Privacy and Responsible CCTV Use in the Workplace

CCTV protects people and property. It also records employees, visitors and customers. Using it responsibly builds trust and helps you stay within the law. This guide sets out simple good practice for facility managers. It also lists the Saudi rules that apply to covered facilities.

Start with a clear purpose

Write down why you use cameras. For most sites, the purpose is security and safety. That means preventing theft, protecting staff and investigating incidents.

A clear purpose helps you decide three things: where cameras go, who may watch, and how long video is kept. Do not start using footage for a different purpose without a clear decision from management.

Point cameras only where they are needed

• Cover entrances, exits, cash points, stores, car parks and other risk areas.
• Do not film more than you need. A camera for a gate should not look into a neighbour's windows.
• Avoid filming more of the public street than your purpose needs.
• Check camera views after building changes. A moved shelf can turn a store camera into an office camera.

Places where cameras are banned in Saudi Arabia

For facilities covered by the law, Article 6 bans cameras inside these places:

• Medical examination rooms, in-patient rooms and physiotherapy rooms.
• Changing rooms and toilets.
• Women's salons and clubs.
• Residential units in tourist accommodation.
• Medical operation rooms and private places, for the categories the Implementing Regulations set.

The Implementing Regulations can add other places. Check them before you add a camera in any sensitive area.

Put up visible signs

Article 6 also requires visible signs in covered places. The signs show that cameras are in use. The Implementing Regulations set their details, number and position. Good practice everywhere is a sign at each entrance, so people know before they walk in.

Limit who sees footage

• Only trained, authorised people should watch live video or recordings.
• Review recordings for a reason, such as an incident or a complaint. Never review them out of curiosity.
• Record every review and every copy in the footage access register.
• In Saudi Arabia, recordings may not be transferred or published without the approval of the Ministry of Interior or the Presidency of State Security, a court order, or a request from the competent investigating authority (Article 6).

Keep footage only as long as needed

Covered facilities in Saudi Arabia must keep recordings for the period set in the Ministry of Interior's requirements document (Article 4). The law itself does not state a number of days. Check the requirements document for your type of facility.

Keep at least that long. Beyond it, good practice is not to keep video longer than your purpose needs. See storage and retention.

Be open with staff

These points are good practice, not rules quoted from the law:

• Tell staff in writing why cameras are used and which areas they cover.
• Explain who may view footage and how long it is kept.
• Give staff a named contact for questions or complaints about cameras.
• Train every operator on these rules before they start.

Never share footage casually

Never post clips on social media or in messaging groups. Never show footage to people who have no reason to see it. A clip shared once can never be taken back. If someone asks for a copy, follow handing over footage safely.

Where these rules come from

The Saudi points above come from the Law on the Use of Security Surveillance Cameras, as published in the Umm Al-Qura gazette. Its Implementing Regulations were approved by Minister of Interior Decision No. 22688. A plain summary is on Saudipedia and on the SSMS Saudi Arabia page.

This guide is orientation only, not legal advice. Your obligations come from the law, its Implementing Regulations and the Ministry's requirements document. Outside Saudi Arabia, follow your local data protection law.

Quick checklist

• Our purpose for CCTV is written down.
• No camera points into a banned place or films more than needed.
• Visible signs are in place.
• Only authorised people view footage, and every review is recorded.
• Our retention period is set and checked against the requirements document.
• Staff know why cameras are used and who to ask.