CCTV and Surveillance Notice | DSH Dubai Smart Home

It sits alongside our Privacy Policy and our Cookie Policy. Where Privacy Policy is the general framework, this notice is the specific rulebook for surveillance because surveillance is the part of a smart home most likely to capture personal data of people other than the homeowner.

1. Why this notice exists

DSH installs and integrates surveillance systems for residential customers across Dubai. Typical hardware includes Hikvision, Axis, Mobotix, and Avigilon cameras and NVRs, paired with Lutron, Crestron, Control4, Ubiquiti, and similar control platforms. These systems can record video continuously, capture audio, run face recognition, log access events at gates and doors, and stream notifications to homeowner phones.

When a customer commissions a DSH installation:

The homeowner becomes the data controller of the household footage and access logs under UAE Federal Decree-Law No. 45 of 2021 (the UAE PDPL). The homeowner decides what is recorded, why, who can see it, and how long it is kept.
DSH may act as a data processor, where the homeowner asks us to monitor the system, store offsite backups, support break glass access, or run remote diagnostics. We act only on documented homeowner instructions.

Because of this split we publish this notice so that:

Homeowners understand the obligations they take on as controllers.
DSH staff have a clear set of rules they must follow on every job.
Family members, household staff, and visitors know what to expect and what their rights are.

2. Lawful basis for surveillance under UAE PDPL

UAE PDPL Article 4 lists the lawful bases for processing personal data, and Article 5 sets stricter conditions for sensitive personal data such as biometrics. UAE PDPL Article 6 governs the requirements for valid consent, including the requirement that consent be specific, informed, and recorded.

For residential CCTV the homeowner usually relies on one or a combination of:

Legitimate interest in protecting persons and property on the premises.
Consent from family members, residents, and household staff who live or work at the property.
Compliance with a legal obligation, where a community management company or insurer requires camera coverage.

For audio recording, face recognition, and other biometric features, the homeowner generally needs explicit consent under UAE PDPL Article 5.

3. UAE Cybercrimes Law (Federal Decree-Law No. 34 of 2021)

UAE Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes sets criminal sanctions for unlawful surveillance and recording.

In particular, Article 44 makes it a criminal offence to use any electronic information system to:

Eavesdrop on, intercept, record, transmit, disclose, or republish conversations, communications, audio, or visual material without authorisation.
Take photographs of others in places not open to the public, or transmit such photographs.
Republish news, photographs, or comments touching on the privacy of family or private life of any person, even if true.

The penalties include imprisonment and fines that scale with severity. DSH installations are designed so that compliance with Article 44 is the default, not a setting to be turned on later.

4. UAE Penal Code (Federal Decree-Law No. 31 of 2021)

UAE Federal Decree-Law No. 31 of 2021 issuing the Penal Code, in particular Article 378, criminalises violations of privacy of family or private life. This includes listening to, recording, or transmitting private conversations or images using any device, without consent. The article applies regardless of whether the device is owned by a private person, a household, or a service provider.

DSH treats Article 378 as a hard floor. Anything that risks crossing it is rejected at design stage.

5. Dubai surveillance camera regulation

In Dubai, the deployment of surveillance cameras is regulated under Dubai Law No. 3 of 2017 on the Regulation of Security Industry, together with implementing decisions and circulars from Dubai Police's Security Industry Regulatory Agency (SIRA), and supplementary requirements from Dubai Civil Defence (DCD) where relevant to fire and life safety integration.

Although the most stringent SIRA rules target commercial premises and public access locations, residential deployments are still expected to follow:

Use of approved equipment and approved installers for high security setups.
Cameras must not be aimed at public roads, neighbouring properties, or other private homes without permit and lawful basis.
Footage covering public spaces, when retained, may need to be made available to Dubai Police on lawful request.
Estate wide or community wide systems (for example, gatehouse cameras for Emirates Hills, Palm Jumeirah, Dubai Hills) typically need explicit SIRA approval and licensed operators.

When a DSH installation includes any element that crosses into community level surveillance, gate house monitoring, or street facing coverage, we will tell you upfront and help you secure the necessary permits.

6. Camera placement rules

DSH installs follow these placement rules by default. The homeowner can override for legitimate reasons, but we document the reason in the design file.

6.1 Lawful zones

Cameras can normally be placed at:

Front door, side doors, garage doors, and other entry points.
Driveway and parking on the property.
Inside the perimeter of the plot, aimed inward.
Garden and pool areas where adults reside, with awareness of who else uses the area.
Plant rooms, server rooms, and storage areas.
Common interior corridors, kitchens, foyers, and stairwells, subject to family consent.

6.2 Prohibited or sensitive zones

Cameras must not be placed where they:

Capture neighbour windows, gardens, or interiors.
Cover public streets or pavements beyond what is needed for the entry point itself.
Cover bathrooms, toilets, changing rooms, prayer rooms, or guest bedrooms.
Capture domestic staff sleeping quarters, except with written consent and only with audio off.
Cover children's bedrooms, beyond infant monitor cameras under direct parental control.

If a camera angle drifts into one of these zones, we either reposition the camera, fit privacy masks, or refuse the install.

7. Audio recording rules

Audio is treated more strictly than video because the UAE Cybercrimes Law and the Penal Code articles cited above specifically call out conversation recording.

DSH default behaviour:

Camera microphones are off by default at commissioning.
Audio recording is only enabled with explicit, written, informed consent from the homeowner, and the homeowner is asked to confirm that everyone routinely captured by that camera has been informed.
Audio capture is not deployed to gate cameras, doorbell cameras, or driveway cameras where casual visitors would be recorded without practical means to consent.
Two way intercoms record only the duration of a triggered call, not continuous audio.

8. Voice control and AI recordings

Voice assistants and AI features can capture far more than people realise. DSH defaults are:

On premises Whisper or equivalent local speech to text for voice control, so that voice audio does not leave the home.
No cloud storage of voice audio by DSH.
Wake word always local, with no streaming until the wake word is detected.
Transcripts not retained by default. If the homeowner wants transcripts retained for routine improvements, that is enabled explicitly and the retention window documented.
Cloud voice assistants (for example, third party voice services with cloud transcription) are deployed only on the homeowner's instruction, and the homeowner is briefed on the third party's privacy posture before activation.

9. Retention periods

Default retention windows on DSH installations:

Continuous CCTV recording on local NVR: 30 days rolling. Standard residential default.
High security villa with estate level threat profile: 90 days rolling. On homeowner instruction.
Event triggered clips (motion, doorbell, alarm): 90 days. Easier to keep longer because volume is small.
Access control logs (gate, doors, biometric reader): 12 months. Operational and incident review.
Voice control transcripts: Not retained. Privacy by default.
Face recognition templates: Active only while feature is enabled. Sensitive personal data under PDPL Art. 5.
Remote support session recordings (when homeowner consents): 90 days. Operational quality.

The homeowner can shorten or extend retention. We document the change and the reason.

10. Access controls: who can view footage

Access to recorded footage is layered.

Homeowner: unrestricted access via the app, web client, or NVR on premises, after multi factor authentication.
Designated household members: access on the homeowner's instruction, with their own credentials. We do not share accounts.
Household staff: typically limited, role specific access. For example, security staff may view live cameras but not export footage, and may not view interior cameras at all.
DSH support engineers: no standing access. When the homeowner reports a fault that needs DSH eyes on footage, we open a time bound, audited break glass session. The session is logged with the engineer's identity, the cameras viewed, and the duration. The log is shown to the homeowner on request.
Manufacturers and third party support: view only screen shares during a live troubleshooting call, with the homeowner or DSH on the line. No file exports.

11. Sharing footage with police, courts, and authorities

We respect lawful requests from UAE authorities including Dubai Police, the Public Prosecution, and DCD. Disclosure is generally based on:

A formal written request quoting the legal basis, typically under the UAE Penal Procedures Law (Federal Decree-Law No. 38 of 2022 issuing the Criminal Procedural Law) or a court order.
The UAE Cybercrimes Law (Federal Decree-Law No. 34 of 2021) for cybercrime investigations.
Article 30 and related provisions of the Penal Procedures Law concerning evidence collection.

Process:

Requests are routed to the homeowner first, because the homeowner is the controller.
DSH supports the homeowner with technical extraction, hash generation for chain of custody, and a written log of what was provided.
Where DSH receives a direct lawful order naming us as the data holder for hosted backups, we comply and notify the homeowner unless the order specifically prohibits notification.

We do not provide footage on informal verbal requests, and we do not provide it to private parties without the homeowner's written consent.

12. Notice and signage obligations

UAE PDPL Article 6 requires that consent be informed. For surveillance, that almost always means visible notice. DSH supplies and recommends:

A discreet sign at every entry point informing visitors that CCTV is in operation, in Arabic and English.
A clear notice for any zone where audio is recorded.
A documented disclosure to household staff at the start of employment, listing which cameras cover their work areas, retention period, and contact details for access requests.
A short briefing for new household members and frequent visitors.

We provide draft signage and notices to homeowners as part of every install handover pack.

13. Customer responsibilities

As the data controller of footage on their installed system, the homeowner is responsible for:

Posting visible signage as above.
Briefing household staff and family members.
Issuing credentials only to authorised users.
Keeping retention windows reasonable for the stated purpose.
Responding to subject access requests from people filmed by their cameras.
Notifying DSH of changes that may affect lawful basis (for example, new staff, new live in family member, change of community rules).
Reporting any data breach, theft, or loss of NVR equipment to DSH and, where required, to the UAE Data Office within 72 hours under UAE PDPL Article 9.

DSH supports the homeowner with templates, training, and incident response on retainer where requested.

14. Data subject rights

If you have been filmed by a DSH installed system, UAE PDPL gives you rights including:

Right to be informed that recording is taking place (Art. 13).
Right of access to footage of yourself (Art. 14).
Right to rectification if data about you is inaccurate (Art. 15).
Right to erasure in defined circumstances, balanced against the homeowner's legitimate interests and any legal hold (Art. 15).
Right to restrict processing during a dispute (Art. 16).
Right to object to processing based on legitimate interests (Art. 18).
Right to lodge a complaint with the UAE Data Office.

Because DSH usually acts as processor rather than controller, the first stop for a request is the homeowner. Where you do not know who the homeowner is, or where DSH is operating the system on the homeowner's behalf, you may write to support@dubaismarthome.ae and we will route the request appropriately.

15. Subject Access Request procedure

For a homeowner or DSH to handle an access request well, we use the following process.

Submit the request in writing, by email or letter, with enough detail to find the footage (date, time window, location, your physical description or photo).
Identity verification. We confirm who you are using a copy of your Emirates ID or passport. We delete the ID copy after the request is closed unless the law requires us to keep it.
Triage within 5 working days. We confirm receipt and tell you whether we can fulfil the request, and by when.
Response within 30 days. We provide the footage relevant to you, with third party faces, voices, and identifiers redacted to protect their privacy. Complex cases can extend by another 30 days, with a written explanation.
Format. Footage is supplied in a common format (MP4 or similar) on a secure download link or encrypted media.
Fee. Reasonable requests are free. We may charge a fair administrative fee for repeat or excessive requests.
Refusals. Where we cannot fulfil the request (for example, the footage no longer exists, or the request would disproportionately affect another person's rights), we explain the reason and your right to complain to the UAE Data Office.

16. Cybersecurity and integrity of recordings

DSH builds installations to align with TDRA Cyber Hygiene residential guidance and, where requested by family office customers, with NESA / UAE Information Assurance Standards v1.1 controls. In practice this means:

NVRs hardened, default credentials changed, firmware kept current.
Camera and NVR network on a segmented VLAN.
Remote access through authenticated VPN, not exposed ports.
Encrypted offsite backup where the homeowner opts in, in a UAE region first.
Audit logs on every administrative action.
Annual review of camera placement, retention windows, and access lists.

17. Contact

For questions about this notice or a surveillance specific request:

Email: support@dubaismarthome.ae
Postal address: One Central, 8th and 9th Floor, Trade Centre 2, Dubai, United Arab Emirates

You also have the right to lodge a complaint with the UAE Data Office under Federal Decree-Law No. 44 of 2021. Contact details are in our Privacy Policy.

For a suspected criminal offence involving recording or surveillance, you can also contact Dubai Police, including via the eCrime portal, under UAE Federal Decree-Law No. 34 of 2021.

This notice is published in English. If a translated version is provided, the English version prevails in the event of a conflict.