How Filming Permits Work in Dubai: A Guide for Brands
Who applies for a Dubai filming permit, when a script needs clearance and what a brand should prepare before an ad or photo shoot.
Read the articleIn the UAE, a business should assume it needs a person’s consent before photographing them for marketing and before publishing that photo. Two federal laws point the same way. Article 44 of Federal Decree Law No. (34) of 2021 on Countering Rumours and Cybercrimes treats taking or sharing photos of people without consent as an invasion of privacy, and the personal data law, Federal Decree by Law No. (45) of 2021, counts a person’s image as personal data that generally cannot be processed without consent.
The practical answer is a written release that names the uses, kept on file for as long as the photo is live. The detail below explains why, and how it works for staff, customers, events and edited images, as of September 2026.
Key points
- Article 44 covers photographing people in any public or private place without consent, and keeping or sharing electronic photos of them.
- Publishing an image with intent to harm is covered even if the image is true and genuine.
- Editing a photo with the intention of defaming or insulting someone is a separate offence in the same article.
- The PDPL defines personal data to include a person’s image, and treats facial images as biometric data when processed to identify someone.
- Consent under the PDPL must be provable, clear and easy to withdraw.
- Withdrawal does not make earlier use unlawful, but it should stop new use.
What UAE photography law under Article 44 actually says
This part of UAE photography law is headed “Revealing Secrets and Invasion of Privacy”, under Article 44. It applies to anyone who uses an information network, an information system or any information technology tool with the intention of invading the privacy of someone’s private or family life, without consent and outside cases the law authorises. It then lists five kinds of act. Two matter most for marketing:
- taking photos of third parties in any public or private place, or preparing, transferring, disclosing, copying or keeping electronic photos; and
- publishing news, electronic photos, images, scenes, comments, data or information, even if true and genuine, with the intention of harming the person.
The article also covers photos of the injured, the dead and victims of accidents or disasters taken or published without permission, and tracking or disclosing someone’s location data. A closing paragraph adds a separate offence for using technology to modify or process a record, photo or scene with the intention of defaming or insulting another person. The article sets out imprisonment and fines for each.
Two words deserve attention. “Intention” means the law is aimed at deliberate intrusion, not an accidental blur in the background. “Consent” is the way out of the first limb entirely. A business cannot control how a court would read intention in a particular case, but it can control whether it holds consent. That is why the safe habit is to get it.
Why UAE photography law treats a photo as personal data
UAE photography law overlaps with data law here. The PDPL’s Article 1 defines personal data as any data relating to an identified or identifiable natural person, and it names image and voice among the identifying elements. It treats biometric data, which it illustrates with facial images, as sensitive personal data. A recognisable face in an advert, a testimonial video with a customer’s voice, or a team photo with names attached all fall inside that definition.
Article 4 opens with a plain rule: processing personal data without the owner’s consent is prohibited, followed by a closed list of exceptions. Several exceptions exist for things like performing a contract, legal claims, public health and employment obligations. Marketing use of someone’s photo does not sit comfortably in any of them, so for campaigns, consent is the practical basis.
Article 5 adds controls that matter after the shoot: data must be collected for a specific and clear purpose, limited to what is necessary, kept securely, and not kept after the purpose is exhausted. A folder of unused portraits from three campaigns ago is a liability, not an asset.
Scope has limits. Article 2 excludes a person processing data for personal purposes, and companies in free zones that have their own data protection legislation. If your business is in one of those zones, its own law applies to that part of the question.
Consent that holds up under UAE photography law
UAE photography law relies on this consent test. Article 6 of the PDPL sets three conditions for consent to count. The controller must be able to prove it. It must be clear, simple, unambiguous and easily accessible, in writing or electronically. And it must include the person’s right to withdraw it easily. The person may withdraw at any time, and withdrawal does not affect the lawfulness of processing that happened before.
Translated into a release form for a marketing shoot, that means:
- The person’s name, the date and the shoot or event it relates to
- Plain wording of each use: organic social posts, paid adverts, website, print, marketplace listings
- Whether their name or job title will appear alongside the image
- How long you intend to use the images, or how you will review that
- A named contact and a simple way to withdraw, such as an email address
- Arabic and English versions, so the person understands what they sign
- For anyone under 18, signature by a parent or guardian
If you cannot show the consent, treat it as if you never had it.
Staff, customers, crowds and reposted content
UAE photography law treats the same principles differently depending on who is in the frame.
| Who appears | Where businesses slip | Safer practice |
|---|---|---|
| Your employees | Assuming the employment contract covers marketing photos | A separate, optional release; the PDPL’s employment exception is framed around legal obligations, not promotion |
| Customers in your venue | Shooting “atmosphere” with identifiable diners, patients or shoppers | Ask before they are in frame, or compose so no one is recognisable |
| Attendees at your event | Relying on a notice alone for close ups used in adverts | Notice for general coverage, individual releases for featured people |
| A customer’s own post about you | Screenshotting it into a paid ad because it was public | Ask the person in writing; a public post is not permission for a new purpose |
| Influencers and hired models | Leaving usage to a chat message | A contract naming platforms, territories and duration |
UAE photography law makes the reposting row catch many brands. Article 4 does allow processing of data that “has become available and known to all by an act of the Data Subject”, but taking someone’s personal photo into a paid campaign is a different purpose from the one they posted for. A short written request is quick and removes the argument.
Location permissions are a separate layer. The Dubai Film and TV Commission includes photography among the formats that need a permit on government operated and private locations, which our guide on how filming permits work in Dubai explains.
Editing, retouching and AI changes to people
UAE photography law covers editing too. Retouching skin or removing a stray reflection is routine. The legal risk starts when an edit changes what a person appears to say, do or endorse. The closing paragraph of Article 44 applies to modifying or processing a photo or scene with the intention of defaming or insulting someone, and that wording does not depend on which software made the change.
- Do not composite a real person into a scene, product or message they did not agree to.
- Do not alter expressions, gestures or clothing in a way that could embarrass the person.
- Keep the original files so you can show what was changed.
- Make the release cover retouching and cropping explicitly, and say that meaning will not be changed.
If an image features a person generated entirely by AI rather than a real individual, disclose that where the platform asks for it. Amazon, for example, now requires a metadata tag on photorealistic AI generated people in product images, which our product listing checklist for noon and Amazon.ae covers.
When someone withdraws consent
UAE photography law makes withdrawal the scenario teams rarely plan for. Under Article 6, a person can withdraw at any time. Under Article 15, they can ask for their personal data to be erased when consent is withdrawn, subject to exceptions set out in the law. Article 6 also confirms that what you did before withdrawal remains lawful.
- Log the request with the date and the images concerned.
- Stop new use at once: pause adverts, remove the image from scheduled posts and from templates.
- Update live assets you control: website pages, marketplace images, email templates.
- Record what cannot be recalled, such as brochures already distributed, and do not reprint them.
- Erase or archive the files according to the request, and confirm to the person in writing.
UAE photography law rewards a tidy asset library, which makes this a short job. Tag every photo with the release it depends on, so you can find all uses of one person quickly.
This article summarises the text of Federal Decree Law No. (34) of 2021 and Federal Decree by Law No. (45) of 2021 as published on the UAE legislation portal, where the Arabic text prevails. It is general information as of September 2026, not legal advice. For a specific campaign, particularly involving children, health settings or sensitive data, speak to a UAE qualified lawyer.
How Digital Marketing Dubai can help
UAE photography law shapes how we plan a shoot: we build consent in rather than chasing it after a shoot, who will appear, which releases are needed, how Arabic and English forms are worded for your uses, and how images are tagged for later withdrawal requests. We do not provide legal advice, and release templates should be reviewed by your lawyer.
Planned content shoots are covered by social media photography, and campaigns built on filmed people by commercial videography. If creators are involved, see influencer marketing. Everything visual sits on the media production services hub, and consent for email lists is covered in our post on email marketing consent under the UAE data protection law.
