Since the Law on the Use of Security Surveillance Cameras was issued in October 2022, CCTV in the Kingdom has moved from a building choice to a legal obligation for a wide range of facilities. Here is what owners and operators need to know, and how to get it right the first time.
Who must comply
The law covers ministries and public institutions, power and desalination plants, oil and petrochemical facilities, commercial complexes, residential complexes, banks and financial institutions, hospitals and clinics, schools, hotels, fuel stations, restaurants, museums, event venues and other sites designated by the Ministry of Interior. Camera systems must be installed before an activity licence is issued or renewed.
Where cameras are not allowed
Cameras must never cover medical examination and treatment rooms, inpatient rooms, physiotherapy rooms, changing rooms, restrooms, women’s salons and clubs, or guest rooms and residential units in tourist accommodation. Good design starts by mapping these areas out before a single camera is placed.
Sensitivity and the control room
Facilities are classified by sensitivity. High-sensitivity sites connect directly to operations rooms over secure networks, medium-sensitivity sites connect over open networks, and low-sensitivity sites need no direct connection. Your classification drives the network design, cybersecurity measures and budget, so confirm it early.
Recordings: keep them, protect them
- Keep recordings for the retention period set in the technical requirements, and preserve any footage linked to an incident until the investigation is closed.
- Recordings may not be copied, transferred or published without approval from the competent authority or a court order.
- Control access to recordings with user accounts, audit logs and secure storage.
Penalties
Fines range from SAR 500 per camera that does not meet the technical specifications and SAR 1,000 per camera not installed as required, up to SAR 5,000 for failing to retain recordings and SAR 20,000 for unlawfully sharing recordings or damaging equipment.
A five-step compliance checklist
- Survey every site and confirm its sensitivity class.
- Design coverage for the required areas while excluding prohibited ones.
- Size storage for the required retention period, with redundancy.
- Secure the network and, where required, the link to the operations room.
- Maintain and document: scheduled maintenance, health monitoring and access logs.
Radees designs and installs surveillance systems built to these requirements, from single buildings to networks of hundreds of sites. Explore our video surveillance solutions or talk to our team.
This article is general information, not legal advice. Always refer to the official text of the law, its implementing regulation and the Ministry of Interior’s technical requirements.