Face recognition CCTV cameras do more than record. The system captures a face, turns it into a digital template and compares it with a stored list of faces to identify the person. On most projects the matching happens in the network video recorder (NVR), the platform or a face terminal at the door, not in the camera. Because a face identifies a person, using this technology in Saudi facilities falls under the Personal Data Protection Law and under the Law on the Use of Security Surveillance Cameras and its Implementing Regulation.
This guide covers detection versus recognition, where each is used, and what the official texts say, with Hikvision, Dahua and ZKTeco models from AZEIDK’s security and surveillance systems.
Key takeaways
- Face detection means the camera saw a face and captured it. Face recognition means the face was compared with a face database to find out who it is.
- Many smart cameras only detect and capture faces. Matching happens in the NVR, the platform or the access control terminal.
- The Personal Data Protection Law lists “biometric data that identifies the person” as sensitive data.
- The CCTV Implementing Regulation bars anyone other than authorised bodies from analysing recording data, except analysis that does not identify people, after the Directorate’s approval.
- Face terminals at doors serve access control and attendance, and need a clear policy for collecting and keeping staff data.
In this article
- How do face recognition CCTV cameras work?
- Face detection or face recognition: what does the camera actually do?
- Where is face recognition used in buildings?
- Limits under the Saudi security surveillance cameras law
- Facial data under the Personal Data Protection Law
- How to choose a face recognition system for your facility
- Common mistakes on face recognition projects
- Frequently asked questions
- Conclusion
How do face recognition CCTV cameras work?
The process has four stages, often split across devices:
- Face detection: the algorithm finds a human face in the scene and tracks it.
- Face capture: the system picks the clearest shot of the face and stores it with the time and channel number.
- Template extraction: the software converts facial features into a digital template that can be compared.
- Face comparison: the template is compared with templates stored in a face library. If the similarity passes a threshold set by the system administrator, an action follows: unlock a door, log attendance, or raise an alert in the control room.
Raising the similarity threshold cuts false matches but rejects the right person more often. Set it during site trials, under real lighting and entry angles.
Face detection or face recognition: what does the camera actually do?
“Supports face” in a catalogue may only mean detection and capture. Take Dahua’s official page for one of the WizMind 5 series models (now discontinued). It lists face detection, tracking, best-shot capture and attributes such as age, glasses and mask, but no matching against a face library. The camera prepares the image; recognition needs another device.
That device can be the recorder. The general official datasheet for the Hikvision DS-7608NXI-K1 AcuSense NVR, which is the datasheet attached to our DS-7608NXI-K1(B) NVR page, lists facial recognition clearly: one channel of recognition from a video stream, or four channels of recognition on captured face pictures, up to 16 face libraries holding up to 20,000 pictures in total, and search by face picture in recordings. Before approval, confirm on the datasheet of the (B) version being supplied that it carries the same face functions. For human and vehicle analytics in WizSense and WizMind cameras, see our article on AI CCTV cameras.
| Device | What it does with a face | Example from the AZEIDK range | Typical use |
|---|---|---|---|
| Smart camera with face detection | Detects, captures and extracts attributes, no matching | A former Dahua WizMind 5 model, per Dahua’s official page | Faster search through recordings |
| NVR with face recognition | Matches against face libraries and raises alerts | Hikvision DS-7608NXI-K1 (general datasheet): up to 16 libraries and 20,000 pictures | Search by picture and alerts, within the legal limits |
| Face terminal for access and attendance | Verifies an enrolled person standing at the device | Hikvision DS-K1T321MFWX: up to 500 faces; ZKTeco FaceDepot-7B: up to 10,000 templates | Door access and time attendance |
| Face recognition intercom door station | Opens the entrance for enrolled residents with liveness detection | Dahua VTO9541D-S3: up to 100,000 faces | Apartment buildings and compounds |
Where is face recognition used in buildings?
Access control at doors and gates
The person stands at the device and is compared with enrolled staff. The ZKTeco FaceDepot-7B is an indoor example with a 7-inch touch screen. It stores up to 10,000 face templates, recognises faces at roughly 0.3 to 3 m, and connects to locks, door sensors, exit buttons and external readers over RS485 and Wiegand.
Time attendance
The Hikvision DS-K1T321MFWX Value Series terminal combines face, fingerprint, M1 card and PIN, with 500 faces, 3,000 fingerprints, 150,000 events and recognition under 0.2 s per user according to its datasheet. It also lists face anti-spoofing and a face duplicate check. To compare fingerprint, face and card for attendance, read our guide to time attendance devices.
Residential entrances
The Dahua VTO9541D-S3 door station is both an intercom and an entry point: a 10.1-inch touch screen, a 2 MP dual-lens camera, verification by face, fingerprint, card or password with liveness detection, and capacity for 100,000 faces.
General surveillance cameras
Picking out specific people among passers-by on surveillance cameras is the most sensitive use, and explicit texts govern it.
Limits under the Saudi security surveillance cameras law
The Law on the Use of Security Surveillance Cameras was issued by Royal Decree No. M/34 dated 7/3/1444 AH, and its Implementing Regulation was published in Umm Al-Qura on 20/11/1444 AH (9 June 2023). Neither names face recognition, but several articles govern it:
- Analysing recordings: Article 10 of the Regulation says that bodies other than authorised ones may not process recordings or analyse their data. It exempts processing and analysis that does not identify or disclose people’s identities, after the Directorate’s approval. So face matching on a covered facility’s cameras is not the owner’s decision alone.
- Security analysis bodies: Article 7 of the Law gives the Ministry of Interior and the Presidency of State Security, as applicable, the right to view live feeds and recordings and to process and analyse their data when needed for security reasons.
- Prohibited places: Article 6 bans cameras inside medical examination, inpatient, physiotherapy and changing rooms, toilets, women’s salons and clubs, and residential units in tourist accommodation, among other places set by the Regulation.
- Transferring and publishing recordings: the same article bans transferring or publishing recordings except with the approval of the Ministry or the Presidency of State Security, a court order, or a request from the competent investigating authority. This covers face captures exported from the NVR.
- Fines: Article 12 sets a fine of SAR 10,000 for each breach of the prohibited-places rule and SAR 20,000 for anyone who transfers or publishes recordings.
The Regulation’s requirement to cover entrances and reception desks “within identification viewing range” means an image clear enough to recognise a person on review, not automated matching. See also our article on the Saudi security surveillance cameras law.
Facial data under the Personal Data Protection Law
The Personal Data Protection Law (PDPL) was approved by Royal Decree No. M/19 dated 9/2/1443 AH. It came into force on 14 September 2023, with a one-year compliance period that ended on 14 September 2024, according to the guide published by the Saudi Data and AI Authority (SDAIA). Following the amendments published in Umm Al-Qura in 1444 AH, sensitive data now includes “biometric data that identifies the person”. Face templates and NVR face libraries fall within it.
Per the SDAIA guide:
- If a facility relies on consent to process sensitive data, the consent must be explicit.
- Legitimate interest cannot be used as a lawful basis for sensitive data.
- Photos and videos of a person are personal data in themselves, even without automated recognition.
Article 35, as amended, sets imprisonment of up to two years and a fine of up to SAR 3 million, or either, for anyone who discloses or publishes sensitive data in breach of the law with intent to harm the data subject or for personal gain.
This is a technical summary, not legal advice. Consult your legal adviser or data protection officer, and obtain the Directorate’s approval where required.
How to choose a face recognition system for your facility
- Start with the purpose: door access for enrolled staff, attendance, or faster search in recordings. The purpose decides the device and the legal frame.
- Read the datasheet for the full model code: face features differ between models in the same series, and one version’s datasheet may omit a feature found in a close model.
- Check capacity: number of faces and libraries, and how many channels support matching, as in the table above.
- Ask for anti-spoofing and liveness detection on door devices, so a printed photo or phone screen cannot open the door.
- Protect templates: limited user rights, firmware updates and a separate device network.
- Document the decision: a written policy on whose data is collected, why and when it is deleted, and an alternative for people who do not want to enrol their face where one is needed.
Common mistakes on face recognition projects
- Buying “AI cameras” on the assumption that they identify people, then finding they only detect faces.
- Running a face library and match alerts on the facility’s cameras without reviewing Article 10 of the Regulation.
- Enrolling staff faces in the attendance device with no written notice or clear lawful basis.
- Mounting a face terminal where a glass door behind the user creates strong backlight, which drives up rejections.
- Exporting face captures and sharing them in messaging groups, which is a transfer of recordings the law prohibits.
- Leaving templates of former employees in the devices after they leave.
Frequently asked questions
Are face recognition cameras allowed in Saudi Arabia?
No text bans the technology itself. But analysing surveillance recordings to identify people is limited to authorised bodies under Article 10 of the Regulation, and facial data is sensitive data under the PDPL.
What is the difference between face detection and face recognition?
Face detection captures a face image without knowing who it is. Face recognition compares the image with an enrolled face library to identify the person.
Is a face attendance device covered by the Personal Data Protection Law?
Yes. Face templates are biometric data that identify a person, which makes them sensitive data. Collecting them needs a lawful basis, and if that basis is consent, it must be explicit.
Do I need a special camera or a special NVR for face recognition?
It depends on the model. In many systems the camera captures the face and an NVR that supports face libraries, such as the Hikvision DS-7608NXI-K1 according to its general datasheet, does the matching.
Can a printed photo open a face terminal?
Devices with anti-spoofing or liveness detection are designed to reject photos and screens, for example the Hikvision DS-K1T321MFWX and Dahua VTO9541D-S3 according to their datasheets and product pages. Check this feature before approval.
What is the fine for publishing CCTV recordings?
Article 12 of the Law on the Use of Security Surveillance Cameras sets a fine of SAR 20,000 for anyone who transfers or publishes recordings without the required approvals.
Conclusion
A face recognition system is a camera that captures, a device that matches, and a managed face library. At doors and for attendance, use is limited to enrolled people. Face matching on surveillance recordings is restricted by the Implementing Regulation. Either way, face templates are sensitive data that need a lawful basis, protection and a deletion policy.
Planning face-based access control or a surveillance upgrade? Send us your doors, user count and entrance layout, and we will recommend devices with their datasheets. Talk to the AZEIDK team
