Yes. Under UAE CCTV privacy law, a business may record staff and customers for security, and the 2026 National Manual for Surveillance Systems sets mandatory camera coverage for 33 categories of premises. The limits: visible, signed cameras; no view into private places or past the site boundary without approval; footage released only on an official letter; nothing posted online.
This guide is for facilities and HR managers and summarises the public texts as they stood in October 2026. It is not legal advice: for a specific site, dispute or footage request, ask a UAE-qualified lawyer and the authority that regulates your premises. For cameras, recorders and approvals, see our guide to CCTV systems for UAE businesses.
Which UAE laws apply to CCTV and privacy?
Three federal laws and a national manual, plus Dubai's manual and the free zones' own data protection laws. The laws define the crimes and the data duties; the manuals say how a camera system is built and run.
| Instrument | Provision that matters for CCTV | Penalty or consequence |
|---|---|---|
| Crimes and Penalties Law, Federal Decree-Law No. 31 of 2021 (it repealed the 1987 Penal Code) | Art. 431: recording conversations, or taking or transmitting a photo of a person, in a private place, outside the cases the law permits or without consent; publishing private-life news or photos, even if true | Incarceration and a fine; devices confiscated, recordings erased |
| Countering Rumours and Cybercrimes, Federal Decree-Law No. 34 of 2021 | Art. 44: using a network or IT device to invade privacy without consent, by recording or disclosing audio or visual material; taking photos of others in any public or private place, or copying or keeping them; publishing to harm a person, even if true | At least 6 months' imprisonment and/or AED 150,000 to 500,000; editing a clip to defame: at least 1 year and/or AED 250,000 to 500,000 |
| Personal Data Protection Law (PDPL), Federal Decree-Law No. 45 of 2021 | Voice and image are named as identifiers of personal data: consent or a listed exception (Art. 4), a stated purpose and limited keeping (Art. 5), information before processing (Art. 13) | Administrative penalties, which a Cabinet decision is to specify (Art. 26) |
| National Manual for Surveillance Systems, Version 3.0 (2026) | Limits on views, hidden cameras and audio; signs; extraction only on an official letter; retention of 30, 90 or 180 days | Applies to the categories of premises it lists, which the concerned authorities may extend |
| SIRA Preventive Systems Manual (2025), Dubai | Hidden cameras, pan and zoom in private areas, and roof cameras looking past the boundary need SIRA approval; signs; a log of every copy | Approved by Administrative Resolution No. 13 of 2025 under Dubai Law No. 12 of 2016 |
| DIFC Data Protection Law No. 5 of 2020; ADGM Data Protection Regulations 2021 | Their own regimes: the PDPL does not apply to free zone companies with their own data protection law (PDPL Art. 2) | Set by each zone's law and its data protection commissioner |
Is it legal to record employees on CCTV in the UAE?
Yes, for security and under the rules that protect everyone else. The National Manual makes staff areas part of the mandatory coverage (main kitchens, dining areas, staff lounges and canteens, at the recognition level) and allows optional coverage of open-plan staff offices, store rooms and locker rooms. What it forbids is concealment: "The installation or use of hidden cameras is strictly prohibited."
Where the PDPL applies, it matters too: its definition of personal data names a person's voice and image among the identifiers. Processing needs consent unless an Article 4 exception applies, and two of them may fit this situation: specific obligations that other UAE laws place on the controller, and obligations and rights in the field of employment. Which one applies to a given camera is for your legal adviser. Either way, Article 13 requires the employer to tell people, before processing starts, why their data is processed, who it is shared with, and how it is protected if it leaves the country.
In practice: a written CCTV notice stating the areas, purpose, viewers, retention and how requests are handled. Article 5 bars later processing that is incompatible with the original purpose, so a security camera is not automatically a performance tool.
Where can CCTV cameras point?
At the areas the manual lists inside your premises, and not into private places or past your boundary without approval. The manual's restrictions (Section 2, clause 6):
- A view that exceeds the entity's boundaries, or exposes private or restricted areas, needs the concerned authorities' prior approval.
- Cameras must not have zoom features, and the cameras or the recorder must support privacy masking to hide unwanted coverage.
- Hidden cameras are prohibited; wireless cameras need prior approval.
- PTZ (pan, tilt, zoom) cameras need prior approval, outside listed exceptions such as audience seating in football stadiums.
- Audio recording needs prior approval, and then a sign saying the cameras record audio and video.
The criminal law draws the outer line. Article 431 punishes photographing a person, or recording conversations, in a private place, outside the cases the law permits or without the person's consent. The article does not list private places, so keep washrooms, changing areas and neighbours' windows and gardens out of view. Abu Dhabi Police and the Monitoring and Control Centre give the same advice for home cameras: avoid private places and respect the surrounding homes.
| Area | What the National Manual says | Design response |
|---|---|---|
| Washrooms | Covers "entrances of public toilets from the outside" | Corridor camera on the door, nothing beyond it |
| Locker and changing rooms | Locker rooms optional (mandatory at places of public transport); views exposing private areas need approval | Door from the corridor; no view where people change; masks, legal advice and approval before any camera inside |
| Neighbouring homes | A view past the boundary needs prior approval | Aim along the fence line, mask the rest |
| Open-plan offices | Optional coverage area | Only if the risk justifies it, stated in the notice |
| Audio | Prior approval, then a sign | Microphones disabled |
Dubai's rules on hidden cameras and views past the boundary are in Part Two, Chapter Eight of SIRA's manual; see our article on SIRA CCTV requirements in Dubai.
Do you need CCTV signs?
Yes, on any site the National Manual covers. Signs announce the cameras in Arabic, English and Urdu (more languages may be added), carry visual symbols, and must be visible, well lit, legible, weatherproof and maintained (Section 2, clause 7). Cameras in areas beyond the manual's listed coverage need signs too, subject to the authority's approval. In Dubai, SIRA requires its approved warning signs at all main entrances and inside lifts.
Who can see CCTV footage, and how can it be shared?
Only the system's operators use it, and footage leaves it only on an official letter from the competent authorities (judicial, police and security) or the concerned authorities that regulate CCTV. The manual (Section 2, clauses 2 to 4) adds:
- Recordings, images, plate data and backups are restricted to authorised users, encrypted at rest in central and cloud storage.
- Every operator has a personal account, and each role gets the minimum permissions, such as live view, playback, export or deletion.
- A record of everyone who accessed or extracted footage on written authorisation: names, place of work, reason, date and time.
- Transfers only on an encrypted drive, after approval; every system keeps a tamper-proof audit log.
- Group B sites (such as hotels, malls, banks and museums) log every export, download and deletion, and protect exported files with encryption, watermarking or hashing.
So an employee who wants footage of an incident goes to the police, who can request it. Under PDPL Article 13, a person can ask the controller, free of charge, what data about them is processed and why; the controller may refuse where the request conflicts with judicial procedures or investigations, or would affect other people's personal data.
Never post footage. Abu Dhabi Police and MCC ask the public not to publish any surveillance clip or image, by any means. Under Article 58 of the cybercrime law, a company's actual manager faces the same penalties if they knew of an offence and their failure in their duties contributed to it; the company is jointly liable for fines when an employee acted in its name and for its benefit.
How long can CCTV footage be kept?
As long as the site's category requires. The National Manual sets 30, 90 or 180 days by category, and the concerned authorities may set the period for a category, with 30 days as the minimum. The recorder overwrites anything older, oldest first. Deleting video or images needs the concerned authorities' prior approval, so on a covered site footage is not cut short by hand.
| Retention (days) | Examples from the 2026 National Manual |
|---|---|
| 30 | Government authorities, cinemas, healthcare entities, parking buildings, holiday homes |
| 90 | Educational entities, residential compounds and commercial buildings, labour accommodation, museums |
| 180 | Hotels, shopping malls, banks, data storage and video recording centres |
The PDPL says personal data must not be kept once its purpose is exhausted (Article 5). The weak point is the copy: a clip exported for an incident leaves the recorder's loop and never overwrites itself. Give every export a case reference and an owner, and agree with the requesting authority what happens to it when the case closes. A person cannot insist on erasure where it would affect an investigation or the claiming and defending of rights (Article 15).
What does the PDPL change for CCTV?
It turns a security system into a personal data system with written rules. The law has applied since 2 January 2022; four articles matter most for cameras:
| PDPL article | What it requires | What it means for CCTV |
|---|---|---|
| Art. 4 | Consent, or a listed exception | Record the basis for each camera purpose |
| Art. 5 | A specific purpose, minimum data, security, nothing kept after the purpose | Views limited to the purpose; retention set by category |
| Art. 13 | Before processing: purposes, sharing, safeguards for transfers abroad | A CCTV notice for staff and visitors |
| Art. 21 | An impact assessment before high-risk technologies; required for large volumes of sensitive data | Assess before face recognition: the law gives facial images as an example of biometric data, which it counts as sensitive |
The PDPL does not apply to government entities that control or process personal data, to data held by security and judicial authorities, or to free zone companies with their own data protection law (Article 2). Its executive regulations were due within six months (Article 28), and controllers then have six months to comply, which the Cabinet may extend (Article 29). At the time of writing the federal legislation portal lists none, so check the UAE Government portal's data protection page and the UAE Data Office before relying on a date. For analytics, see our article on AI video analytics for CCTV.
CCTV in the DIFC and ADGM
DIFC companies follow the DIFC Data Protection Law No. 5 of 2020 (consolidated July 2025); ADGM companies follow the ADGM Data Protection Regulations 2021. ADGM's Commissioner of Data Protection considers a data protection impact assessment necessary before systematically monitoring a publicly accessible place on a large scale, or collecting employees' biometric data to identify them, for example for building entry.
How UBM handles it
UBM designs and installs IP CCTV as part of its security and network work, and sets the privacy limits in the coverage plan before anything is ordered. Each camera's field of view is drawn on the site plan: washroom entrances covered from the corridor, masks wherever a view reaches past the boundary, audio off. Operators get named accounts with the minimum rights, export rights stay with a small group, and recorders overwrite at the category's retention period. When a recorder is retired, it is wiped before it leaves the site, with footage kept or destroyed to the policy.
At handover, the facilities team receives the camera schedule, mask settings and account list, ready for its CCTV notice and extraction log; legal questions stay with your lawyer. See our CCTV and physical security work, or talk to a UBM engineer about your site.
Questions people ask
Is it legal to have CCTV in an office in the UAE?
Yes, for security, with visible cameras, signs in Arabic, English and Urdu, no views into private areas or past the boundary without approval, and footage released only on an official letter.
Can my employer watch me at my desk on CCTV?
The manual lists open-plan staff offices as an optional coverage area, so a visible, signed camera can be there. The National Manual prohibits hidden cameras (in Dubai, SIRA's manual allows them only with SIRA approval), only the system's operators may use it, and where the PDPL applies, staff must be told the purpose before processing starts.
Can I post CCTV footage of a theft or accident on social media?
No. Give it to the police. Abu Dhabi Police and MCC ask the public not to publish any surveillance clip or image, and Article 44 of the cybercrime law punishes publishing images to harm a person, or photos of accident victims without the consent of those concerned.
Can CCTV record audio in the UAE?
On a site the National Manual covers, not without the concerned authorities' prior approval, and then a sign must say the cameras record audio and video. Recording conversations in a private place without consent can also fall under Article 431.
Can I point a camera at my neighbour's house?
Do not. On a site the National Manual covers, a view past the boundary needs prior approval; Abu Dhabi Police ask residents to respect the privacy of surrounding homes; and photographing a person in a private place without consent is a crime under Article 431.
Sources
- Federal Decree-Law No. 31 of 2021 Promulgating the Crimes and Penalties Law, Article 431 (UAE Legislation portal, 2021, consolidated to 2026)
- Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes, Articles 44 and 58 (UAE Legislation portal, 2021, consolidated to 2024)
- Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE Legislation portal, 2021)
- National Manual for Surveillance Systems, Version 3.0, Regulations section (Monitoring and Control Centre, 2026)
- Administrative Resolution No. 13 of 2025 Approving the Preventive Systems Manual (Security Industry Regulatory Agency, Dubai, 2025)
- Abu Dhabi Police and the Monitoring and Control Centre call on the public to follow home surveillance system controls (Abu Dhabi Police, 22 November 2024, in Arabic)
- Data protection laws (UAE Government portal, 2025)
- Data Protection Law, DIFC Law No. 5 of 2020, consolidated version (DIFC, 2025)
- Guidance on the Data Protection Regulations 2021, Part 4: Data Protection Impact Assessments (ADGM Office of Data Protection, 2021)
Comments
Questions and experience from readers. A person reads every comment before it appears.
No comments yet. If something here does not match what you have seen on site, say so.