It’s usual for employers to want to seek assurances that a candidate is who they say they are and that they have the right skills. But there are strict rules about background checks in the UAE. To avoid fines, breaking the law, and hurting your reputation, it’s important to know what you can and can’t do.
Background checks are permitted in the UAE if they’re job-related, consent-based, and PDPL-compliant, and if you avoid protected traits under the Labour Law. Use official criminal and education channels, treat health/credit/criminal data as sensitive, and never retain passports.
Why this matters now
- The UAE’s modern privacy regime (PDPL) and strong equality rules reshape how screening is done. Get the process right, and you cut time-to-hire while staying audit-ready.
What’s allowed in a UAE background check
In the UAE, certain types of background checks are legally permitted, giving employers a way to confirm a candidate’s identity and credentials without breaching the law.
You can:
- Identity/right-to-work verification (passport/visa/Emirates ID). Verify, don’t retain passports.
- Criminal record checks through MOI/Dubai Police (Police Clearance Certificate), when relevant to the role or regulator.
- Education & licensing verification via MOFA attestation and MoE Certificate of Equivalency where required.
- Employment history & references (notice + minimisation under PDPL).
- Credit checks (cautious use): rely on candidate-provided AECB reports if role-relevant; AECB access is purpose-bound.
- Drug/alcohol testing where job-justified (e.g., safety-sensitive), with consent and PDPL safeguards.
While employers have the right to protect their business interests, there are clear limits on what they may request from candidates.
You can’t:
- Retain passports. It’s a prohibited practice, verify identity without taking custody. Build SOPs that physically prevent retention.
- Collect or act on protected characteristics. Article 4 of the Labour Law bans discrimination based on race, colour, sex, religion, national or social origin, or disability, design criteria and thresholds accordingly.
- Mix up medicals. Don’t impose employer-run general medical checks; use role-specific tests only with consent and clear relevance. Visa medicals are separate.
- Transfer candidate data abroad without a mechanism. If your screening vendor hosts data outside the UAE (or in a free zone), implement PDPL-compliant transfer grounds.
PDPL in practice: four controls your HR team needs
The UAE’s Personal Data Protection Law (PDPL), introduced in 2021, is the country’s first comprehensive privacy framework and it reshaped how employers handle candidate information. For background checks, this means you can’t just collect and store whatever data you like—you must prove that every step is lawful, transparent, and secure. The law places particular emphasis on sensitive data such as health, criminal records, and biometrics, and it requires employers to justify collection, safeguard processing, and manage cross-border transfers with care. In short, PDPL turns background screening from an administrative task into a regulated compliance process that HR teams must actively manage.
- Transparent notice & lawful basis
Give candidates a recruitment privacy notice explaining what you collect, why, who will see it, how long you keep it, and where it’s stored/processed. Use consent where required and document it; otherwise assess contract/legal obligation bases. - Sensitive-data handling
Treat criminal, health, biometrics/genetics as sensitive. Limit access, encrypt at rest, and segregate from the general HRIS. - Data minimisation & retention
Collect the least data needed, keep it only as long as required for hiring decisions, and delete securely. Keep records of processing and breach procedures. - Cross-border transfers
Confirm your vendor’s hosting and sub-processors. Implement adequacy or other PDPL transfer mechanisms before exporting candidate data.
DIFC & ADGM: When free-zone rules apply
Hiring rules in the UAE differ depending on whether an employee is based in the mainland or in one of the country’s free zones. Employment governed by DIFC or ADGM? Expect EU-style data-protection obligations and “special category” treatment for criminal/health data. That often means:
- Explicit consent, DPIAs for high-risk processing, and controller registrations/notifications where applicable.
- Contractual clauses for transfers, security, and audit rights from screening vendors.
A role-based, compliant screening matrix (example)
- Finance leadership / signatory authority: identity, employment history, references, police clearance, candidate-provided AECB report, education attestation/equivalency.
- Education (Dubai private schools): identity, police clearance, education attestation/equivalency; follow KHDA recruitment standards.
- Site HSE roles: identity, police clearance (where policy-based), references; drug/alcohol testing per policy.
Tip: Align every check to a documented risk in the job description. If you can’t explain the link in one sentence, don’t collect the data.
Step-by-step: running a UAE-compliant background check
- Scope: map checks to role risk (job-related only).
- Notice & consent: issue your privacy notice; capture specific consent where used (e.g., criminal/credit).
- Official routes first: MOI PCC, MoE/MOFA for education; log receipt in your ATS.
- Minimise & secure: store results encrypted; restrict access to decision-makers only; track retention dates.
- Adverse action: when results are relevant and negative, document the job link, rule out protected traits, and provide the candidate an opportunity to explain.
Onboarding guardrails: no passport retention; PDPL data map updated; vendor contracts include transfer/security terms.
How Auxilium simplifies the process
As an Employer of Record with deep GCC coverage, Auxilium provides compliant UAE specific hiring solutions. Clients get one platform, one local team, and zero entity setup, with end-of-service (gratuity) obligations handled the right way.
If you’re hiring in the UAE, Auxilium’s Employer of Record solution takes care of payroll, visa processing, background-check workflows, and end-of-service—so your leaders can focus on revenue, not red tape.
Talk to Auxilium to deploy teams in days, not months. Book a free consultation to build a compliant UAE hiring plan today.
