Home > > > CCTV Rules in Qatar for Businesses: What Law No. 9 of 2011 Requires

CCTV Rules in Qatar for Businesses: What Law No. 9 of 2011 Requires

Author : Axle Systems | Published On : 03 Nov 2026

This article explains the law in plain language. It is not legal advice. For a decision about your premises, confirm with the Ministry of Interior's Security Systems Department or a lawyer.

The short answer

Qatar regulates CCTV in businesses through Law No. 9 of 2011 Regulating the Use of Security Cameras and Monitoring Devices, issued on 18 May 2011. Businesses in the categories the law lists must install cameras, run them 24 hours a day, keep a control room, display a sign, keep recordings unaltered for 120 days and hand them to the authorities on request. The law bans cameras in certain private areas and sets fines, imprisonment and license suspension for breaches. The Ministry of Interior's Security Systems Department (SSD) licenses surveillance systems and maintains a list of accredited installation companies.

Which businesses must install CCTV?

Article 1 of the law lists the establishments it covers:

  • Hotels, serviced apartments and residential complexes
  • Banks, financial institutions and exchange offices
  • Gold and jewelry shops
  • Sports and cultural clubs
  • Shopping and entertainment centers
  • Hospitals and clinics
  • Warehouses and storage facilities for precious or hazardous materials designated by the competent authority

The Council of Ministers can add further categories on the proposal of the Minister of Interior. If your type of business is not on this list, confirm with the SSD before you buy equipment.

What the law requires once cameras are installed

Round-the-clock operation and a control room

Article 2 requires owners and managers of covered establishments to install cameras, operate them 24 hours a day and have a control room.

Maintenance to official specifications

Article 3 requires cameras to be maintained and updated to the technical specifications set by ministerial decision. The competent authority may enter the premises to inspect the equipment.

Camera locations and connection to the authorities

Article 4 gives the competent authority the power to set the locations and number of cameras. It may also require an establishment to connect its cameras to the authority's systems in the public interest.

A visible sign

Article 5 requires a clear sign showing that the premises are under camera surveillance.

Keeping recordings for 120 days

Article 6 requires recordings to be kept for 120 days without any modification and handed to the competent authority on request. The same article requires the recordings to be destroyed immediately after the 120 days.

Who may copy or share footage?

Article 7 prohibits transferring, storing, transmitting or publishing recordings without the competent authority's approval. That covers sending footage outside the business and posting it online.

Where cameras are not allowed

Article 8 prohibits cameras in bedrooms, physiotherapy rooms, restrooms, changing rooms and areas designated for women.

Recordings as evidence

Article 9 makes recordings from an establishment's cameras admissible as evidence before investigators and courts, unless the contrary is proven.

Penalties for breaking the rules

Breach

Maximum penalty

Sharing or publishing recordings without approval (Art. 7), or cameras in prohibited areas (Art. 8)

Up to 3 years' imprisonment, a fine of up to QAR 50,000, or both (Art. 10)

Failing to install and operate cameras (Art. 2), maintain them to specification (Art. 3), connect them when required (Art. 4), display a sign (Art. 5) or keep and hand over recordings (Art. 6)

Up to 1 year's imprisonment, a fine of up to QAR 10,000, or both (Art. 11)

Either of the above

The court may also suspend the activity license for up to one year or cancel it (Arts. 10 and 11)

Under Article 12, the person who actually manages the business faces the same penalties if they knew of the violation, or if their failure to perform their management duties contributed to it. The business is jointly liable for fines and compensation when an employee commits the violation in its name and for its benefit.

The Security Systems Department's role

The SSD issues licenses for surveillance systems and devices after its inspection section confirms they conform, issues conformity certificates for cameras and installation sites, and issues import licenses. Importing CCTV cameras requires the SSD's prior permission.

In April 2026 the Ministry of Interior published a list of 162 companies licensed and approved by the SSD to install surveillance cameras, and urged the public to install cameras only through companies registered with the ministry. Since September 2025, the Metrash app has accepted complaints to the SSD, including complaints about unlicensed surveillance activity.

The ministry has also advised camera owners to use only trusted apps for remote viewing, to choose strong passwords and change them regularly, to avoid viewing cameras through open or untrusted internet links, and to have the installer inspect the site first so that cameras do not violate other people's privacy.

How data privacy law applies

Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016) defines personal data as information about a person whose identity can be determined, directly or by combining it with other data. It applies to personal data processed electronically. Digital recordings in which people can be identified can fall within that definition.

The law requires organizations to process personal data lawfully and to take appropriate administrative, technical and financial measures to protect it (Article 8). It requires protection against loss, damage, alteration and unauthorized access or disclosure (Article 13), and notification of breaches that may cause serious damage (Article 14). Breaching Article 13 carries a fine of up to QAR 5 million (Article 24).

The law is now enforced by the National Data Privacy Office at the National Cyber Security Agency. In February 2026 the office issued a binding decision against a company in the sports sector after a personal data breach. It found the company's technical, administrative and physical safeguards inadequate and ordered it to strengthen them.

For a CCTV system, that points to clear controls: named users with viewing rights, a log of who viewed or exported footage, secure remote access and changed default passwords. If your cameras also feed face recognition or attendance systems, Axle Systems' biometric data privacy checklist for employers in Qatar covers the additional steps.

Planning storage for 120 days of footage

The 120-day rule drives the size of your recorder more than anything else. The calculation is:

Storage per camera = average bitrate × seconds per day × 120 days

Here is a worked example. Replace the assumptions with your installer's figures. It assumes a 1080p camera encoding H.265 at an average of 2 Mbps, recording continuously:

  • 2 Mbps is 0.25 megabytes per second, or about 21.6 GB a day
  • Over 120 days, that is about 2.6 TB per camera
  • Sixteen cameras need about 41 TB of usable storage, before any RAID overhead

Higher resolutions, busier scenes and less efficient codecs raise the bitrate, and the total rises in proportion. Ask any installer to show this calculation for your actual cameras and settings.

Checklist before you sign with an installer

  1. The company appears on the Ministry of Interior's current list of accredited camera companies.
  2. The company confirms in writing whether your premises fall under Law No. 9 of 2011, and which SSD approvals it will obtain.
  3. Cameras will be imported with SSD permission, and you will receive the conformity certificate after installation.
  4. The design shows every camera position, and none covers an area banned by Article 8.
  5. A surveillance sign is included, as Article 5 requires.
  6. The storage calculation shows 120 days of recordings at the configured settings.
  7. Recordings cannot be altered, and the system logs who viewed or exported footage.
  8. Default passwords are changed, remote viewing uses a trusted app, and firmware updates are part of maintenance.
  9. A maintenance contract keeps the system running 24 hours a day and up to the official specifications.

What this article does not cover

Article 3 provides for technical specifications set by ministerial decision, covering matters such as camera standards and recording requirements. This article does not reproduce them. Ask your accredited installer for the version currently in force.

About Axle Systems: Founded in 2012, Axle Systems is a security systems integrator in Doha that designs and installs CCTV, access control and attendance systems for businesses in Qatar.

Sources