Applicant Privacy Notice Template for the United Arab Emirates

When your organization recruits employees in the United Arab Emirates, you must provide job applicants with clear information about how you collect, use, and protect their personal data. An Applicant Privacy Notice is your legal obligation under UAE Federal Decree-Law No. 45 of 2021, ensuring candidates understand your data handling practices before they submit their applications.

When do you need this document?

You need an Applicant Privacy Notice whenever you collect personal data from job candidates through any recruitment channel. This includes posting job advertisements online, receiving CV submissions via email, conducting interviews, performing background checks, or requesting references from previous employers. The notice must be provided before or at the point of data collection, whether candidates apply through your company website, recruitment agencies, job boards, or in-person interviews. Organizations operating in UAE free zones like DIFC or ADGM may need to comply with additional specific regulations alongside federal requirements.

Key legal considerations

Your privacy notice must clearly identify the types of personal data you collect, including contact information, employment history, educational qualifications, references, and any sensitive data like health information for medical examinations. You must specify the legal basis for processing under UAE law, typically legitimate interest for recruitment purposes or contractual necessity for employment. The document should outline data retention periods, explaining how long you keep unsuccessful applicants' data versus successful hires' information. You must also detail data sharing practices, including transfers to background check providers, recruitment agencies, or international offices, ensuring appropriate safeguards are in place for cross-border transfers.

Legal requirements in United Arab Emirates

Under UAE Federal Decree-Law No. 45 of 2021, you must obtain clear consent for data processing where required and provide applicants with specific rights including access to their data, correction of inaccuracies, and deletion requests where legally permissible. Your notice must be written in clear, understandable language and be easily accessible to all applicants. Organizations in DIFC must also comply with DIFC Data Protection Law No. 5 of 2020, which follows GDPR-style requirements for lawful basis, data minimization, and enhanced individual rights. ADGM entities must adhere to ADGM Data Protection Regulations 2021 with similar stringent requirements. The notice should specify your data protection officer contact details and explain how applicants can lodge complaints with relevant UAE authorities if they believe their data has been mishandled during the recruitment process.