In Saudi Arabia, CCTV in a facility is no longer a technical choice the owner makes alone. The Saudi security surveillance cameras law, approved by Royal Decree No. (M/34) dated 7/3/1444H, and its Implementing Regulations published in the Umm Al-Qura official gazette, set out where cameras must be installed, who may access the equipment, how recordings are kept and to whom they may be handed over. They also link the issue or renewal of an activity licence to a certificate confirming the installation requirements are met.
This article turns the official text of the Implementing Regulations into a practical list of obligations for owners and designers. If you are planning a new system or upgrading an existing one, AZEIDK’s security and surveillance systems page sets out our supply, installation, configuration, testing and maintenance scope.
Key takeaways
- Article 2 of the Regulations lists the areas that must be covered, including entrances, reception desks and car park entrances at a range that allows identification, plus emergency exits, assembly points and fire equipment locations.
- Article 4 states that competent government bodies will not issue or renew a licence for a covered activity without a certificate of compliance with installation requirements issued by the Public Security Directorate.
- Audio recording and thermal cameras may only be enabled with Directorate approval. Privacy masking is mandatory in specific cases, including cameras whose zoom exceeds 150 metres.
- Recordings may only be handed over on a formal request from Ministry of Interior enforcement bodies or the State Security Presidency, and any fault must be reported immediately through the electronic platform.
- Technical specifications and the recording retention period are set in the Security Conditions and Requirements Document, which is the design basis for storage sizing.
In this article
- The official framework: law, regulations and conditions document
- Where cameras must be installed: Article 2
- Installation, access and fault controls: Article 3
- Privacy, audio and thermal cameras: Article 8
- Keeping and handing over recordings
- Licensing, enforcement and correction periods
- Common mistakes in applying the Saudi security surveillance cameras law
- Frequently asked questions
- Conclusion
The official framework: law, regulations and conditions document
The framework has three layers:
| Document | Reference | What it sets |
|---|---|---|
| Law on the Use of Security Surveillance Cameras | Royal Decree No. (M/34) dated 7/3/1444H | General provisions, covered categories and violations; it tasked the Ministry and relevant bodies with setting a timetable for each category |
| Implementing Regulations | Minister of Interior Decision No. (22688) dated 3/11/1444H, published 20/11/1444H | Coverage areas, installation and access controls, privacy, handover of recordings, enforcement procedures and correction periods |
| Security Conditions and Requirements Document and site sensitivity classification | Approved by the same decision, to be published on the Ministry of Interior website | Technical specifications, retention period, warning sign formats and site classification by sensitivity |
The approving decision set installation deadlines counted from the publication of the Regulations: 360 days for high-sensitivity entities and 540 days for medium- and low-sensitivity entities. It also required high- and medium-sensitivity entities to connect their systems to operations rooms within 540 days, according to the sensitivity classification. With the Regulations published on 9 June 2023, these periods have passed, so the obligation now applies to covered facilities. The Saudi Central Bank has also issued a notice confirming that entities under its supervision must comply with the law and its Regulations, and classifying financial institutions as high-sensitivity entities.
Where cameras must be installed: Article 2
Article 2 lists the areas that must be covered. For several areas it defines what the image must achieve, not just that a camera is present:
- At a range that allows identification: facility entrances, reception desks, and entrances to telecom, internal network and electrical rooms.
- At a range that allows number plate reading and identification: car park entrances and exits, and visitor drop-off and pick-up areas.
- General coverage: stores and warehouses, the main lobby and corridors on every floor, ATMs, stairs and escalators, loading and unloading areas and service areas.
- Safety and utility areas: emergency exit doors, assembly points and fire equipment locations; gas cylinder, electrical, water tank and central air-conditioning rooms or compounds and their surroundings; and fuel stations, covering pumps and tanks.
- Any further areas listed in the conditions document.
The article exempts shop owners inside enclosed malls and office buildings from installing external cameras for their shops or offices. For women’s salons and women’s clubs, Article 8 specifies a subset of the same areas.
“At a range that allows identification” means lens choice, mounting angle and lighting are part of the obligation. We explained camera layout and viewing distances in our article on CCTV coverage.
Installation, access and fault controls: Article 3
On top of the technical specifications in the conditions document, Article 3 adds clear operating obligations:
- Install equipment in secured, clean locations under continuous monitoring by the facility.
- Dedicate storage media to the camera equipment only.
- Meet National Cybersecurity Authority requirements when connecting the equipment to other networks, after Ministry approval.
- Restrict access to the equipment to authorised persons and keep a log of their entry and exit.
- Report immediately to the Public Security Directorate, through the electronic platform, anything that disrupts the equipment, and fix it as quickly as possible.
The last item makes system maintenance a legal obligation, not an option. A facility with no one responsible for following up faults is exposed to a violation even if the installation was sound.
Privacy, audio and thermal cameras: Article 8
| Item | Rule in the Regulations | Design impact |
|---|---|---|
| Audio recording | Not enabled without Directorate approval | Disable audio by default during programming and record this in the handover file |
| Thermal cameras | Not used without Directorate approval | Do not include them in the BOQ before approval is obtained |
| Privacy mask | Mandatory for pan-tilt-zoom cameras, rooftop external cameras whose view extends beyond the site, and high-specification cameras or cameras whose zoom exceeds 150 metres | Confirm the camera and recorder support the feature in the datasheet, and configure it at commissioning |
| Warning signs | At all entrances and exits in a visible position, in the two formats set in the conditions document | Include them in the supply and installation scope |
For pan-tilt-zoom cameras specifically, see our guide to selecting Dahua and Hikvision PTZ cameras, and confirm privacy mask support in each model’s datasheet before approval.
Keeping and handing over recordings
The Regulations deal with recordings from three angles:
- When a security incident is reported: the person responsible for the site is notified and signs a written undertaking to keep the recordings until the investigation ends or for the period set in the conditions document, whichever is longer (Article 6).
- Handover: recordings are only handed over on a formal request from Ministry of Interior enforcement bodies or the State Security Presidency, and requests to transfer recordings are submitted through the electronic platform with their justification (Articles 6 and 9).
- After the retention period: parties that are not authorised may not keep recordings beyond the period set in the conditions document, or process or analyse them, except for processing that does not identify or disclose individuals and only with Directorate approval (Article 10).
For the designer, the retention period in the conditions document is the starting point for storage sizing, with margin for extended retention during an investigation. The calculation by resolution, frame rate and compression is covered in our guide to NVR storage and bandwidth calculation.
Licensing, enforcement and correction periods
Article 4 states that the Directorate issues a certificate of compliance with installation requirements, and that competent government bodies will not issue or renew a licence for a covered activity without it. Plan the system as part of the licensing path.
Article 7 sets the procedure for licences to practise the activities listed in Article 5 of the law: meet the conditions document, apply to the Directorate on the designated form, attach the ID, commercial registration or articles of association depending on the entity, and sign an undertaking to comply. If your contractor carries out one of these activities, ask for proof of its licence.
When a violation is recorded, a report is drawn up and signed by the person responsible, then sent to the competent committee within ten working days at most. Article 16 sets correction periods: thirty days from the report date for some violations and twenty-four hours for two others, depending on how they are classified in Article 12 of the law.
Common mistakes in applying the Saudi security surveillance cameras law
- Token entrance coverage: a wide-angle camera sees the door but not faces, while the Regulations require a range that allows identification.
- Ignoring safety and utility areas: emergency exits, assembly points, electrical rooms, water tanks and gas areas are named explicitly in Article 2.
- Shared storage: recording to a server or storage medium used for other purposes, against the requirement for dedicated media.
- Audio left on by default: many cameras ship with an active microphone, and enabling it without Directorate approval breaches Article 8.
- No access log: no record of who entered the recorder room or viewed recordings.
- Handing over recordings on an informal request: the Regulations limit handover to formal requests from enforcement bodies.
Frequently asked questions
Is the activity licence linked to surveillance cameras?
Yes. Article 4 of the Regulations states that no licence or renewal is granted to a covered activity without a certificate of compliance with installation requirements issued by the Public Security Directorate.
How long must recordings be kept?
The Regulations refer to the period set in the Security Conditions and Requirements Document. When a security incident is reported, recordings are kept until the investigation ends or for that period, whichever is longer. Check the document on the Ministry of Interior website before sizing storage.
Is audio recording allowed?
Audio recording may not be enabled without approval from the Public Security Directorate. The same applies to thermal cameras.
When is a privacy mask required?
For pan-tilt-zoom cameras, rooftop external cameras whose view extends beyond the site, and high-specification cameras or cameras whose zoom exceeds 150 metres.
What should I do if cameras fail?
Article 3 requires immediate reporting to the Directorate through the electronic platform of anything that disrupts the equipment, and fixing it as quickly as possible.
Conclusion
The surveillance cameras law and its Implementing Regulations turn CCTV from optional security equipment into a licensing requirement: defined coverage areas with a stated image purpose, dedicated storage, restricted and logged access, privacy and audio controls, and handover of recordings through formal channels only. For the news background on the law, see our item on security and surveillance systems in Saudi Arabia. Start from the conditions document and your site’s sensitivity classification, then design the system around them.
Does your facility’s CCTV actually cover the Article 2 areas? Our team tests the system and verifies coverage, storage and access settings against the requirements of the Regulations. Talk to the AZEIDK team
