United Arab Emirates: passenger data record
- Data protection law
- Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, issued 20 September 2021, in force 2 January 2022 1
- Data protection authority
- UAE Data Office, set up by Federal Decree-Law No. 44 of 2021 and affiliated with the Cabinet 3
- Agency that receives API/PNR
- Not published by a UAE authority. Gulf News named the GCAA, GDRFA Dubai, the Ministry of Interior and Dubai Police in connection with the API system in 2018 7
- API/PNR status
- API live at Dubai and Abu Dhabi airports, as reported on 15 September 2018 7. PNR not confirmed 7
- Biometric collection at entry
- Yes for registered smart gate users. GDRFA Dubai gates use face and iris recognition, per a 22 February 2021 release 5
- Date checked
- 21 October 2026
Federal personal data law
Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data was issued on 20 September 2021 and published in Official Gazette No. 712 (supplement) on 26 September 2021 1. It took effect on 2 January 2022 1. The legislation portal says the Arabic text prevails in case of conflict 1.
Article 2 sets the scope. The law applies to data subjects in the UAE, to controllers and processors in the UAE, and to controllers and processors abroad that process data of people in the UAE 2. It does not apply to government data, to government entities that control or process personal data, or to personal data held by security and judicial authorities 2. Health data and banking and credit data with their own legislation are excluded, as are free zone companies with their own data protection legislation 2.
Article 9 requires controllers to notify the regulator of breaches that would prejudice privacy, confidentiality or security, and to notify affected data subjects 2. Articles 13 to 18 set rights to information, portability, correction, erasure, restriction, objection and review of automated decisions 2. Article 22 permits transfers abroad to countries with adequate data protection legislation, and Article 23 lists other grounds such as contract, explicit consent and international judicial cooperation 2. Article 28 says the Council of Ministers issues executive regulations within six months of promulgation 2.
UAE Data Office
The government portal u.ae says Federal Decree-Law No. 44 of 2021 set up the UAE Data Office, affiliated with the UAE Cabinet, to act as the federal data regulator 3. Its listed tasks are preparing data protection policies and legislation, approving standards for monitoring the personal data law, preparing systems for complaints and grievances, and issuing guidelines 3. The page lists the DIFC Data Protection Law, DIFC Law No. 5 of 2020, for the Dubai International Financial Centre 3.
Under the decree-law, the regulator receives complaints (Article 24), breach reports (Article 9) and grievances against its own decisions (Article 25) 2.
Border agencies: ICP and GDRFA Dubai
The Federal Authority for Identity, Citizenship, Customs and Port Security (ICP) began on 29 September 2004 as the Emirates Identity Authority under Federal Law No. (2) of 2004 4. Federal Decree-Law No. (3) of 2017 renamed it and moved nationality, passport and foreigner entry and residence duties to it from the Ministry of Interior 4. ICP says it registers the population's personal and biometric data, issues Emirates ID cards and sets entry permit rules for foreigners 4. Its overview page does not mention API or PNR 4.
The General Directorate of Residency and Foreigners Affairs in Dubai (GDRFA Dubai) runs passport control at Dubai airports 6.
Smart gates and facial recognition
On 22 February 2021 GDRFA Dubai announced a fast-track passport control service using face and iris recognition 6. The Dubai Media Office said the biometric systems were deployed at 122 smart gates at arrival and departure terminals in Dubai airports 5. Departing passengers need a boarding pass and must pre-register to use the service 5,6.
The two official releases give different processing times. GDRFA Dubai said passengers finish passport control in five seconds 6. The Dubai Media Office said five to nine seconds, depending on the passenger's movement 5. Neither release names a technology supplier or states what biometric data is kept or for how long 5,6.
Advance passenger information
Gulf News reporter Razmig Bedirian reported on 15 September 2018 that the Advance Passenger Information System, in operation in the UAE since 2014, was fully implemented and operational at Dubai and Abu Dhabi airports, citing Laila Ali Bin Hareb Al Muhairi of the GCAA 7. The report said the system cross-checks travellers against a unified database before boarding and returns a Board, No Board or Probation result 7. It drew on passport data, online booking and reservation systems and a global distribution system 7. The report named the GCAA, GDRFA Dubai, the Ministry of Interior and Dubai Police 7. No vendor was named 7.
No UAE authority page checked for this record states which agency holds PNR data or how long passenger data is kept 3,4.
Chronology
| Date | Event |
|---|---|
| 29 September 2004 | Emirates Identity Authority set up, later renamed ICP 4 |
| 2017 | Federal Decree-Law No. (3) of 2017 moves passport and entry duties to the authority 4 |
| 15 September 2018 | Gulf News reports API system fully operational at Dubai and Abu Dhabi airports 7 |
| 22 February 2021 | GDRFA Dubai announces face and iris smart gate service 5,6 |
| 20 September 2021 | Federal Decree-Law No. 45 of 2021 issued 1 |
| 2 January 2022 | Personal data law takes effect 1,3 |
Common questions
Does the UAE data protection law cover border agencies?
Article 2 of Federal Decree-Law No. 45 of 2021 excludes government data, government entities that process personal data, and data held by security and judicial authorities 2.
Who regulates personal data in the UAE?
The UAE Data Office, set up by Federal Decree-Law No. 44 of 2021, acts as the federal data regulator 3.
What biometrics do Dubai smart gates use?
Face and iris recognition, per GDRFA Dubai's 22 February 2021 announcement 6.
Does the UAE use advance passenger information?
Gulf News reported in September 2018, citing a GCAA official, that the system was fully operational at Dubai and Abu Dhabi airports 7.
Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email hello@passengerdataexplained.org with the official link.
Sources
- UAE Legislation portal: Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data (20 September 2021)
- UAE Legislation portal: Federal Decree by Law No. (45) of 2021, full text download (20 September 2021)
- UAE Government portal u.ae: Data protection laws (updated 4 December 2025)
- Federal Authority for Identity, Citizenship, Customs and Port Security: Overview (updated 17 February 2026)
- Dubai Media Office: GDRFA launches smart gate in DXB (22 February 2021)
- GDRFA Dubai: New fast-track passport control service uses face and iris-recognition technologies (22 February 2021)
- Gulf News: New airport system assesses passenger risk factor, by Razmig Bedirian (updated 15 September 2018)
Related
- Advance Passenger Information (API) explained
What API data is, which fields airlines send, who receives it, the legal basis, how long it is kept, and examples from four jurisdictions.
- Facial recognition gates at airports
How border e-gates match a traveller's face to a passport or a stored gallery, what images are kept, who runs the gates and where they are used.
- Interactive API and board or no-board decisions
How interactive Advance Passenger Information lets border authorities answer board or no-board at check-in, with US, Canadian and UK examples.
- Biometric data at borders
Which fingerprints and facial images border agencies collect from travellers, the legal basis, who holds the records and how long they are kept.
- Who oversees passenger data
The bodies that check how governments use API and PNR data: data protection authorities, data protection officers, courts and UN standards.