What is considered sensitive personal data under the UAE PDPL?

The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) distinguishes ordinary personal data from special categories that carry heightened protection because misuse can cause greater harm. These sensitive categories generally include data revealing a person's racial or ethnic origin, religious or philosophical beliefs, political opinions, criminal record, health and genetic data, biometric data used to identify a person, and data concerning sex life. The law also gives particular attention to the personal data of children. Processing these categories typically requires stronger justification and safeguards than processing routine information such as a name or email address, and businesses are expected to apply appropriate technical and organisational security measures. If your organisation handles health, biometric or other sensitive data, you should map where it sits, limit access, document your lawful basis, and confirm the exact requirements and any conditions in the law's Executive Regulations and with the UAE Data Office. Mishandling sensitive data exposes a business to enforcement and complaints. For a compliance review tailored to your sector, you can browse verified UAE legal professionals on LEXAI.