PDPL and video analytics: keep footage in the Kingdom

A mall operator can know how many people came through each entrance, how long the food-court queue was at 9 pm, and which zones overcrowd on a Thursday night, without a single face or raw recording leaving the building. Saudi law rewards exactly that design. This guide sets out the two laws that govern camera analytics in a mall, where the lines are, and the questions to put to any provider before footage moves.

Two laws, one camera

The Personal Data Protection Law

The Personal Data Protection Law defines personal data to include photos and videos of an individual (Article 1). A camera image of an identifiable shopper is personal data, and analysing it is processing. Article 2 applies the law to processing inside the Kingdom, and to processing from outside the Kingdom of data about people who reside in it. Under the amended Article 43, the law came into force 720 days after its publication in the Official Gazette; the official text on the Bureau of Experts portal shows the amendments by Royal Decree M/148.

The Law of Use of Security Surveillance Cameras

The Law of Use of Security Surveillance Cameras (Royal Decree M/34, Arabic text) applies to commercial complexes and shopping centres, entertainment venues, tourist accommodation, food service establishments and many other places (Article 2). For a mall it means:

• Cameras installed, maintained and running around the clock (Article 4)
• Recordings kept for the period set in the Ministry of Interior's conditions document, and preserved unaltered when an incident is reported (Article 4)
• No cameras inside changing rooms, toilets, women's salons and clubs, and other listed places (Article 6)
• Visible signs telling people the place has cameras (Article 6)
• Recordings may not be transferred or published except with the approval of the Ministry or the Presidency of State Security, under a court order, or at the request of the competent investigating authority (Article 6)
• Systems linked to the cameras managed according to what the National Cybersecurity Authority issues (Article 14)
• Fines that include SAR 20,000 for transferring or publishing recordings in breach of the law (Article 12)

Read together, the two laws push the same way. Keep raw footage where it is recorded, extract only what you need, and be able to show who saw what.

Where analytics becomes sensitive data

The PDPL lists biometric data used to identify a person as sensitive data (Article 1). Counting people, measuring dwell time or detecting a crowd does not need to know who anyone is. Face matching does. The moment a system compares faces against a list, the processing moves into a heavier class.

The penalties reflect that. Disclosing or publishing sensitive data in breach of the law, with intent to harm the data subject or for personal benefit, carries up to two years' imprisonment, a fine of up to SAR 3 million, or both (Article 35). Other violations carry a warning or a fine of up to SAR 5 million, which can be doubled for a repeat violation (Article 36).

Plate reading in the car park sits in between. The PDPL's definition covers data that identifies a person directly or indirectly, and its examples include licence numbers and personal property records. Treat plate data as personal data and set its retention on purpose.

Moving footage out of the Kingdom

Many video analytics services process footage in a cloud region abroad. Under the PDPL, that is a transfer. Article 29 allows transfers outside the Kingdom only for listed purposes and on conditions: no prejudice to national security or the Kingdom's vital interests, an adequate level of protection abroad, and the minimum personal data needed. The Regulation on Personal Data Transfer Outside the Kingdom adds the detail, and requires a risk assessment before certain transfers, including continuous or widespread transfers of sensitive data (Article 7).

For a mall, the camera law's restriction on transferring recordings applies on top. The simplest position is the strongest one: if raw footage never leaves the site, there is no transfer to assess.

Obligations that come with continuous monitoring

The PDPL Implementing Regulation adds three obligations that matter for camera analytics:

• Impact assessment (Article 25). Required for processing sensitive data, for processing that by its nature requires constant monitoring of data subjects, and for processing based on newly adopted technologies. It must cover purpose and legal basis, necessity and proportionality, likely impact, and the measures that reduce risk. Write it before go-live.
• Data protection officer (Article 32). Required where the controller's primary activities are based on processing that needs regular and systematic monitoring of data subjects. Check whether that describes your operation.
• Breach notification (Article 24). Notify the competent authority within 72 hours of becoming aware of a breach that may cause harm, and notify affected individuals without undue delay where it may harm them.

The law itself also limits what you collect to the minimum needed for the purpose (Article 11), and requires destruction once the purpose ends, unless another law sets a retention period, in which case the data is destroyed when that period ends (Article 18). For a mall, that reconciles cleanly: raw recordings for the period the camera conditions document sets, and analytics output kept as anonymous counts.

A design that keeps identities in the Kingdom

Layer	Design choice	Why it matters
Processing	Models run on edge hardware on site	Raw video never leaves the building
Output	Counts, occupancy, queue length, dwell time, alerts	Aggregates identify no one
Evidence	Short event clips only, faces blurred by default	Minimum data for the purpose
Identity	No face matching unless requested and lawful	Stays outside sensitive data by default
Hosting	On premises or in a Saudi data centre	No cross-border transfer to assess
Access	Role-based access, with every view logged	Shows who saw what, for audits and incidents

What a mall can measure this way

• Footfall by entrance and by hour, for leasing conversations and staffing
• Occupancy by zone, with an alert before crowding builds
• Queue length at the food court, cinema and customer service desk
• Dwell time in front of anchor stores and promotional space
• Car park occupancy, and plate reading at entry and exit
• Footage searchable by event, such as a person in a closed zone after hours, without searching by identity

Where to start

1. List the cameras. Record each camera, its location and its purpose. Confirm none sits in a prohibited place and the required signs are up.
2. Give each camera one question. Footfall at the entrance, queue length, or zone occupancy. A specific question sets the minimum data.
3. Write the impact assessment before go-live. Describe the processing, where it runs, how long outputs are kept, and who can see what.
4. Start with one camera. Measure accuracy and false alarms on your own footage, then scale.

Questions to ask a video analytics provider

• Where is video processed, and does raw footage ever leave our site?
• What data leaves the site, in what form, and to which country?
• Are faces blurred by default? Can face matching be switched on without our written approval?
• How long do you keep clips and counts, and who can delete them?
• Who on your side can view live or recorded video, and is every view logged?
• Will you support our impact assessment with a written description of the processing?
• How are your systems run to meet NCA requirements, as Article 14 of the camera law expects?

How TQN builds it

TQN's Vision AI practice turns cameras a site already owns into live counts, alerts and evidence. Models run on site on edge hardware. Only events and short clips leave the site. Hosting is on premises or in a Saudi data centre. Faces are blurred by default, and there is no face matching unless the client requests it and it is lawful. The architecture is designed to support PDPL and NCA requirements; the legal assessment for your site stays with your counsel. See how this applies to retail and malls.

Show us one camera

Pick one camera, such as a main entrance or a food-court queue, and give us ten minutes of footage from it, shared in a way your legal team approves. We return a free read-out of what that camera could report every day. Show us one camera.