Hikvision vs Dahua: Which CCTV Brand for UK Projects

Hikvision and Dahua dominate the UK installer market for good reason — competitive pricing, deep feature sets, and mature ecosystems. In 2026, however, specifying either brand demands more due diligence than it did five years ago. UK Government guidance issued in 2022, US federal procurement restrictions, and UK GDPR supply-chain obligations have collectively turned these into compliance decisions as much as technical ones. Get the site classification wrong, skip the DPIA, or fail to disclose the relevant guidance to a public-sector client, and the reputational and contractual exposure lands squarely on the installer. This guide gives you a precise, practical framework: when each brand is appropriate, how they compare on the specs that actually move the needle, and where the genuine risk lines sit.

What Does UK Compliance Risk Actually Mean for Installers Specifying Either Brand?

Both Hikvision and Dahua carry genuine compliance risk on UK public-sector and sensitive-site projects — not because either is illegal to buy or install, but because a 2022 government directive and inherited US contractual obligations can expose installers to reputational damage, tender disqualification, and professional liability if the risks are not disclosed upfront.

The November 2022 Written Ministerial Statement

On 24 November 2022, Cabinet Office Minister Oliver Dowden issued Written Ministerial Statement HCWS374, directing all UK government departments to cease deploying Hikvision and Dahua equipment on "sensitive sites" and to cease procurement of new kit for those locations. The statement did not define "sensitive" with surgical precision, but subsequent Cabinet Office guidance and industry interpretation has settled on a working definition covering: central government buildings, critical national infrastructure (CNI) — including energy, water, transport and communications — the defence supply chain, policing and blue-light premises, and any site processing classified or SECRET-level data.

That scope is broader than many installers initially assume. A subcontractor fitting cameras in a server room for a water utility, or a systems integrator upgrading access control at a defence prime's manufacturing facility, is almost certainly operating on a "sensitive site" under this framework. The directive applies to new deployments; it does not mandate rip-and-replace of existing installations, though it strongly implies a migration plan should be in place.

What the FCC Covered List Actually Means in a UK Context

NDAA Section 889 is a US federal procurement rule — it prohibits US government agencies from buying equipment from companies on the FCC Covered List, which includes both Hikvision and Dahua. It is emphatically not a UK legal prohibition. A private UK business or local authority can purchase and install either brand without breaching any domestic statute.

The restriction travels contractually, however. UK organisations that are subsidiaries of US parent companies, or that hold NATO contracts, MoD framework agreements, or supply-chain positions with US prime contractors, will frequently find that Section 889 compliance is a contractual pass-down requirement. An installer who specifies Hikvision or Dahua on such a project without checking the client's upstream contractual obligations risks delivering a non-compliant system — with the cost of remediation falling on them.

The practical check is straightforward: before specifying either brand on any commercial or public-sector tender, ask the client directly whether their organisation is subject to NDAA Section 889 obligations or holds US government-linked contracts. Get the answer in writing.

Professional Liability and the DPIA Obligation

The reputational and contractual exposure for installers is real and underappreciated. If you specify Hikvision or Dahua on a public-sector or CNI tender without disclosing the 2022 Dowden statement (HCWS374) to the client, you have failed to give competent professional advice. Should the client subsequently face scrutiny — from an auditor, a contracting authority, or the press — the installer who signed off the design is the first call they make.

There is also a direct data protection angle. The ICO's code of practice for surveillance cameras — In the Picture: A Data Protection Code of Practice for Surveillance Cameras and Personal Information — aligned with UK GDPR, requires data controllers to conduct a Data Protection Impact Assessment (DPIA) before deploying surveillance systems likely to result in high risk to individuals (UK GDPR Article 35). The use of equipment from manufacturers subject to government security advisories must be disclosed in the DPIA. If an installer designs a system and that DPIA is never triggered — or is completed without reference to HCWS374 — the installer's specification has contributed to a deficient compliance process.

Practical Steps for Installers in June 2026

Risk Factor	Question to Ask Before Specifying
UK Government / CNI site	Does this site fall under the 2022 Cabinet Office sensitive-site directive (HCWS374)?
US parent company or MoD supply chain	Is

How Do Hikvision and Dahua Actually Compare on Specs That Matter to UK Installers?

Both brands are genuinely close on headline specs in 2026 — the differences that matter are in PoE budget discipline, AI architecture, and storage planning rather than raw megapixel counts.

---

Image Quality and Low-Light Performance

Some models in Hikvision's ColorVu/AcuSense range and Dahua's Full-colour/WizSense range quote minimum illumination figures in the region of 0.005 lux in full-colour mode, using large-aperture lenses combined with warm supplemental LEDs rather than IR. Check per-model datasheets — these figures vary across the range and don't apply universally. At that sensitivity level, the practical differentiator in most UK installs is lens focal length and scene lighting geometry, not sensor spec alone.

Dahua's WizSense range uses an independent AI chip running deep learning algorithms dedicated to human and vehicle classification. That dedicated silicon means AI processing doesn't compete with image encoding on the main SoC — relevant on busy scenes where you're running perimeter detection and recording simultaneously.

Hikvision's AcuSense line applies comparable human/vehicle filtering. Some higher-end ColorVu models use larger sensors (1/1.8″ in certain SKUs — confirm against the specific model datasheet before specifying). Both brands' mainstream 4 MP turrets — the workhorses of most UK domestic and light-commercial installs — perform comparably in side-by-side night tests at typical UK street-lighting levels (2–5 lux ambient).

Where Dahua edges ahead in the WizSense catalogue is SMD Plus (Smart Motion Detection Plus), which reduces false triggers from foliage and rain more aggressively than Hikvision's equivalent motion filtering. On UK sites — where wind-blown trees and hedges are a constant nuisance — that matters more than a marginal difference in minimum illumination figures.

---

PoE Budget Discipline: Where Installs Actually Get Constrained

Switch budget is where most installs fail. PoE budget varies significantly between NVR models and generations — 8-port NVRs from both brands can range from around 60 W to 120 W or more depending on the specific SKU, so always pull the datasheet for the exact model you're quoting before committing to a camera mix. Do not assume the PoE variant you've used before carries the same budget as a newer or differently-suffixed model.

Power draw per camera also varies by model, mode, and environmental conditions — a 4 MP turret running IR will draw differently from the same unit in full-colour mode with white-light LEDs active. PTZs are where budgets collapse: a compact PTZ in motion can draw materially more than a fixed turret, and a mid-range optical zoom unit at full pan/tilt speed more still. Always check the PoE class and maximum watt rating on the camera's own datasheet, not a generic category figure.

Camera mix (8-port NVR)	Planning note
8 × 4 MP turrets	Most 8-port NVRs handle this comfortably
6 × turret + 1 × compact PTZ	Check budget — PTZ draw varies widely
6 × turret + 2 × compact PTZ	Budget likely exceeded on lower-rated NVRs
5 × turret + 1 × high-zoom PTZ	High risk of overrun; verify per datasheet

On UK 230 V mains, the NVR's own PSU headroom is rarely the constraint — both units run well within their rated input. Once you move beyond 8 cameras onto a managed PoE switch feeding multiple NVRs, budget per-port and per-switch carefully. A 24-

Which Brand Should You Specify for Which Job? (Tiered Recommendation Matrix)

Specify neither brand without explicit client sign-off on the procurement risk. The right choice depends almost entirely on the procurement environment, not on camera specs. Public-sector exposure changes the calculus completely; for purely commercial or residential work, both brands are viable and the decision comes down to budget, distributor relationships, and AI feature requirements.

---

Tier 1 — Public Sector, Government, CNI, and MoD Supply Chain

Default recommendation: neither brand without explicit client sign-off. Specify Axis, Hanwha, or Bosch as the safe baseline.

Both Hikvision and Dahua appear on the US FCC Covered List restricting federal procurement, and both have faced ongoing scrutiny in the UK from the NPSA and parliamentary committees. For any project touching central or local government, critical national infrastructure, or a supply chain that feeds MoD contracts, the procurement risk is not theoretical — it is contractual and reputational.

Before any camera brand is even discussed, complete a Data Protection Impact Assessment under UK GDPR Article 35. If the DPIA flags cross-border data transfer risk or supply-chain sensitivity, that finding alone justifies specifying an alternative and documenting the rationale in the project file.

Axis is Swedish-owned, Hanwha is South Korean, and Bosch is German; none currently appear on the FCC Covered List. That distinction matters when you are writing a procurement justification or responding to a client's supply-chain questionnaire.

If a client explicitly instructs you to proceed with Hikvision or Dahua on cost grounds despite the above, get that instruction in writing, record it in the project file, and ensure the client has signed off the DPIA outcome. Your professional liability does not disappear because the client chose the cheaper option — the paper trail is your protection.

Scenario	Recommendation	Action Required
Central/local government	Axis, Hanwha, or Bosch	DPIA mandatory; document decision
CNI / utilities / transport	Axis, Hanwha, or Bosch	DPIA + written client sign-off
MoD supply chain	Axis, Hanwha, or Bosch	Check contract clauses explicitly
Client insists on Hik/Dahua	Proceed only with written client instruction	Record in project file; revisit DPIA

---

Tier 2 — Commercial (Retail, Logistics, Hospitality, Private Offices)

Both brands are fully viable here. Hikvision has the wider UK distributor footprint; Dahua WizSense offers the stronger value proposition where AI analytics matter and budget is tight.

Hikvision is stocked by ADI, Videcon, and SEC, giving it same-day availability across most of the UK and stronger name recognition with the IT managers and facilities teams you'll be handing the system over to. That familiarity reduces post-handover support calls and speeds up sign-off.

Dahua's WizSense range uses an independent AI chip and deep-learning algorithm focused on human and vehicle classification — the same core capability as Hikvision's AcuSense, but typically at a lower per-camera cost. For a logistics depot or large retail estate where you're specifying 40+ cameras and AI-based false-alarm filtering is a key deliverable, the saving per unit compounds quickly.

Neither brand carries meaningful regulatory risk in a purely private commercial context, provided you comply with the ICO's code of practice for surveillance cameras (In the Picture: A Data Protection Code of Practice for Surveillance Cameras and Personal Information): lawful basis documented, signage in place, retention periods set (28 days is the common default, but justify it in your DPIA), and no unnecessary off-site cloud routing without a processor agreement in place.

On UK-based technical support and warranty, both brands operate RMA processes through their UK distribution partners rather than directly — in practice, ADI and Videcon handle Hikvision returns with well-established turnaround procedures, whereas Dahua's UK support chain, while improving, is less consistently reported by installers as responsive. Factor that into your post-installation support commitments, particularly on larger commercial contracts.

Priority	Choose Hikvision	Choose Dahua
Distributor availability	✓ ADI/Videcon/SEC stock depth	Slightly narrower, but improving
AI analytics on a budget	Competitive	✓ WizSense per-unit cost advantage
IT team familiarity	✓ Stronger brand recognition	Less familiar to non-specialist staff
Post-install RMA support	✓ More established UK distributor process	Variable; confirm with your distributor

4. What Practical Steps Protect You as an Installer Regardless of Which Brand You Choose?

The brand on the camera matters far less than how you configure and document the installation. Whether you fit Hikvision or Dahua, the same UK GDPR obligations, cyber-hygiene requirements, and professional paper trail apply — and getting any one of them wrong exposes you, not the manufacturer.

UK GDPR and ICO CCTV Code Compliance

Every CCTV installation in the UK is subject to UK GDPR and the ICO's code of practice for surveillance cameras — formally titled In the Picture: A Data Protection Code of Practice for Surveillance Cameras and Personal Information. Signage is not optional: each sign must state the operator's identity, the purpose of the surveillance, and a contact point for data-subject requests — minimum content required by that code.

Camera positioning is where most residential installs fall foul of UK GDPR Article 5(1)(c), the data minimisation and proportionality principle. A camera must not capture more than is necessary for its stated purpose — in practice, it should not routinely record a public pavement, a neighbour's garden, or a shared driveway beyond the operator's boundary.

Both Hikvision and Dahua ship wide-angle lenses as standard. A 2.8 mm lens is the most common focal length across both ranges, giving a field of view that can easily sweep 100° or more. On a semi-detached property that angle almost always captures beyond the curtilage. Use privacy masking zones in the NVR or camera web interface to black out areas outside the client's boundary before handover, and photograph the masked live view as evidence.

Where a system uses any form of facial recognition or other biometric processing, a Data Protection Impact Assessment (DPIA) under UK GDPR Article 35 is mandatory before deployment. That DPIA must be disclosed to the ICO if the residual risk remains high after mitigation.

Cyber Hygiene: NCSC-Aligned Steps

Both brands have required a forced password change on first login since approximately 2017 firmware, so out-of-the-box default credentials are less of a risk than they once were — but verify this on every device you commission, because older stock or grey-market units may ship on earlier firmware. Never assume.

Beyond passwords, disable UPnP on the router and NVR. UPnP can silently open inbound ports, negating any firewall protection. Place the NVR on an isolated VLAN so that a compromised camera cannot reach the rest of the client's network — straightforward on any managed switch.

Cloud relay services — Hik-Connect for Hikvision, DMSS for Dahua — are convenient but create an outbound tunnel to servers outside the UK. If the client does not need remote viewing, disable the cloud relay entirely and document that decision. If they do need remote access, configure port-forwarding to a specific port with a strong password, or better still, provision a VPN on the router so the NVR is never directly internet-facing. The NCSC's guidance on securing network-connected cameras aligns with all of these steps.

Documentation: Your Professional Protection

Record in writing, at the time of installation, the brand and model specified, the reason for that selection (client budget, site requirements, existing system compatibility), and any client instructions that overrode your recommendation. If a client insists on a particular brand or asks you to leave cloud relay enabled against your advice, get that in writing — an email confirmation is sufficient.

Your handover pack should include, as a minimum:

• Equipment schedule: brand, model number, firmware version, and serial number for every device
• Network configuration record: IP addresses, VLAN assignment, ports used, UPnP status (disabled), cloud relay status (enabled/disabled with reason)
• Privacy masking confirmation: photograph of the live masked view, signed off by the client
• Signage checklist: location, content, and photograph of each ICO-compliant sign
• Password record: stored securely (password manager or encrypted document), not written on the NVR itself
• Data retention period agreed: the ICO recommends 31 days as a typical maximum for most sites; anything longer needs a documented justification

Retention maths matter here. A four-camera system recording continuously at