United Arab EmiratesFederal Decree-Law on the Protection of Personal Data, reach over scraped public personal data
Federal Decree-Law No. 45 of 2021, Art. 4 (reach over scraped public personal data)
In force since .
A personal data rule binding private bodies.
- Audit expectation
- none
What it requires
- A scraper collecting the personal data of an individual in onshore UAE from a public, unauthenticated page must still establish a lawful basis under Art. 4 for any use beyond the narrow act that made the data public, and must treat a biometric identifier derived from public photographs, video, or audio as Sensitive Personal Data requiring explicit consent.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 4 prohibits processing personal data without the data subject's consent and lists the cases that are excluded from that prohibition, including data that has become available and known to all by an act of the data subject. It names no log, record or documentation. The controller's record of processing is in Article 7(4), a section this row does not cite.
- Kind
- None
- As of
What this law does
Article 4(2) provides a lawful-basis exception for processing personal data that has become available and known to all by an act of the data subject, which the jurisdiction's privacy record confirms is a consent-basis exception rather than a scope exclusion: personal data a scraper collects from a public, unauthenticated page of a UAE resident remains Personal Data for the Law's other duties, including security, purpose limitation, cross-border transfer, and breach reporting, once collected outside the narrow act that made it public.
The Law carries no publicly-available-data carve-out of the kind some jurisdictions apply to a whole category of public records, and Art. 1's Biometric Data definition names facial images and fingerprints as worked examples of Sensitive Personal Data with no exclusion for an identifier derived from a public recording, so a scraper deriving a biometric identifier from publicly posted photographs or audio faces the Law's elevated consent requirement for Sensitive Personal Data.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .