Surveillance camera rules for businesses: what owners need to know

What the surveillance camera law is about

Saudi Arabia has a dedicated law on the use of security surveillance cameras, with implementing regulations that set out the details, and the Ministry of Interior is the reference authority. The law is less about which camera you buy and more about three things: who must install cameras, how they are installed and operated, and how recordings are handled afterwards.

The rules apply to the premises, not only to the installer. If a camera later stops working or a disk fills up unnoticed, keeping the system running is still the owner’s responsibility. Compliance is a small habit, not a one-day event.

The requirements are updated from time to time, so don’t rely on a forwarded WhatsApp message. Check the official text and what the competent authority asks for when licensing your activity; our surveillance camera compliance page is a good starting point.

Do your premises have to install cameras?

The law lists categories of commercial and public premises that must install cameras, typically places with many visitors, cash or goods on site, or sensitive services. The exact list, and the positions each category must cover, is in the implementing regulations, and that is the only source to rely on.

Take a restaurant in Al Olaya, Riyadh. The owner may or may not be required to cover the entrance and the payment area, depending on how the activity is classified and what the regulations say. A warehouse in Dammam’s industrial area is different again: gates, loading bays, perimeter. Don’t assume that what your neighbour does applies to you.

Even if your activity isn’t on the list, most businesses install cameras for practical reasons: the till, a dispute with a supplier, the stockroom. The same privacy and usage rules still apply. See the needs of each business on our pages for shops and restaurants.

Where cameras go, and where they never go

Good design starts with one question: what would I need to see clearly if I needed the recording tomorrow? Usually that means entrances and exits, payment points, delivery areas, the stockroom and parking. An entrance camera should capture faces, not film the door from afar against street backlight that turns every face into a silhouette.

Some places never get a camera: toilets, changing and fitting rooms, and any place of a private nature. In a clothing shop in Jeddah, for example, the cameras cover the sales floor, the till and the entrance; the fitting rooms have no camera inside and none pointed into them. Clinics may have extra considerations for examination rooms.

Watch outdoor angles too. A shopfront camera covers the entrance and the pavement, not the windows opposite or a neighbour’s house; use privacy masking in the recorder where needed. Some premises may also need a sign telling visitors cameras are in use, which is respectful practice either way.

Recording, retention and technical specifications

The regulations may set a minimum period for keeping recordings and technical requirements such as image clarity, a time stamp or recording through power cuts. We give no figures here: find out what applies to your activity from the official source, then have the installer design around it and write it into the quote.

Technically, retention isn’t a setting you choose from a menu. It is the result of a calculation: number of cameras, resolution, frames per second, compression and recording hours. Add cameras after installation without adding disk capacity and retention quietly gets shorter. We walk through that calculation in our guide to recording retention.

Set the recorder’s clock correctly; a clear recording with the wrong date wastes everyone’s time. And a recorder without backup power stops at the first power cut, so give that its own line in the quote.

Who may view and copy recordings?

Recordings contain images of people, which are personal data. The practical rule: as few people as possible can reach them, each with their own account rather than one shared password. Usually the owner and the responsible manager are enough, and staff who only need live view don’t need export rights.

The law also governs handing recordings to the competent authorities and prohibits publishing them except as it allows. A clip showing a customer or employee doesn’t go into WhatsApp groups or onto social media, even to warn others. If an incident happens, keep the clip and hand it to the competent authority as they require.

A common mistake is leaving the installer’s password on the recorder after handover. Ask for every password to be changed to yours when you take over the system, and know who has remote access to it.

Inspections: staying compliant without the stress

The competent authorities may visit to check compliance, and a visit usually comes down to plain questions. Are the required cameras there and working? Is retention long enough? Can you play back a given day’s recording? Preparing for that is easier than it sounds.

Spend five minutes a week checking every camera shows a picture and playing back a recording from a few days ago. In a small café in Khobar, the manager can simply do this every Sunday before opening. With several branches or a large system, a maintenance contract takes this off your plate and gives you a written record of visits and repairs.

Practical steps before installing or upgrading

Opening new premises or upgrading? This order saves trouble:

• Confirm how your activity is classified and what coverage, retention and specifications the law asks of it.
• Ask a company licensed to install surveillance systems for a site visit, not just a quote over the phone.
• Have the quote state camera positions, resolution, storage capacity and expected retention, and backup power.
• At handover, change the passwords, set each user’s permissions and keep the camera layout plan.

For choosing a company see choosing a licensed installer; for camera numbers see how many cameras you need; and for what drives the cost see our cost guide.