Is AI interviewing legal in the UAE?

The short answer

No UAE law bans AI interviews. Employers in the UAE can use AI to interview and assess candidates, but the personal data involved, including voice, video, answers and scores, is covered by data protection law. The main rules are about telling candidates what happens, having a lawful basis, letting people object to decisions made by automated processing, and moving data abroad safely.

Which law applies depends on where the employer is. Most of the UAE is covered by the federal Personal Data Protection Law. Companies in the DIFC and ADGM financial free zones have their own data protection laws, with their own rules on automated decisions.

This guide is general information, not legal advice. Laws and their implementing rules change, so take advice on your own situation.

The federal law: PDPL

The UAE Personal Data Protection Law is Federal Decree-Law No. 45 of 2021. It was issued on 20 September 2021 and came into force on 2 January 2022. It applies to personal data of people who live or work in the UAE, and to controllers and processors inside the UAE, as well as those outside it that process the data of people in the UAE.

It does not apply to some categories, including government data, health and banking data covered by their own laws, and companies in free zones that have their own data protection legislation (Article 2).

The law leaves several details, such as breach-notification deadlines and transfer controls, to Executive Regulations. When we checked the official UAE legislation portal on 13 October 2026, we could not find those regulations published, nor a Cabinet decision setting the PDPL's penalties. The law gives organisations six months to comply once the regulations are issued. Even so, the law itself is in force, and building to it now is sensible.

Consent and other lawful bases

Under Article 4, personal data may not be processed without the person's consent, unless one of the listed exceptions applies. The exceptions relevant to hiring include meeting obligations or exercising rights under employment law, steps the person asks for before entering a contract, and obligations under other UAE laws. There is no general “legitimate interests” basis like the one in European law.

Where consent is used, Article 6 says it must be clear, simple and unambiguous, the controller must be able to prove it, and the person must be able to withdraw it easily. For AI interviews, the safest approach is a clear consent screen before the interview starts.

Telling candidates what happens

Article 13 gives people the right to information about how their data is processed, including decisions made based on automated processing, including profiling. Before processing starts, the controller must tell them the purposes, who the data is shared with, and the safeguards for any transfer abroad.

For an AI interview, that means telling the candidate, before they begin, that the interviewer is AI, what is recorded, how answers are scored, who sees the results, how long data is kept and where it is processed.

The right to object to automated decisions

Article 18 gives people the right to object to decisions based on automated processing, including profiling, particularly where those decisions have legal effects or seriously affect them. The law defines automated processing to include systems that are only partly automated, with limited human supervision.

There are exceptions: where the automated processing is agreed in a contract with the person, required by another UAE law, or covered by their prior consent. Even then, the controller must protect the person's privacy, and must include a human element in reviewing an automated decision if the person asks.

For hiring, the practical point is simple: a candidate should be able to ask for a person to review any decision an AI influenced, and someone should actually do it.

Impact assessments and data protection officers

Article 21 requires a data protection impact assessment before processing that uses modern technologies with a high risk to privacy, and specifically for systematic and comprehensive automated assessment of personal aspects, including profiling, that has legal or similarly serious effects. Article 10 requires a data protection officer in similar high-risk cases. An employer screening many candidates with AI should assume these may apply and do the assessment.

Sending data outside the UAE

AI interview tools often store or process data in other countries. Under Article 22, data may go to countries that have a data protection law and a regulator, in cases approved by the UAE's data regulator. Otherwise, Article 23 allows transfers in listed cases, including a contract that imposes the same obligations as the PDPL, or the person's express consent where this does not conflict with public or security interests. Ask any vendor where data is stored, which providers process it and on what basis it moves.

DIFC: automated decisions and AI systems

Companies in the Dubai International Financial Centre follow DIFC Data Protection Law No. 5 of 2020. Article 38 gives people the right to object to decisions based solely on automated processing, including profiling, that have legal or seriously impactful effects, and to ask for a manual review. Where such decisions rest on a contract or explicit consent, safeguards including manual review are required.

DIFC also has specific rules for AI. Regulation 10 of the DIFC Data Protection Regulations, in force since 1 September 2023, covers personal data processed through autonomous and semi-autonomous systems. It requires clear notice when a person first uses such a system, describing its purposes, its outputs and how they are used, and the safeguards in its design, and it sets principles of being ethical, fair, transparent, secure and accountable. In June 2026 DIFC consulted on changes to Regulation 10. Check the DIFC Commissioner's latest version before relying on any detail.

ADGM: the right not to be decided by a machine

Companies in Abu Dhabi Global Market follow the ADGM Data Protection Regulations 2021. Section 20 gives people the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects, unless it is necessary for a contract, based on explicit consent or authorised by law. In the contract and consent cases, the person must be able to get human intervention, give their view and contest the decision.

ADGM's own guidance uses a fully automated recruitment aptitude test as an example of automated processing, and says a human review must be meaningful, with the authority to change the result. Transfers outside ADGM are covered by sections 40 to 46.

AI ethics guidance

The UAE Charter for the Development and Use of Artificial Intelligence, approved by the UAE Cabinet in June 2024, sets out priorities including human oversight, transparency and avoiding algorithmic bias. It is a policy document rather than a law with penalties, but it shows what the government expects of AI used on people.

What employers should do in practice

• Work out which law applies: the federal PDPL, the DIFC law or the ADGM regulations
• Tell candidates before the interview that it is run by AI, what is recorded, how it is scored, who sees it and how long it is kept
• Get clear consent before the interview starts, and keep a record of it
• Keep a person responsible for every hiring decision, and record the reason
• Give candidates an easy way to object to automated processing or ask for a human review, and respond quickly
• Do a data protection impact assessment before rolling AI interviews out at scale
• Ask vendors where data is stored and processed, which providers they use, and how long data is kept
• Give every candidate for a role the same questions and rubric, and check outcomes across groups for unfair patterns

How Octrahire handles this

Octrahire's AI interviewers say they are AI at the start of every interview. Candidates see what is recorded and agree before they begin. The AI never hires or rejects anyone: a person makes every decision and must record a reason. Candidates can ask for a person to review their interview, or object to automated processing, from their application page, and the employer must respond within 2 working days.

Data is hosted on AWS in Mumbai, India, and some AI providers process it in other countries; interview sessions are deleted after 90 days. Octrahire follows the UAE PDPL and India's Digital Personal Data Protection Act, 2023.