Facial Recognition in the UAE: How Is Your Privacy Protected?

From airport immigration gates to digital payment apps, facial recognition technology is becoming part of daily life in the UAE. While it offers speed and convenience, many citizens and residents are asking: What happens to my facial data? Who has access to it? Can I say no?

The good news is — your privacy is protected under the UAE’s Personal Data Protection Law (PDPL). In this blog, we break down what facial recognition data is, how the UAE regulates it, and what rights you have to stay in control of your identity.

What Is Facial Recognition Data?

Facial recognition data refers to biometric information extracted from your face. It can include:

Facial geometry

Unique facial features

Skin texture

Iris and eye details

This type of data is classified as “sensitive personal data” under the UAE PDPL because it can uniquely identify an individual.

🔐 Why it matters: If mishandled, facial recognition data can be used for unauthorized surveillance, identity theft, or profiling.

The Legal Shield: UAE Personal Data Protection Law (PDPL)

The UAE introduced the Federal Decree-Law №45 of 2021 on the Protection of Personal Data (PDPL) to give individuals greater control over their personal information — including biometric and facial recognition data.

Here’s how the PDPL safeguards your privacy:

Facial recognition data is categorized as “sensitive personal data,” which means it:

Requires stricter protection than regular personal data

Cannot be processed unless a legal basis is established

Must be handled with appropriate technical and organizational safeguards

📌 Takeaway: Companies need your clear consent or a lawful reason to collect and use your face data.

How Is Your Consent Handled?

Under the UAE PDPL, explicit consent is the cornerstone for processing facial recognition data.

Consent must be:

✅ Freely given

✅ Specific to the purpose

✅ Informed (you must understand how your data will be used)

✅ Withdrawable at any time

❌ What doesn’t count? Pre-ticked boxes, silence, or inactivity.

💡 Example: If a mall installs facial recognition for security, they must inform you and give you the option to opt out unless required by law.

When Can Your Facial Data Be Collected Without Consent?

There are limited exceptions where your face data can be processed without consent:

Public interest or national security

Healthcare emergencies

Compliance with a legal obligation

However, even in such cases, data minimization and strict security protocols must be followed.

Data Subject Rights: You’re in Control

The UAE PDPL grants you several rights over your facial recognition data:

🎯 Pro Tip: Always check for a privacy notice or consent form before using a facial scan-based app or device.

Cross-Border Transfers: Is Your Data Leaving the UAE?

Facial recognition data can only be transferred outside the UAE if the destination country ensures adequate protection or if specific safeguards are in place, such as:

Data Office approval

Binding legal agreements

Specific data transfer mechanisms (to be detailed in Executive Regulations)

🚨 Caution: If your facial data is stored on foreign servers (e.g., via cloud apps), ask the provider how and where your data is processed.

Who Regulates and Enforces the Law?

The UAE Data Office oversees and enforces compliance with the PDPL. It is responsible for:

Approving cross-border data transfers

Investigating data breaches or misuse

Issuing fines and corrective actions

As of now, fines for non-compliance have not been officially specified, but are expected in upcoming Executive Regulations.

Real-World Example: Face Scans at Airports

The UAE has implemented facial recognition at airports to streamline passenger verification. While this is legally allowed under national security and public interest grounds, authorities must still:

Inform passengers about the use of face scanning

Implement high-level cybersecurity protections

Minimize data storage duration

✈️ Tip: Look for signage and consent notices at immigration checkpoints or use alternative options where available.

Final Thoughts: Privacy and Progress Can Coexist

Facial recognition isn’t going anywhere — but that doesn’t mean your privacy is up for grabs. The UAE’s PDPL ensures that businesses and government agencies can only use your face data lawfully, securely, and transparently.

As a resident or visitor in the UAE, you’re protected. Just remember:

Read privacy notices carefully

Ask questions if you’re unsure

Use your rights when needed

Need Help Complying with UAE PDPL?

Whether you’re a business using facial recognition or an individual concerned about your data, our privacy experts can guide you through compliance and rights management. Contact us today for tailored support.