Candidate data under the UAE data law: a recruiter's guide

The law and who it covers

The UAE government portal describes Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, the Personal Data Protection Law (PDPL), as coming into force on 2 January 2022 and applying to the processing of personal data, in full or in part through electronic systems, inside or outside the country.^[1] The official Arabic text, as reported by the law firm Clyde & Co, extends it to controllers and processors in the UAE and to those abroad that process the data of people in the UAE.^[2][3]

A recruitment agency or an in-house recruiting team is a controller of the CVs and notes it collects, deciding what is collected and why. A system supplier that stores them on the recruiter's behalf is typically a processor. That is the vocabulary of the law, and the next sections follow it.

Consent and its exceptions

The portal says the law prohibits processing without the consent of its owner, except in some cases.^[1] The official text lists those cases, including performing a contract with the data subject, meeting obligations under other UAE laws, employment or social security obligations, legal claims and the public interest. It requires consent to be clear, simple and unambiguous, provable by the controller and open to withdrawal at any time.^[2][3]

Clyde & Co notes that there is no general legitimate interests basis of the kind found in the European GDPR, and reads the law as requiring consent, with opt-out mechanisms, for marketing use.^[3] The sources reviewed do not settle whether handling an application falls within the contract exception or needs consent, and they do not address recruitment specifically. That is a question for a UAE data protection lawyer.

The practical design point holds either way. Applying for a job and being kept on file for future roles are different purposes. A system that records consent separately for each purpose, with a date, and that lets the person withdraw it, is easier to defend than one that relies on a single tick box at registration.

Rights candidates may exercise

The portal says the law gives the data owner the right to request correction of inaccurate personal data and to restrict or stop processing it.^[1] The official text, summarised in similar terms by Clyde & Co, sets out a wider list: to receive information from a controller, to obtain data and have it transferred to another controller, to have data corrected or erased in defined cases, to restrict processing in certain cases, to object to processing for direct marketing or statistical surveys, and to object to decisions from automated processing that have legal or serious effects.^[2][3]

For a recruiter these map to ordinary requests: a candidate asks what is held, asks for a copy, asks for a correction or asks for removal. The last item, objecting to automated decisions with serious effects, matters if software ranks or filters applicants. This guide found no source that says how the provision applies to automated screening, so the question belongs with a lawyer.

On notices, the official text requires only limited information before processing: the purposes, the sectors or establishments inside or outside the UAE with which the data will be shared, and the safeguards for cross-border processing. More detail is provided on request, and controllers must give individuals clear means of contacting them and exercising their rights.^[2][3]

What controllers and processors must do

The official text requires processors to act on the controller's instructions and under contracts that set the scope and purpose of processing. Controllers and processors must keep a record of personal data, controllers must carry out an impact assessment before using modern technologies that pose a high risk to privacy, processing must be limited to what is necessary for its purpose, and a data protection officer must be appointed in certain circumstances.^[2][3]

In recruiting this means a written agreement with any system supplier or outsourced screening provider, a list of what is held and why, and a decision about who answers a candidate's request. Whether an organisation falls within the circumstances that require a data protection officer is a legal question the sources do not resolve.

Breaches and transfers abroad

The official text requires a controller that learns of a breach affecting the privacy, confidentiality and security of personal data to report it to the UAE Data Office and to notify affected individuals, within a period and under procedures set by the executive regulations. Processors must tell the controller immediately.^[2][3] Because the regulations set the period, no deadline can be stated from the sources reviewed.

Cross-border transfers matter to any recruiter whose system, agency partner or screening tool sits outside the UAE. Under the official text data may be transferred abroad in cases approved by the UAE Data Office, such as where the destination has data protection legislation covering the key safeguards. Without adequate protection, transfers may rest on grounds such as a contract or the data subject's express consent where that does not conflict with UAE public and security interests. Clyde & Co said in 2021 that it was unclear how adequacy would be assessed.^[2][3] Ask each supplier in writing where data is stored and processed.

What was still unsettled in 2026

The law required the Cabinet to issue executive regulations within six months of its issue, and gives controllers and processors six months from those regulations to comply.^[2] DLA Piper's country summary, dated January 2025, said the regulations had not yet been published, and the Chambers 2026 practice guide, dated 10 March 2026, said they had yet to be issued.^[4][5] Some compliance-vendor pages in 2026 assert that they were issued, but those pages cite instrument numbers that contradict each other and none could be matched to a published text. Check the UAE legislation portal or ask a lawyer before relying on either claim.

The law itself does not set penalty amounts and leaves violations and administrative penalties to a Cabinet decision.^[3] Figures quoted in commentary are not repeated here.

The regulator is also in transition. The government announced in June 2026 the Federal Authority for Artificial Intelligence and Data, which brings together the AI Office, the digital-government work of the telecommunications regulator and the Data Office. As of early September 2026, this review found no published output from the new Authority on the data protection law.^[8][9] The obligations in the Decree-Law apply meanwhile; what is unsettled is the detail that the regulations were meant to supply.

DIFC and ADGM

The federal law excludes companies in free zones that have their own data protection legislation. The DIFC has the Data Protection Law, DIFC Law No. 5 of 2020, and its Commissioner is responsible for supervising and enforcing it.^[6] ADGM announced its Data Protection Regulations 2021 on 14 February 2021, with an independent Office of Data Protection headed by a Commissioner.^[7] A recruiter established in one of those zones, or processing for a client there, falls under a different law for that processing. None of the sources reviewed addresses recruitment in these zones specifically.

Keeping, deleting and the placement record

No source reviewed sets a retention period for unsuccessful candidates under UAE law. This guide therefore gives no figure, and the right period for an organisation is a decision to make with advice, write down and have the system enforce.

A recruiting business has a tension to manage. A candidate may ask for their data to be erased, while the business may need to keep the invoice, the placement fee record and the tax trail. One practical approach is to remove the name, contact details and CV content and keep only the financial record. A flag that hides a record but keeps it is not the same as erasure, and a system should be tested on whether an erasure reaches notes, attachments, email history and backups.

Questions for a supplier or agency

• Where is our data stored and processed, and who are the sub-processors?
• How is consent recorded: per person and purpose, with a date and a way to withdraw?
• How long do you keep each type of data, and does the system enforce it?
• Can you export and erase one person's data, including notes and attachments?
• Who accessed what, and when? Is there an access log?
• Do we receive a written data-processing agreement naming each party's role?
• What is your plan if there is a breach, and how quickly will you tell us?
• What happens to our data when we leave?

These are prompts, not legal requirements. The Works ATS, which The Works Group sells and which is in build, will hold candidate data, and the same questions should be put to us as to any supplier.^[10] This guide describes the law and does not advise on it.

Questions