Saudi Arabia and the UAE side by side
| Saudi PDPL | UAE federal PDPL | |
|---|---|---|
| Status | In force since September 2023, enforceable since 14 September 2024 | In force since January 2022. Executive Regulations not yet issued |
| Lawful basis for biometric data | Explicit consent in most cases. Legitimate interest cannot be used for sensitive data | Consent, or an exception such as obligations under employment law |
| Assessments and registration | Impact assessment required for sensitive data. Registration with SDAIA may be required | Impact assessment for high-risk processing, including large volumes of sensitive data |
| Transfers abroad | Adequacy, SDAIA’s standard contractual clauses or set exceptions, with a risk assessment for continuous or large-scale sensitive data | No adequacy list published yet, so transfers rely on contractual safeguards or explicit consent |
| Regulator | Saudi Data and AI Authority (SDAIA) | Emirates Data Office, now part of the Federal Authority for AI and Data created in June 2026 |
Proposed Saudi storage rule. SDAIA consulted from 6 October to 5 November 2026 on amendments that would require controllers to store personal data within the Kingdom, with transfers abroad still permitted under the PDPL. The proposal is not yet in force and may change before adoption.
The DIFC and ADGM free zones
The federal PDPL does not apply in the Dubai International Financial Centre or Abu Dhabi Global Market. Companies registered there follow DIFC Law No. 5 of 2020 or the ADGM Data Protection Regulations 2021, both modelled closely on the GDPR. Each treats biometric data used for identification as special-category data, which needs an additional legal basis, and the ADGM requires an “appropriate policy document” from employers relying on employment law for that basis. Other GCC states have their own data protection rules, which this page does not cover.
Fines and penalties
| Regime | Maximum penalty |
|---|---|
| Saudi PDPL | A warning or up to SAR 5 million per violation, doubled for repeat offences. Disclosing sensitive data to cause harm or for gain carries up to two years in prison or SAR 3 million |
| UAE federal PDPL | To be set by Cabinet decision, not yet published |
| DIFC | Administrative fines of USD 10,000 to 100,000 per contravention, with no defined cap for serious breaches |
| ADGM | Up to USD 28 million |
Before you enrol the first employee
- Confirm which regime applies. Companies registered in the DIFC or ADGM follow the free-zone rules, not the federal PDPL.
- Complete an impact assessment before go-live, and in Saudi Arabia check whether you must register with SDAIA or appoint a DPO.
- Obtain and record consent with a notice in Arabic and English, and offer a non-biometric alternative to anyone who declines.
- Decide where the data will be stored, taking account of transfer rules and the proposed Saudi storage requirement.
- Prepare a breach-response plan that can notify SDAIA within 72 hours.
Free templates: Download the free consent-form and retention-policy templates →
How NCheck supports it
As the employer, you are the controller, so the decision on which basis to rely on rests with you. NCheck provides controls that help you meet your obligations.
- On-premises deployment on servers in Saudi Arabia or the UAE keeps biometric data in-country.
- Encrypted, non-reversible templates, and event photos deleted automatically after a period you set.
- RFID or manual check-in as an alternative for anyone who declines biometrics.
- Deletion tools and an audit trail to support your retention limits.
Using NCheck Cloud for staff in Saudi Arabia or the UAE can involve a transfer abroad under either law. NCheck On-Premises, run on servers in the country, avoids the transfer and would also meet the proposed Saudi storage rule if it is adopted. More on data residency and biometric data.
Common in these industries
Construction · Oil & gas · Hospitality · all industries
Frequently asked questions
Which laws apply in the Gulf?
Saudi Arabia’s Personal Data Protection Law and the UAE’s federal PDPL cover most employers, while companies registered in the DIFC or ADGM follow those free zones’ own rules. All four treat biometric data as sensitive or special-category data.
Is consent required from employees?
In Saudi Arabia, explicit consent is the usual basis, since legitimate interest cannot be used for sensitive data. The UAE law also allows processing needed to meet employment-law obligations. In both countries, recorded consent with a non-biometric alternative is the cautious route.
Can biometric data leave the country?
Yes, under conditions. Saudi Arabia allows transfers with adequacy, standard contractual clauses or set exceptions, and is consulting on a rule that would require personal data to be stored in the Kingdom. The UAE has not yet published a list of adequate countries, so transfers rely on contractual safeguards or explicit consent. NCheck On-Premises keeps data on your own servers in either country.
Are there fines in the UAE yet?
Under the federal PDPL, the penalty schedule awaits a Cabinet decision that has not been published. The DIFC and ADGM regimes are separate and can already impose fines, up to USD 28 million in the ADGM.
This page is general guidance, not legal advice. Laws change; confirm current requirements with your counsel.
Deploy it the compliant way
Run NCheck fully on your own server — data never leaves your network — or in NCheck Cloud. Either way, matching uses encrypted templates, and event photos can be deleted automatically after a period you set. About on-premises → · Security & compliance →