- Before sending the employee file, establish the applicable legal regime, the purpose, the data actually needed, each party's role and where processing takes place.
- Review the contract, permissions, security, retention, how employee requests and incidents are handled, and the exit plan.
- Using a provider does not automatically transfer all of the organisation's responsibilities to it, and compliance is reviewed periodically, not just on the day of signing.
This article is for professional awareness and is not legal advice or an opinion on the compliance of any particular platform.
Which law applies to the organisation’s data?
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data is a core reference, but its scope and exemptions matter as much as its obligations. Do not assume that every organisation in the UAE is subject to it in the same way; special provisions or other frameworks may apply depending on the organisation, the sector and the zone. Settle this question before copying a data processing agreement template from the internet. [1]
For example, the Dubai International Financial Centre has its own data protection law, Law No. 5 of 2020 as amended, overseen by its own authority. Review the current version and guidance where it applies, and do not confuse it with the federal law or with the requirements of other zones. This article sets out review questions; it does not provide a complete map of every exemption or regime in the country. [2, 3]
Why will the provider receive this particular data?
Write down the purpose for each set of data: calculating pay, managing leave, issuing documents, or another specific function. Then ask what is the minimum needed to achieve it. Do not send the complete HR file because the provider asked for “everything you have”; some attachments or details may not be needed for the agreed service. The legal basis for processing is reviewed according to the case and the applicable regime. [1]
Do not assume that consent is the only answer for every employment-related processing, or that an employee signing a general clause permits any later use. What happens must be explained appropriately, with the basis, purpose, rights and relevant procedures defined. If the provider wants to use the data to improve its product or analyse it for its own purposes, that needs a separate review and must not be hidden inside a vague technical description of the service.
Who is the controller, who is the processor, and why does it matter?
Roles depend on who decides the purpose and means of processing and on what each party actually does, not only on the label chosen in the contract. A payroll provider may process data on the organisation’s instructions, but other services or additional purposes may need a different analysis. So map the data flows and decisions before fixing the legal description in the agreement. [1, 3]
Ask: Who chooses the data required? Who sets the retention period? Can the provider use the data for its own purposes? Does it use another party? Who handles an employee’s request? These practical questions help the specialist define the roles. Being described as a processor does not mean a party has no obligations, and having a processor does not mean the controller can ignore what happens to the data once it is sent.
What should the contract cover?
It should address the scope of the service, the purpose, the data categories, instructions, duration, security measures and confidentiality, along with arrangements for ending the service and returning or deleting data as required. Review the terms for using sub-processors, help with requests and incidents, and evidence that obligations are being met. The federal law sets out processor obligations relating to purpose, duration, protection, records and more; these need to be turned into workable arrangements. [1]
Do not settle for a clause saying “both parties shall comply with the law” if it does not say who does what in an incident or when the contract ends. Equally, do not copy a long list of terms that neither the organisation nor the supplier can apply. Ask for suitable evidence, discuss exceptions with specialists, then document the decision and the remaining risks. This is a suggested contract review model, not a ready-made clause that replaces legal advice.
Where will the data be processed, and who can access it?
Review hosting, backups, technical support and sub-processors, since data may be processed in places other than the main server. Access from outside the country may raise questions about cross-border transfer or processing under the applicable regime. A local office address does not prove that the data stays in the country, and it should not be assumed that every transfer is either banned or freely allowed. [1, 2]
Ask for a clear statement of the data flow, then decide who in the organisation has authority to send, review, edit and export. Use the minimum necessary permissions, and review the accounts of leavers, administrators and support staff. You can test a branch manager’s account to make sure it cannot see other branches’ data without need. This is a suggested operational test; on its own it does not prove the platform is compliant or replace a security assessment.
How do you test the service without exposing real files unnecessarily?
Start with synthetic data for the pilot where it is enough to test calculations and workflows, and check that fields and attachments do not contain real information by mistake. If a particular test needs real data, review the purpose, permissions and controls before using it. Do not move the full file into an open test environment and leave protection until after launch.
Test corrections, ending the service, exporting records and deleting accounts, not just payroll calculation. The core function may work while a correction request or a data export fails when you change provider. Also review export files, emails and notifications, because they can expose data outside the main screen that was tested. Documenting these results helps accept the service on a clear basis.
What happens after a misdirected file or an incident?
Set up a route for internal reporting, assessment, containment and communication with the supplier and specialists. If a file is sent to the wrong recipient, asking them to delete it does not necessarily close the matter; review the nature of the data, the recipients, what happened to it and the applicable obligations. No single employee should decide to notify everyone, or no one, without involving the people named in the plan.
Notification requirements and their details vary with the legal framework and the facts, so this article does not give a single deadline for all UAE organisations. Refer to the current legislation and decisions, the legal specialist, or the data protection officer where that role applies. The organisation keeps a record of the decision, its reasons and the actions taken, so the response can be reviewed and improved once the event is over.
What does a hypothetical UAE case look like?
A hypothetical company wants to move to a new payroll provider. The export file includes attachments that payroll does not need, and the contract does not say where the service is supported from. The team stops the transfer of those attachments, asks for the data flow to be explained and the processing scope amended, then tests the payroll service with suitable data. This is an awareness case, and it does not conclude that earlier sharing was unlawful without examining the facts and the law.
After launch, the company reviews user permissions, data quality, leaver procedures and retention. When the contract ends, it follows a defined exit plan instead of leaving files in abandoned accounts. This approach brings together legal, HR, IT and procurement, because any single team may see one part of the process and miss another that affects the protection of employees.
How do you check the transfer file before sending it?
Match the fields to the purpose, and check for hidden columns, extra sheets, comments and attachments. The file may contain information added for a different need. Then check the recipient, the channel, the permissions and the version required. This operational checklist reduces errors; it does not replace a review of the legal basis.
Record what was transferred, to whom, when and for what purpose, in line with policy and without creating unnecessary extra copies. If the service changes, review the description, the contract and the data rather than widening the transfer automatically. Name one person to answer employees’ questions, so answers are not scattered between the supplier, HR and IT.
At periodic reviews, ask what has changed since the contract was signed: hosting, sub-processors, analytics features or permissions. Compliance is not a snapshot of the signing date. Documenting changes helps protection continue and makes moving to another provider more orderly. The exit plan should also match technical reality: the export file format, the time available, who checks the data is complete, and how remaining copies are handled. These operational details stop the end of a contract turning into the loss of records you need, or the continuation of processing that no longer has a legitimate purpose.
Frequently asked questions
Is the employee's consent in the employment contract enough for every use?
That cannot be assumed. Purposes, legal bases, requirements and rights are reviewed under the applicable law, especially when a use is added that was not part of the original service.
Is a confidentiality agreement enough on its own?
It may be important, but it does not necessarily cover the details of processing, permissions, retention, transfers and incidents. Review the required obligations and document them in a way that suits the service.
Does hosting inside the country settle compliance?
Not on its own. Review support, access, backups, purposes, permissions and the other obligations, as well as where processing actually takes place.
Can all files be deleted when an employee leaves?
Do not make a blanket decision without reviewing retention periods, obligations and legitimate purposes. Distinguish what must be kept from what no longer serves a purpose, in line with policy and law.
What is the first document I should ask the provider for?
Ask for a description of the data flow, roles, locations and sub-processors, then link it to the draft contract, the security measures and the exit plan before sending any employee files.
References
Recommended programmes
