CCTV Privacy & UAE PDPL: Camera Placement Compliance — Guide

Yes. The PDPL defines personal data as any data relating to an identified or identifiable natural person. CCTV footage that captures facial features, body characteristics, clothing, gait patterns, or vehicle registration plates enables direct or indirect identification, placing it squarely within the PDPL's scope. This classification applies regardless of whether the footage is stored on a local NVR, a cloud VMS, or viewed only in real time — the act of capture itself constitutes processing.

Cameras must never cover bathrooms, ablution facilities, prayer rooms, changing rooms, or medical examination areas. Cameras in private offices occupied by a single individual should be avoided unless that person gives documented written consent and legal counsel confirms it is appropriate. Break rooms and canteens present a grey area — legal counsel should assess whether a legitimate security purpose exists. The proportionality test also extends beyond your premises: a camera whose field of view captures a neighbouring property's windows, courtyard, or rooftop terrace exceeds its lawful purpose unless privacy-masking zones digitally exclude those areas from recording.

Privacy masking is a firmware-level feature available on most contemporary IP cameras from Hikvision, Dahua, Axis, and other manufacturers. The installer defines polygon-shaped regions within the camera's field of view that are rendered as solid black blocks — these regions are excluded at the encoding stage before the video stream reaches the NVR, meaning the masked content is never recorded and cannot be recovered. Most cameras support four to eight independent masking zones. On PTZ cameras, masking coordinates must track the pan-tilt position dynamically, which requires careful configuration. While privacy masking is a strong technical control, the PDPL does not prescribe specific technologies — legal counsel should confirm that your overall configuration satisfies the proportionality standard for your specific premises.

The PDPL grants data subjects the right to access their personal data, receive a copy of it, request rectification of inaccurate data, and request erasure where retention has exceeded its lawful period. In CCTV terms, this means an individual can request confirmation of whether they were recorded at a specific time and location, and if so, obtain an exported clip of the relevant footage. Organisations need an NVR or VMS capable of time-stamped search and export to a portable format such as AVI or MP4. The response timeframe that applies must be observed (confirm the current period with qualified UAE counsel), and the exported footage must be redacted to obscure other identifiable individuals who appear in the same frames — a process that may require professional video-editing support.

The PDPL mandates that personal data must not be stored longer than necessary for its stated purpose. ADMCC retention periods for Abu Dhabi depend on the facility type — commercial premises are commonly given 30 to 90 days and critical infrastructure may need longer — so confirm your category directly with ADMCC. Your NVR should be configured with automated overwrite schedules that enforce the approved retention period without manual intervention. Storing footage indefinitely is a measurable compliance breach. Our detailed retention-periods guide examines storage calculations and ADMCC category-specific requirements.

Contact our Abu Dhabi team at +971 55 651 7843 or email [email protected] with your premises type, approximate area in square metres, and the number of entry and exit points. You may also submit a request directly at our quotation page. We conduct an on-site assessment that maps camera positions against PDPL proportionality requirements, identifies zones requiring privacy masking, specifies bilingual signage locations, and documents the proposed retention schedule — providing your legal counsel with the technical detail they need to verify compliance.