Call Recording Laws in the UAE: What Contact Centres Must Know

Call recording laws in the UAE sit at the meeting point of two regimes: the TDRA governs the telecommunications channel a contact centre uses, and the UAE PDPL (Federal Decree-Law 45/2021) governs the recording itself as personal data. A compliant recording needs a lawful basis, clear disclosure and disciplined retention.

• Recording is personal data: a voice recording is processing of personal data under the UAE PDPL — Federal Decree-Law 45/2021 — so PDPL principles apply. Source: u.ae.
• Telecom regulator: the TDRA (Telecommunications and Digital Government Regulatory Authority) oversees the telecommunications services and channels contact centres run on.
• Consent is one lawful basis, not the only one: where consent is used it must be freely given, specific and demonstrable; other lawful grounds the PDPL recognises may also apply.
• Financial conduct overlay: for banks, the CBUAE Consumer Protection Regulation (Circular 8/2020) adds disclosure and fair-treatment duties on recorded calls.
• Free-zone overlays: the DIFC applies Data Protection Law No. 5 of 2020 and the ADGM its Data Protection Regulations 2021 for firms based in those zones.

Contact centres in the UAE record calls in an environment few other markets share. The customer base is majority-expatriate and multilingual, so a single queue may switch between Arabic and English within one shift, and the notice that a call is recorded has to be understood by both. Financial callers are often tied to salary-transfer lending and the Wage Protection System (WPS), so a recorded servicing or collections call can hold unusually sensitive detail. Add a split between onshore mainland entities and DIFC or ADGM booking centres, and a recording captured in one place may fall under a different regime than a colleague's two desks away. That mix — bilingual disclosure, sensitive financial context and overlapping jurisdictions — is why call recording laws in the UAE deserve a careful read.

What are the call recording laws in the UAE?

There is no single "call recording act" in the UAE. Instead, two frameworks combine on every recorded call. The first is telecommunications regulation: the TDRA licenses and oversees the telecommunications services, numbers and channels a contact centre operates on, and its rules shape how voice services and marketing communications may be used. The second is data-protection law: the UAE PDPL (Federal Decree-Law 45/2021), administered by the UAE Data Office, treats a recording as processing of personal data and therefore requires a lawful basis, transparency and respect for data-subject rights.

For regulated sectors, a third layer applies on top. A bank's recorded calls also engage the CBUAE Consumer Protection Regulation (Circular 8/2020), while insurers and telecom operators carry their own sector conduct expectations. The practical takeaway: "may we record this call?" is never answered by one rulebook alone.

Do you need consent to record a call in the UAE?

Not always, but you always need a lawful basis and clear disclosure. Under the UAE PDPL, consent is one lawful ground for processing personal data, but the law recognises others — for example, processing necessary to perform a contract to which the customer is a party. A servicing or collections recording tied to a customer's own active agreement may rest on contractual necessity rather than fresh consent, whereas a recording used for a purely promotional purpose is far more likely to need consent and to engage the TDRA's expectations on marketing communications.

Whatever the basis, transparency is non-negotiable: the customer should be told at the start of the call that it is being recorded and why. Where consent is the chosen basis, it must be freely given, specific, informed and withdrawable, and the controller must be able to demonstrate it. Silence or a pre-ticked box does not meet that standard.

What must a recording disclosure say?

A defensible disclosure is short but complete. It identifies who is calling, states that the call is being recorded, gives the purpose in plain terms, and — where relevant — signals how the customer can exercise their rights. Because the customer base is bilingual, it should be available in Arabic and English and delivered before any personal data is discussed.

For contact centres using AI voice agents, one more element matters: the customer should understand they are speaking with an automated system, consistent with UAE PDPL transparency principles and the CBUAE's February 2026 guidance on the use of AI and machine learning by licensed financial institutions.

How long can you keep call recordings in the UAE?

The UAE PDPL builds on purpose limitation and storage limitation, so recordings should be kept only as long as needed for the stated purpose and then securely deleted. There is no universal figure that fits every recording; retention should be tied to why the call was recorded — quality monitoring, dispute evidence, or a regulatory record — and to any sector-specific record-keeping duty the organisation is subject to.

Two disciplines follow. First, security: recordings hold personal and often financial data, so access should be restricted, logged and protected in line with the PDPL's security expectations. Second, cross-border transfer: if recordings are stored or processed outside the UAE, the PDPL's transfer rules apply, which matters when a contact centre uses cloud infrastructure or an offshore quality-assurance team.

Do the DIFC and ADGM change call recording rules?

Yes, where the customer relationship sits inside a financial free zone. Firms based in the DIFC follow DIFC Data Protection Law No. 5 of 2020; firms in the ADGM follow the ADGM Data Protection Regulations 2021. The mainland UAE PDPL does not apply inside those zones. A group that books some customers onshore and others in a free zone may therefore record the same type of call under two regimes at once.

The practical rule is to map each recorded queue to the entity that owns the relationship, then apply that entity's regime — rather than assuming one recording policy covers all three.

What extra rules apply to financial-services contact centres?

Banks and finance companies carry a conduct overlay on recorded calls. The CBUAE Consumer Protection Regulation (Circular 8/2020) and its Standards require fair treatment, honest disclosure and no coercive collection pressure, and those duties apply to the recorded interaction just as much as the recording itself. Where a recorded call feeds an automated decision that materially affects a customer, the CBUAE's 2026 AI/ML guidance reinforces human oversight and explainability, and DIFC DPL Article 10 sets specific conditions for decisions based solely on autonomous processing. For collections specifically, calling-time policies should follow the UAE working week — the weekend is Saturday–Sunday.

How AI helps: turning recordings into compliance evidence

Recording a call is easy; proving that every recorded call met its disclosure, conduct and retention duties across thousands of interactions is the hard part. This is the practical case for call intelligence. YuCI analyses recorded calls at scale to check that the recording disclosure was given, flag conduct risks such as coercive language on collections calls, and surface where scripts drifted from policy — so a contact centre can evidence compliance rather than hope for it. The qualitative outcome teams value: consistent quality assurance across the full call volume, with an auditable trail regulators and internal audit expect, instead of spot-checking a small sample by hand.

FAQ

Do I have to tell customers a call is being recorded in the UAE? Yes. Transparency is central to the UAE PDPL, so a defensible practice tells the customer at the start of the call that it is being recorded and why, in a language they understand, before any personal data is discussed.

Is consent always required to record a call in the UAE? No. Consent is one lawful basis under the UAE PDPL, but a recording tied to a customer's own contract may rest on another ground such as contractual necessity. Promotional recordings are more likely to need consent. Confirm the basis per purpose.

Which regulator governs call recording in the UAE? Two apply together. The TDRA oversees the telecommunications channel the contact centre uses, and the UAE PDPL — administered by the UAE Data Office — governs the recording as personal data. For banks, the CBUAE adds conduct duties.

How long can a contact centre keep call recordings? Only as long as needed for the stated purpose, in line with the UAE PDPL's storage-limitation principle, then securely deleted. There is no single fixed period; retention should match the recording's purpose and any sector record-keeping duty.

Do the DIFC and ADGM have different call recording rules? Yes. Firms based in the DIFC follow Data Protection Law No. 5 of 2020 and those in the ADGM follow the Data Protection Regulations 2021. The mainland UAE PDPL does not apply inside those free zones.

Can call recordings be stored outside the UAE? Potentially, but the UAE PDPL's cross-border transfer rules apply, so a contact centre using offshore cloud storage or an overseas quality-assurance team must ensure the transfer meets those requirements.

Setting up a compliant contact centre in the UAE? Start with the essentials on the YuVerse UAE hub, or read our explainer on UAE PDPL consent rules for AI calling.

This is a general explainer, not legal advice.

References

• UAE Government — UAE Personal Data Protection Law (Federal Decree-Law 45/2021): https://u.ae/
• TDRA — Telecommunications and Digital Government Regulatory Authority: https://tdra.gov.ae/
• CBUAE Rulebook — Consumer Protection Regulation (Circular 8/2020): https://rulebook.centralbank.ae/en/rulebook/consumer-protection-regulation
• CBUAE Rulebook — Consumer Protection Standards: https://rulebook.centralbank.ae/en/rulebook/consumer-protection-standards
• DIFC — Data Protection Law No. 5 of 2020 (Article 10, autonomous decision-making): https://www.difc.com/