Federal Decree-Law No. 45 of 2021 establishes the framework for the lawful processing of personal data in the UAE. The law is administered by the UAE Data Office, which issues guidance and resolves matters within the federal jurisdiction. Free zones with their own data protection regimes — the Dubai International Financial Centre and the Abu Dhabi Global Market in particular — operate under their own laws, which run in parallel and which apply where the relevant data processing falls within their jurisdictional scope. For tenancies within the emirates and outside the financial free zones, the federal law is the governing instrument.
This desk processes personal data in a screen on the basis of the data subject’s consent. Whether any further basis is available for a given component, and on what terms, is confirmed against the current law for that case rather than assumed. Consent is the primary basis for the most personal categories of data processed in a screen — the credit score, the employment particulars, the prior landlord references — and is the basis the screen architecture is built around.
Consent under the law is informed, specific, freely given, and capable of being withdrawn. The screen procures consent on this footing: the tenant is informed of what is being processed and why, the consent is sought per-component rather than as a blanket authorisation, the consent is given through clear affirmative action rather than implied, and the tenant retains rights under the law including the right to withdraw consent and to have data deleted in the circumstances the law provides. Deletion at the end of this desk’s stated retention period is its own policy, applied in addition to those rights.
The law identifies categories of sensitive personal data that attract heightened protection; the categories, and the safeguards that apply to them, are as set out in the law and its implementing provisions. A standard tenant screen at this desk is designed not to process special-category data. Where any element of a proposed screen would involve special-category data, the legal basis must be re-examined and additional safeguards put in place; in most ordinary screens this question does not arise.
Personal data may be held only for as long as the purpose of the processing requires. For tenant screening, this means that the data underlying a screen is held for the period during which the screen serves the tenancy decision and the early period of the tenancy where reference to the file may legitimately arise. This desk retains screen data for twelve months from the date of issue. That is its own stated policy for this processing purpose rather than a statutory screening period, and any longer retention would need a specific lawful basis.
At the end of the retention period, the personal data is removed from active systems. Where the screening party retains records for the purpose of demonstrating that the screen occurred and that consents were properly obtained — that is, audit records rather than the substantive data itself — these may be retained for a longer period appropriate to the legal and regulatory framework. The distinction between substantive data and audit metadata is material and is part of any well-constructed retention policy.
The tenant, as data subject, has rights under the law. The rights include: the right to be informed about the processing; the right to access the personal data held about them; the right to have inaccurate data corrected; the right to have data deleted in the circumstances the law provides, such as where the lawful basis for processing has lapsed; the right to object to processing in defined circumstances; the right to data portability where the data has been provided by the data subject. The screening party is obliged to honour these rights, with the procedural channels for exercising them stated plainly to the tenant.
A party conducting tenant screening processes personal data and is therefore a controller, or in some arrangements a processor, under the law. The obligations include: lawful basis for each processing activity, transparency to the data subject, accuracy, retention discipline, security of the data held, and the prompt handling of data subject requests. Where the screening party processes data on behalf of a landlord, the legal relationship between the landlord and the screening party should be documented in a written instrument reflecting the law’s requirements for controller-processor relationships.
Where any element of the screen involves transfer of personal data outside the UAE — for instance, where a sanctions check uses an international database — the transfer is governed by the rules for cross-border transfers under the law. The conditions on which such a transfer may lawfully be made are set out in the law and its implementing provisions, and are confirmed for the specific arrangement rather than assumed. Cross-border arrangements should be assessed and documented.
This page sets out the framework. It does not constitute legal advice in relation to any specific arrangement. Parties conducting tenant screening at scale, or in any arrangement of complexity, should obtain advice on their specific facts. The summary on this page is intended to be accurate and useful as a foundation; it does not substitute for the work of counsel on a specific implementation.
Related pages: UAE PASS consent, the limits of screening, glossary.