Processes biometric data, in the United Arab Emirates

DIFC Law No. 5 of 2020 · Read the law's page

• An app whose Controller or Processor is incorporated in the DIFC, or that Processes Personal Data in the DIFC as part of stable arrangements, must have a lawful basis under Article 10 for Processing Personal Data, and must obtain the Data Subject's explicit consent or satisfy another condition in Article 11 before Processing a faceprint, voiceprint, or other biometric identifier used to uniquely identify a natural person, including one derived from a photo, video, or audio recording.

ADGM Data Protection Regulations 2021 (consolidated February 2024) · Read the law's page

• An app that is a controller or processor established in or targeting the ADGM free zone must establish a lawful basis for processing personal data, and must obtain explicit consent or another qualifying condition before processing a faceprint, voiceprint, or other biometric identifier, including one derived from a photo, video, or audio recording.

Federal Decree-Law No. 45 of 2021, Art. 4 (reach over scraped public personal data) · Read the law's page

• A scraper collecting the personal data of an individual in onshore UAE from a public, unauthenticated page must still establish a lawful basis under Art. 4 for any use beyond the narrow act that made the data public, and must treat a biometric identifier derived from public photographs, video, or audio as Sensitive Personal Data requiring explicit consent.

Federal Decree-Law No. 45 of 2021, Arts. 1, 4 · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in the onshore UAE must establish a lawful basis under PDPL Art. 4, ordinarily consent, and must obtain the Data Subject's explicit consent before processing a faceprint, voiceprint, or other identity-linked biometric identifier, including one derived from a photo, video, or audio recording, since biometric data is a category of Sensitive Personal Data.