This is the document most often missing from an otherwise complete data protection set. A UAE employer holds passport and visa copies, Emirates ID, **medical fitness results**, health insurance data, bank details and WPS records — much of it sensitive — and employees are rarely told any of it.
Employee Privacy Notice
How we handle your personal data
This is the document most often missing from an otherwise complete data protection set. A UAE employer holds passport and visa copies, Emirates ID, medical fitness results, health insurance data, bank details and WPS records — much of it sensitive — and employees are rarely told any of it.
| Item | Detail |
|---|---|
| Employer | [COMPANY NAME], [licence] [NUMBER] |
| Applicable regime | [Federal PDPL / DIFC / ADGM] |
| Regulator | [UAE Data Office / DIFC Commissioner / ADGM Office of Data Protection] |
| Contact for questions | [NAME], [EMAIL], [PHONE] |
| Data Protection Officer | [NAME / not appointed] |
| Issued to | All employees, at onboarding and on material change |
| Languages available | [LIST] |
| Version and date | [NUMBER], [DATE] |
This notice explains what personal information we hold about you, why we hold it, who we share it with and what rights you have. It is not part of your contract, and we will update it if what we do changes.
1. What We Hold
| Category | Examples | Sensitive? |
|---|---|---|
| Identity and contact | Name, date of birth, nationality, address, phone, personal email, emergency contact | |
| Immigration and identity documents | Passport copy, visa, Emirates ID, work permit, labour card | |
| Employment record | Contract, job title, salary, appraisals, warnings, leave, attendance | |
| Payroll and financial | Bank details, WPS records, gratuity accrual, [GPSSA where applicable] | |
| Health | Medical fitness test results, health insurance enrolment and claims, sick leave certificates, workplace injury records | Yes |
| Family | Dependants where sponsored or insured | [Some] |
| Systems and access | Login records, device assignment, building access | |
| [CCTV] | Images at the premises | |
| [Background checks] | Qualifications, references, [criminal record where lawfully required] | [Some] |
1.1Employers frequently believe they hold no sensitive data. Medical fitness testing is mandatory for a residence visa, health insurance is mandatory, and both generate health data about every employee.
2. Why We Hold It
5 more pages in the Word file
This is page 1 of the Word document, exactly as it appears when you open it. Fields shown like THIS are placeholders for you to complete.
These notes accompany the template and explain the drafting choices, the compliance points and the mistakes most often made with this document. They appear as a final page in the Word file, intended to be deleted before the document is executed.
Organisations write a customer privacy notice and appoint a DPO, then never tell employees anything. The employment relationship generates more sensitive data than most customer relationships, and it is the one where the individual has least power to object.
Medical fitness testing is required for a residence visa and health insurance is mandatory, so every UAE employer processes health data about every employee. Employers routinely conclude they hold nothing sensitive. They do, from day one.
Consent given by an employee to their employer is rarely freely given, because refusing has obvious consequences. Use contract and legal obligation for the processing you must do, and reserve consent for genuinely optional things.
Legitimate interests is available under DIFC and ADGM; the federal regime leans more heavily on consent and other bases. A notice copied from a European or DIFC template and applied to a mainland entity claims bases it cannot rely on.
Employees whose residence depends on their employment are reluctant to make requests of their employer. A notice that does not address that plainly will not be used, and the absence of requests will be mistaken for satisfaction.
A notice circulated in English to a workforce reading Hindi, Urdu, Tagalog, Malayalam or Arabic has been distributed, not communicated. Translate it and record which language each person received.
MOHRE or the zone authority, immigration, the bank for WPS, the health insurer, the medical testing centre, and GPSSA where applicable. Employees are entitled to know their data goes to these bodies, and the list is longer than most notices admit.
Enrolment and claims processing means the insurer sees medical information about your staff. That is a disclosure of sensitive data and it belongs in the notice, with a processing agreement behind it.
The most common weakness is not external sharing but internal access — whole teams able to see payroll, medical results and disciplinary records because permissions were never narrowed. Access should be role-based and logged.
Using a mainland payroll bureau, bank or insurer means transferring employee data out of the financial free zone, and the mainland is not on the DIFC adequacy list. This affects almost every DIFC employer and is almost never documented.
Payroll and tax records need seven years; health data should be held for less and with tighter access; unsuccessful applicant records rarely need years. Blank or indefinite retention advertises that the obligation is not being met.
System monitoring, building access records and CCTV are all processing of employee data. Disclose them here and in the IT policy. Covert monitoring without a clear basis is a breach and destroys trust when discovered.
The notice belongs in the first-week pack with the contract, handbook and IP assignment. Issuing it years into employment invites the question of what was happening before.
A new HR platform, payroll provider, insurer or group reporting arrangement changes who receives the data. The notice drifts out of date silently — tie the review to system changes as well as an annual date.
Reflects UAE, DIFC and ADGM positions current as of {{DATE OF USE}}. **The status of the federal PDPL Executive Regulations is reported inconsistently and bears on response periods and rights.** Retention requirements, transfer rules and regulator contacts change — confirm with the relevant regulator or a UAE data protection adviser.
This is a ready-to-use template provided for convenience. Laws and requirements change, and every situation is different — please have it reviewed by a qualified professional (a lawyer, corporate secretary, or accountant as relevant) before you rely on it.