Employee monitoring law · United Arab Emirates
Three regimes in one country. Onshore, DIFC and ADGM each have their own rules.
Identify which regime you are in first, onshore, DIFC and ADGM diverge on almost everything.
- Region
- Middle East & Africa
- Instruments
- 3 governing
- Employer duties
- 3 listed
- Last reviewed
- August 22, 2026
United Arab Emirates · what the law requires
Notice and proportionality
The UAE is not one jurisdiction for this purpose. Onshore, the Federal Personal Data Protection Law applies. The DIFC and ADGM financial free zones have their own data protection laws, both closer to the GDPR, with DIFC Law No. 5 of 2020 including provisions on high-risk processing and, distinctively, on data-sharing transparency. Where your employees sit determines which applies, and a single group can be subject to all three.
- Identify which regime binds each employeeOnshore, DIFC and ADGM are separate. A group with staff in more than one must satisfy each.
- Assessment for high-risk processingThe free-zone laws require a DPIA for high-risk processing, and systematic employee monitoring reaches that threshold.
- Transparent notice and lawful basisA documented basis and clear information to employees across all three regimes.
- Proof Ledger
- Outcomes
- Certificates
- Audit log
- Data access
- Disputes
- Data egress
- Export
- What We See
- Controls
- AKAria K. viewed screenshotsLena M. · 3 capturesScreen capturemacOS · London09:42a91f…4c023d7b…91ee
- JMJon M. exported time reportDesign team · CSVmacOS · Berlin09:313d7b…91ee77c5…0ba4
- SDSara D. opened capture reviewRavi P. · one flagged frameWindows · Manchester09:1877c5…0ba4e208…5f13
- wm_live_7f2… read /v1/deliverablesScoped key · read onlyPublic API · allowlisted IP08:57e208…5f13b64a…2d90
- LMLena M. viewed her own recordWhat We SeemacOS · London08:44b64a…2d901cf9…8e77
- AKAria K. changed capture policyBlur set to alwaysmacOS · London08:261cf9…8e7705d2…ae31
The instruments, and which control answers each duty
- Federal Personal Data Protection Law: Federal Decree-Law No. 45 of 2021. The onshore regime: lawful bases, data subject rights, and controller obligations.
- DIFC Data Protection Law: DIFC Law No. 5 of 2020. GDPR-aligned, with a Commissioner of Data Protection, DPIA duties for high-risk processing and notification requirements.
- ADGM Data Protection Regulations: ADGM Data Protection Regulations 2021. The Abu Dhabi Global Market regime, also GDPR-aligned.
No product does this part
What you must still do yourself
Compliance is a property of your deployment. These are the steps in United Arab Emirates that no vendor can complete on your behalf, and skipping them is what turns a rollout into a finding.
- 1Map employees to onshore, DIFC or ADGM and apply the right regime to each.
- 2Complete the DPIA the free-zone laws require.
- 3Take local advice. This is a jurisdiction where the structure of your entity changes the answer.
- If you get it wrongAdministrative fines under the Federal law and the free-zone regimes, with DIFC able to issue directions and fines through its Commissioner.
Verify the claim
Every control above, on the page that describes it
- Capture policies scoped per team and entityRun different policies for different entities without separate systems
- Published control inventory with source referencesSupport the DPIA with a documented control set
- Per-person self-view plus the read-only v1 REST APIServe data subject rights across entities
Sources and review date
Last reviewed August 22, 2026This is a summary of how employee-monitoring rules generally work in this jurisdiction, written to help you scope a rollout and brief your own advisers. It is not legal advice, it is not a substitute for it, and law changes. Verify against the primary sources listed and take local counsel before you deploy.
Nearby jurisdictions
Monitoring law elsewhere in Middle East & Africa
- South AfricaPOPIA plus RICA, and RICA makes unlawful interception a criminal offence.
- PolandThe Labour Code lists the permitted purposes, and productivity is not one of them.
- United KingdomThe ICO's 2023 monitoring guidance is the operative document, and it expects a DPIA.
- IrelandThe DPC accepts a legitimate business interest, and then tests proportionality hard.
- DenmarkSix weeks' notice under the collective agreement framework, and a strict purpose test.
- United States (federal)Federal law is permissive; the real constraints are state law and the NLRA.
Point it at one team for a week.
Create the account, put the agent on a handful of desks, and leave it alone. On Friday you read the week instead of reconstructing it: hours against their projects, focus and idle per person, and the timesheets already filled in.
Free for two seats. No card, and no sales call to sit through.