Face recognition in the United Arab Emirates

Which UAE data protection law applies?

All three treat biometric data used to identify a person as a special or sensitive category requiring a stronger basis than ordinary personal data. The DIFC and ADGM regimes are closely modelled on the European General Data Protection Regulation, so a team that has implemented GDPR controls will recognise the structure.

The federal PDPL's executive regulations, which set out much of the operational detail, have been slower to arrive than the law itself. Where they are not yet in force for a given question, practice is commonly guided by the free-zone regimes and by sector regulators, which is a reason to confirm current status rather than rely on a summary.

What does the federal PDPL require for biometric data?

The PDPL classifies biometric data as sensitive personal data. Processing personal data generally requires the consent of the data subject, subject to a list of exceptions in the law — among them where processing is necessary to protect the public interest, for legal claims, for public health, or to carry out obligations of the controller under employment law.

• Consent must be clear, unambiguous and capable of being withdrawn.
• Processing must be for a specified purpose and limited to what that purpose needs.
• Data subjects have rights of access, correction, erasure and objection.
• Breaches must be notified to the UAE Data Office, and to the data subject where the breach would prejudice their privacy or security.
• A data protection officer is required where processing involves sensitive personal data on a large scale, among other triggers.

Where can the data be held?

The PDPL permits transfer outside the UAE to a jurisdiction the UAE Data Office has determined provides an adequate level of protection, or on the basis of a contract or binding undertaking that imposes equivalent protections, or with the data subject's explicit consent, subject to conditions.

In practice, deployments in government, aviation, ports and critical infrastructure in the region are commonly specified to keep biometric data in-country and frequently on-site, which is a procurement position rather than a universal legal requirement. Ayonix supports that directly: the ATLAS BOX appliance and edge configurations run detection, template extraction and matching on hardware at the site, so nothing is sent to a vendor service.

• Air-gapped operation, where the site's policy is that no network route exists.
• On-premise operation inside the operator's own data centre in the UAE.
• Edge operation at the camera, where only the result leaves the device.
• Sector rules may add requirements — aviation, ports and government each have their own supervisory expectations.

What should a UAE buyer establish before deployment?

• Which regime governs the site — federal PDPL, DIFC or ADGM — before anything else.
• The basis relied on for processing sensitive personal data, and how consent is captured and withdrawn if consent is the basis.
• Whether a data protection officer is required for the scale of processing.
• Where template storage physically sits and whether it ever leaves the country.
• Retention periods for templates and match records, and what enforces them.
• How accuracy was measured on the operator's own cameras, in local conditions, rather than on a vendor benchmark.

Ayonix publishes no headline accuracy figure for this or any market. What it publishes is its participation in the face recognition evaluations run by the United States National Institute of Standards and Technology, which are independent and whose results are public — a checkable statement rather than a marketing number. NIST does not certify, approve or endorse vendors.

This page describes what the named laws require, with each instrument cited so it can be checked. It is not legal advice, and it is not a statement that any particular deployment complies: that assessment belongs to your own counsel and your data protection authority.