Data Protection

Biometric attendance in the UAE: what the PDPL and DIFC expect

Walk through the staff entrance of a Dubai hotel or an Abu Dhabi clinic and there is a good chance a fingerprint reader or face-recognition unit is mounted by the door. They became the default because they stop one employee clocking in for another. They also leave the employer holding the most sensitive category of personal data that UAE data protection law recognises, for everyone on the payroll.

None of that makes biometric attendance unlawful. It does mean the decision needs more thought than picking a device from a supplier's catalogue. This guide covers which law applies, what each says about biometric and location data, and the questions to settle before a reader goes on the wall.

Three regimes, depending on where you are licensed

For most UAE businesses the relevant law is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, usually called the PDPL, in force since 2 January 2022. Its scope article excludes, among others, companies and establishments in free zones that have their own data protection legislation. The two that matter for most employers are the financial free zones: the DIFC, with its Data Protection Law (DIFC Law No. 5 of 2020), and ADGM, with its Data Protection Regulations 2021. A company in DMCC or JAFZA is not in that position and works under the PDPL.

One caveat. The PDPL left much of the detail to Executive Regulations, which were due within six months of its issue. As of October 2026 we could not confirm from an official source that they have been published, and secondary sources contradict each other. The obligations in the Decree-Law itself apply regardless; what remains unclear is the detail of thresholds and procedures. Check the UAE Legislation portal before relying on anyone's summary, ours included.

Why biometrics are a separate category

Both main regimes treat biometric data differently from a name or an employee number.

• PDPL. The definition of sensitive personal data includes biometric data, alongside health, religious belief and criminal record. Biometric data means personal data produced by processing a person's physical, physiological or behavioural characteristics in a way that allows them to be identified. Facial images and fingerprints are the obvious examples.
• DIFC. Special categories of personal data include biometric data where it is used to uniquely identify a natural person. An attendance clock does exactly that; identifying the person in front of it is its whole job.

Suppliers often point out that the device stores a mathematical template rather than an image of the fingerprint. That may reduce the security risk. A template that exists to identify someone is still biometric data for these purposes.

What the law expects before you install it

Under the PDPL

Article 21 requires an assessment of the impact of processing on personal data protection before it starts, and processing a large volume of sensitive personal data is one of the cases in which that assessment is mandatory. Sensitive data also appears in the conditions that can require a data protection officer (Article 10). How much counts as a large volume was left to the Executive Regulations, but an employer putting its whole workforce on a biometric clock would be unwise to assume it falls below the line. Employees also have rights over their data, including to have inaccurate data corrected and processing restricted or stopped.

Consent is one lawful basis, and Article 4 lists the cases in which data may be processed without it. Whether any of them covers a biometric clock in your workplace is a question for your legal adviser, not something to assume. Consent is awkward in an employment relationship anyway, because an employee who feels unable to refuse has not really consented.

Under the DIFC Data Protection Law

The DIFC law is more explicit. Article 11(b) allows special-category data to be processed where that is necessary to carry out the obligations and exercise the specific rights of the employer or the employee in the context of employment. Before any high-risk processing, the controller must carry out a data protection impact assessment (Article 20), and high-risk processing is defined to include processing a material amount of special-category data, or a considerable amount of staff data where that is likely to result in a high risk. Employees must be given clear information about the processing when their data is collected (Article 29). Commentators have also reported the DIFC Commissioner's view that consent is unlikely to be a sound basis for employers to rely on.

Location data is personal data too

Biometrics get most of the attention, but GPS check-in raises its own questions. The DIFC law names location data among the identifiers that make a person identifiable, and the PDPL defines personal data just as broadly. Recording where someone is at the moment they check in at a site is one thing. Following their phone all day because the app happens to have location permission is another, and hard to justify for attendance.

If you use location verification, capture it at the moment of the scan, use it only to confirm the employee was at the right site, and keep it only as long as you might need it to settle a question about that record.

The proportionality question

Each regime asks some version of the same question. Is this processing necessary for the purpose, or could the purpose be achieved in a less intrusive way? For attendance the purpose is usually concrete: knowing who arrived when and at which site, and stopping buddy punching. Set the options side by side.

None of these is perfect, and a reasonable employer may still decide that biometrics are justified in a particular setting, a pharmacy store room or a cash office, say. Writing the comparison down pays off because it becomes part of your impact assessment, and that is what a regulator would expect to see.

A practical checklist

• Map the data. What is captured (template, photo, location, device ID), where it is stored, who can see it, and which vendor processes it.
• Identify the regime and the basis. PDPL, DIFC or ADGM, and the lawful basis you rely on, in writing.
• Do the impact assessment before rollout, not after the first complaint.
• Tell employees in a language they understand. In many UAE workforces that means Arabic and English plus the main languages on site, such as Hindi, Urdu, Malayalam or Tagalog.
• Set retention periods. Attendance records may need to be kept for years for labour law purposes, but a biometric template has no reason to outlive the employment relationship.
• Ask where the data is hosted. The PDPL regulates transfers of personal data outside the UAE, and the DIFC and ADGM regimes have their own transfer rules.
• Limit access. A branch manager needs their team's times, not the whole company's location history.

How HelloPDKS approaches this

HelloPDKS does not use biometrics. Employees check in by scanning a QR code with the mobile app, either a printed code or the one shown on a HelloPDKS wall terminal, which changes over time so that a photo of it soon stops working. Location verification is optional. When it is switched on, it confirms the check-in rather than tracking people through the day, and each company can set how long location records are kept. Managers see only their own branch or department. The product was designed around GDPR and KVKK principles, but that does not replace your own PDPL or DIFC assessment: you remain the controller of your employees' data.

The interface is in English and Turkish, so English-speaking HR and operations teams can review the setup directly. If you are weighing a QR-based approach against biometrics, request a demo and ask us the hosting and data-flow questions from the checklist above.