Law note · United Arab Emirates
Federal Decree-Law on the Protection of Personal Data, comprehensive regime and lawful basis
What it requires
- An app that collects, uses, or discloses the personal data of an individual in the onshore UAE must establish a lawful basis under PDPL Art. 4, ordinarily consent, and must obtain the Data Subject's explicit consent before processing a faceprint, voiceprint, or other identity-linked biometric identifier, including one derived from a photo, video, or audio recording, since biometric data is a category of Sensitive Personal Data.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
- Excludes recording-derived identifiers
- No
What we found
The federal PDPL is the UAE's onshore comprehensive personal-data statute, applying outside the DIFC and ADGM free zones. Processing requires a lawful basis, most commonly the Data Subject's consent, with Art. 4 listing alternative grounds including a consent exception at Art. 4(2) for data the Data Subject has made public by their own act. Controller and Processor are General Data Protection Regulation (GDPR)-style defined roles, with the Controller determining purposes and means and bearing primary compliance duty.
Art. 1's Biometric Data definition names facial images and fingerprints as worked examples and lists Biometric Data as a category of Sensitive Personal Data, so an identity-linked voiceprint or faceprint ordinarily requires the Data Subject's explicit consent as its legal basis; no exclusion for an identifier derived from a photo, video, or audio recording was found.
The Decree-Law's Art. 28 Executive Regulations, which would supply operative detail including the breach-notification timeline, could not be confirmed to exist at primary source in this research pass; a corpus candidate citing "Cabinet Resolution No. 83 of 2022" as that Executive Regulation is confirmed wrong (that instrument is an unrelated vehicle speed-radar regulation), and is not authored here.