternoon light returns a silhouette. This is why the process starts with a site survey covering blind spots, ceiling heights, reflective surfaces, lighting at different times of day, and the direction the sun hits the facade, and why the resulting design is submitted as drawings before anyone drills a hole. Changing the layout after the drawings are approved usually means going back for a revision.
Technical specifications, and why the numbers you read online disagree
Search this topic and you will find one guide stating a Full HD 1080p baseline, another stating 4MP, and a third stating 4K Ultra HD, all describing the same authority. They are not all wrong: SIRA maintains a technical specification and an approved-products list that are revised over time, and older guidance keeps circulating long after the underlying document has moved on. Requirements have clearly tightened, with higher-resolution cameras now routinely specified at identification points, but the binding figure is whichever version is current on the day your site is audited.
That is a practical instruction rather than a caveat. Before committing to hardware, have your licensed provider pull the current specification and the approved model list from the SIRA portal and quote against it in writing. Buying to a number quoted in an article, this one included, is how businesses end up replacing a camera fleet twelve months early.
Parameters
What the specification actually covers
- Resolution in tiers, a baseline for general coverage and a higher grade at entrances, exits and cash-handling points.
- Frame rate, with 25 frames per second the commonly specified figure so fast movement stays readable.
- Colour recording, compatible with the PAL colour standard used across the UAE.
- Low-light performance, infrared or equivalent, rated to a stated effective distance rather than a marketing claim.
- Wide dynamic range, for doorways where bright exterior light meets interior shade.
- Signal-to-noise performance, so footage stays usable rather than merely present.
- Ingress protection on outdoor housings, which in Dubai has to cope with heat, humidity, dust and coastal salt air.
- Compression and bitrate, since a move to H.265 changes the storage calculation for the same retention period.
Recording, storage and retention rules
Retention is the part auditors scrutinise most closely, because it is the part that quietly fails. The requirement is a continuous rolling archive, not an average: a week lost to a failed disk in the middle of the window is a gap, and a gap is a finding.
| Premises category | Minimum retention commonly applied |
|---|---|
| Offices, shops, restaurants, hotels, warehouses | 31 days |
| Banks, exchange houses, jewellers and gold traders | 90 days |
| Shopping malls and other high-risk categories | 90 days, per the sector schedule |
Some published guides round the standard figure to 30 days. Treat the sector schedule as authoritative and size the recorder with headroom rather than to the exact minimum, because storage consumption rises the moment you add cameras, raise resolution or increase frame rate.
Storage
What the recorder has to satisfy
- Redundant disk configuration so a single drive failure does not break the archive
- Encrypted, tamper-protected recording with restricted user accounts
- The recorder physically secured in a locked room or cabinet, not under a counter
- Accurate and synchronised time stamps across every camera
- Footage that can be exported in a readable format on request
- Capacity calculated for peak recording, not for a quiet Tuesday
Approved equipment and licensed installers
SIRA licenses the businesses that supply and install security systems, and certifies the individuals who do the work. In the agency's terminology, the company doing the installation is a security service provider, and your business, as the premises owner or tenant, is a security service user with its own facility account on the SIRA portal. Both sides of that relationship appear in the record.
A current SIRA licence for the security activity, verifiable by licence number through the official portal. A general electrician or IT contractor cannot certify the system, however competent the wiring.
Technicians and CCTV operators hold their own certification and security cadre cards. The card carries an expiry date, and lapsed cards are a routine finding during audits.
Approval is granted to specific models, not to manufacturers. A trusted brand name on the box means nothing if that particular model number is not on the current list.
The infrastructure between the cameras and the recorder is part of the deliverable too. Cable routes, power delivery, switch capacity and containment all get looked at, and a surveillance network sharing tired cabling with the office LAN tends to produce dropped frames that only show up when someone needs the footage. Where a fit-out is already in progress, it is cheaper to design the camera runs alongside the structured cabling than to pull them separately afterwards.
Privacy limits: where cameras must not point
Surveillance rules in Dubai are written with privacy as a hard boundary rather than a preference. Pointing a camera into a restricted space is not a minor deduction on an inspection sheet: it can invalidate the certificate and escalate beyond SIRA entirely.
- Entrances, exits and reception areas
- Tills, cash handling and safe rooms
- Corridors, lift lobbies and stairwell landings
- Stock rooms, server rooms and restricted zones
- Loading bays, car parks and the perimeter
- Restrooms, washrooms and changing rooms
- Prayer rooms, locker areas and staff rest rooms
- Any space where a person reasonably undresses
- A neighbour's property, interior or private garden
- Concealed lenses and audio capture without specific approval
Two further points catch employers out. Cameras are expected to be visible rather than hidden, so a discreet installation intended to catch staff behaviour is a violation in itself. And premises under surveillance must display clear signage saying so, in a position people actually see on the way in. Missing signage is one of the easiest findings for an inspector to record and one of the cheapest to fix in advance.
The SIRA approval process, step by step
-
Stage 1Appoint a licensed provider
Verify the licence number before signing anything. The provider opens or links your facility account on the SIRA portal.
-
Stage 2Design and drawings
A CAD layout showing camera positions, fields of view and equipment locations is submitted for security plan certification before installation begins.
-
Stage 3Install to the approved design
Deviations from the certified drawing are the single most common cause of re-approval, so changes on site need to go back through the portal.
-
Stage 4Register the system
Camera model numbers, IP addresses, camera-to-recorder mapping, storage capacity and the schematic are uploaded, along with the maintenance agreement.
-
Stage 5Connect to VideoGuard
An approved remote link device is configured and the camera e-map created, so the system's operating status reports back continuously and a connectivity record exists.
-
Stage 6Audit and certificate
An assigned auditor inspects the site against the standard. On a pass, the No Objection Certificate is issued. On a fail, the report lists what to correct before re-inspection.
Paperwork
Documents you will be asked for
The business supplies the commercial documents; the installer prepares the technical ones. Delays are almost always documentation rather than hardware, so gather these early.
- Trade licence copy
- Ejari or tenancy contract
- Landlord or building NOC where applicable
- Premises floor plan
- CCTV layout drawing
- Camera and recorder specification sheet
- Model numbers and quantities
- Storage capacity and retention calculation
- Installer licence details
- Technician certification records
- Signed maintenance agreement
- Audit fee payment record
Why systems fail the audit
- Coverage that does not identify. Cameras are present and recording, but faces at the entrance and plates at the barrier are not readable.
- Deviation from the approved drawings. A camera moved on site to suit the ceiling grid, without the drawing being revised.
- Unapproved equipment. A model that performs well but is not on the current approved list fails immediately, regardless of quality.
- Retention that does not hold. The recorder is configured for the right number of days but the disks cannot sustain it once every camera is recording.
- VideoGuard offline. The link was set up at handover, then broke after a router change or an internet migration and nobody noticed.
- Prohibited or concealed placement. A camera covering a rest area or a neighbouring unit, or a lens deliberately hidden from view.
- Records that do not match the site. Serial numbers, positions or quantities on the portal that no longer reflect what is on the wall.
Keeping the system compliant between audits
Certification is a snapshot of one day. Compliance is a condition you have to hold for the rest of the year, and surveillance systems fail quietly: nobody notices a dead camera or a stalled recording until an incident happens and the footage is not there. A maintenance agreement with a licensed provider is a condition of holding the certificate, with quarterly preventive visits the common cadence.
Lenses cleaned, angles re-checked against the approved drawing, recording verified end to end, retention window confirmed, firmware brought up to date and each visit logged in a signed service report.
Disk health, recording gaps, cameras dropping off the network and the VideoGuard heartbeat all watched continuously, so a fault raises an alert the same week rather than surfacing at the next audit.
Drawings, model list, certificates, cadre cards, service reports and the connectivity record kept in one place, so a renewal or a spot inspection is a retrieval exercise rather than a scramble.
Often overlooked
Your recorder is a networked computer
Once cameras moved to IP, the surveillance system became part of your IT estate. It runs firmware, holds credentials, sits on a network and is reachable from somewhere. Treating it as a security appliance that somebody else owns is how a compliant system turns into an exposure.
- Change every default credential on cameras and recorders, and remove the shared password taped inside the cabinet.
- Segment the surveillance network onto its own VLAN so a compromised camera cannot reach finance or HR systems.
- Control remote access deliberately, rather than leaving a port forwarded so the manager can check the app from home.
- Patch firmware on a schedule, since surveillance devices are a well-known target and outdated firmware also draws audit comment.
- Back up the configuration, not just the footage, so a failed recorder can be rebuilt to the certified layout quickly.
This is where surveillance overlaps with everything else on your network, and where a site-wide IT annual maintenance contract earns its place: the same discipline that keeps servers patched and monitored keeps a camera fleet inspection-ready. For companies without an internal IT team, managed IT services are usually where the monitoring and the record-keeping end up living.
SIRA compliance is not the same as data-protection compliance
The second obligation
Two frameworks, one camera
A certificate on the wall confirms the system meets the security standard. It says nothing about how you handle the footage afterwards.
Recorded video of identifiable people is personal data. Alongside the security rules, the federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, sets the baseline for how that data is collected, stored and shared, overseen by the UAE Data Office. Very few surveillance guides mention it, and it is the obligation most likely to be missed by a business that has just passed an inspection.
- Purpose and minimisation, collecting footage for security rather than for monitoring individual employees, and not repurposing it later.
- Retention discipline, keeping footage for the mandated window and having a defensible reason for holding a clip beyond it.
- Access control, with named users, individual logins and a record of who viewed or exported what.
- Analytics and facial recognition, which move you into biometric data, a sensitive category that carries a higher bar and usually calls for an impact assessment before you switch it on.
- Breach handling, with a defined process for reporting exposure of footage promptly, since notification windows are measured in hours.
- Free zone regimes, because businesses in DIFC and ADGM operate under separate data-protection laws that apply on top of the security rules.
Treating footage as regulated data rather than as a security by-product also tightens the rest of your posture, which is the same ground covered in our cybersecurity checklist for UAE SMEs.
A pre-inspection checklist you can run yourself
Before the auditor arrives
Walk the site with this list
None of this requires a technician. An office manager with an hour, a torch and access to the recorder can clear most of it, and anything that fails is worth flagging to your provider before the audit rather than after.
- Every camera on the drawing exists on the wall
- No camera has been moved, covered or knocked out of aim
- Faces are identifiable in entrance footage
- Plates are readable at the vehicle entry point
- Live view matches recorded playback on every channel
- Playback works for the oldest day in the retention window
- No blank days or gaps in the recording calendar
- Date and time stamps correct on all channels
- No camera views a restroom, prayer or changing area
- No camera overlooks a neighbouring unit
- Surveillance signage visible at every entrance
- Recorder locked away and free of dust build-up
- Disk health showing no warnings or failed drives
- VideoGuard connection reporting as active
- Maintenance visits logged and reports signed
- Certificates, cadre cards and drawings in one file
Frequently asked questions
Is SIRA CCTV approval mandatory for every business in Dubai?
It applies to most commercial premises, and it is enforced strictly for categories considered higher risk, including retail, hospitality, warehousing, healthcare, education, banks and gold traders. The practical test is usually your trade licence: if a licensing or building authority asks for evidence of a compliant surveillance system before issuing or renewing, the requirement applies to you. If you are unsure which category your activity falls into, a licensed provider can confirm it against the current schedule rather than leaving you to guess.
How long does CCTV footage have to be kept in Dubai?
Most business premises are required to hold a continuous rolling archive of at least 31 days, while high-risk categories such as banks, exchange houses, jewellers and large malls are held to 90 days. Some guides round the standard figure to 30 days, so the sector schedule is what matters for your specific site. The retention has to be genuinely continuous, which means the recorder needs enough disk capacity and redundancy to sustain the full window with every camera recording, not just under light load.
Can I buy cameras and install them myself?
Not for a commercial premises that needs certification. The system has to be designed, installed and certified by a company holding a current SIRA licence for the security activity, using technicians who hold their own certification. A self-installed or electrician-installed system will not pass audit and cannot be certified retrospectively without significant rework, which usually costs more than doing it correctly the first time.
What is VideoGuard and does my business need it?
VideoGuard is the mechanism that links a certified system back to SIRA through an approved remote link device, so the operating status of the installation is visible to the regulator. It monitors whether the system is alive and recording rather than streaming your footage for casual viewing. Where it applies to your premises category, the connectivity record forms part of the evidence needed for certification and for licence-related approvals, and a link that has silently dropped is a common audit finding.
What happens if my system fails inspection?
The auditor issues a report setting out what does not meet the standard, and no certificate is issued until the items are corrected and the site is re-inspected. The immediate cost is the rework and the delay, but the bigger exposure is commercial: without a valid certificate a business can find a trade licence renewal, a building completion certificate or a fit-out approval held up. Penalties and corrective orders also apply, and an insurer may push back on a claim if an incident occurred while the system was non-compliant.
Do I need a maintenance contract to stay compliant?
Yes. Holding a valid certificate is tied to having a maintenance agreement in place with a licensed provider, registered against the site, with preventive visits carried out and documented. Quarterly is the common cadence. The paper trail matters as much as the work itself, because signed service reports are what demonstrate the system has been maintained continuously rather than repaired once when something broke.
Do private villas and apartments need SIRA approval?
Private residences generally sit outside the approval regime, so a homeowner installing cameras on their own property is not usually going through certification. The privacy rules still apply: a camera must not overlook a neighbour's property, a shared corridor or a public road without permission, and concealed cameras are restricted. Apartment towers and gated communities are treated differently, because their shared and common areas fall to the building's system and are usually the responsibility of the owners association.
How long does the approval process take?
For a straightforward site with correct paperwork, the journey from drawings to certificate commonly runs a few weeks, covering design certification, installation, portal registration, the connectivity setup and the audit itself. Delays are rarely caused by hardware. They are caused by incomplete documents, drawings that no longer match what was installed, or equipment ordered before the approved model list was checked, all of which are avoidable by sequencing the project properly at the start.
Working out where your site stands?
If you are planning a fit-out, inheriting a system from a previous tenant, or facing a renewal with a certificate you cannot find, the useful first step is a walk-through against the checklist above and a look at the current approved equipment list.
