United Arab EmiratesFederal Decree-Law on the Protection of Personal Data, comprehensive regime and lawful basis
Federal Decree-Law No. 45 of 2021, Arts. 1, 4
In force since .
A comprehensive regime rule binding private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- An app that collects, uses, or discloses the personal data of an individual in the onshore UAE must establish a lawful basis under PDPL Art. 4, ordinarily consent, and must obtain the Data Subject's explicit consent before processing a faceprint, voiceprint, or other identity-linked biometric identifier, including one derived from a photo, video, or audio recording, since biometric data is a category of Sensitive Personal Data.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does Personal Data that an individual posted to a public profile count as Personal Data that 'has become available and known to all by an act of the Data Subject' under Article 4(2), and does that exception cover an app's later processing of it for a new purpose such as model training?
What it makes you log
Logging duty
Article 1 defines the terms the Decree-Law uses and Article 4 lists the cases in which personal data may be processed without the owner's consent. Neither requires a person to make, keep or produce a log or record. The record a controller keeps of its processing (Article 7(4)), the terms of consent (Article 6) and the scope clause (Article 2) are in articles this row does not cite, so none is borrowed.
- Kind
- None
- As of
What this law does
The federal PDPL is the UAE's onshore comprehensive personal-data statute, applying outside the DIFC and ADGM free zones. Processing requires a lawful basis, most commonly the Data Subject's consent, with Art. 4 listing alternative grounds including a consent exception at Art. 4(2) for data the Data Subject has made public by their own act. Controller and Processor are General Data Protection Regulation (GDPR)-style defined roles, with the Controller determining purposes and means and bearing primary compliance duty.
Art. 1's Biometric Data definition names facial images and fingerprints as worked examples and lists Biometric Data as a category of Sensitive Personal Data, so an identity-linked voiceprint or faceprint ordinarily requires the Data Subject's explicit consent as its legal basis; no exclusion for an identifier derived from a photo, video, or audio recording was found.
The Decree-Law's Art. 28 Executive Regulations, which would supply operative detail including the breach-notification timeline, have not been located at primary source; Cabinet Resolution No. 83 of 2022, sometimes cited as that Executive Regulation, is an unrelated vehicle speed-radar regulation.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .