Crowded public walkway at dusk, every figure distant or from behind, seen past a foreground pillar

Consent and Privacy Law When Filming in Dubai

A crew that has worked in London, Berlin or New York carries an assumption into Dubai: that people in a public place have no reasonable expectation of privacy, so a wide shot of a street is just a wide shot of a street. UAE law-firm analyses of the country's cybercrime law say there is no blanket public-place exception.

This guide is for the producer or marketing lead planning a shoot with people in frame. It covers what the privacy provision is described as reaching, what the penalties are, what a court has said about criminal intent, why images of identifiable people are also personal data, and the consent plan that follows from all of it.

The one line to hold onto

There are three permissions, not one. Permission to be in the place, which is the film permit. Permission to film the people, which is consent. Ownership of the resulting film, which is the rights clause. Holding one does not give you the others.

Filming people in Dubai starts with consent, not with the location permit

Watch out

Important

This article describes how UAE law firms and regional media describe the position. The statutory text of the decree was not retrieved for this piece, so nothing below should be read as the wording of the law itself. The exposure here is criminal rather than administrative, which is a good reason to take proper advice on your own shoot rather than relying on any article, including this one.

The three permissions are worth separating before anything else, because most productions hold one and assume all three. The permit says you may be in the location. It says nothing about the people who happen to be there. The rights clause says who owns the film afterwards, which is a third question again, and the Journal covers both of those elsewhere.

This article is about the middle one, and it is the one with criminal exposure attached.

The UAE law firm BSA Law, writing on Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes, describes Article 44 as reaching the taking of photographs of others in any public or private place, and states that no blanket public-place exception exists. That is the sentence that breaks the imported instinct, and it is worth reading twice before a crew is briefed.

1 · To be in the place

The film permit, plus any venue or organiser layer. It says where you may set up. It says nothing about who is in frame.

2 · To film the people

Consent, recorded. The permission with criminal exposure attached, and the subject of this article.

3 · To own the film

The rights clause, which under UAE law has to state the right, the object, the duration and the place of use.

What the privacy provision reaches

BSA Law sets out five methods of privacy infringement covered by Article 44, using information networks or electronic systems.

Recording or disclosing conversations, communications, or audio or visual material. Taking photographs of others in any public or private place, and preparing, transmitting, revealing, copying or retaining electronic images. Publishing photographs or information with intent to harm the person, even where the material is true. Photographing the injured, the deceased or victims of accidents or disasters, and transmitting or publishing them without authorisation. And monitoring or disclosing another person's geographic location data.

The verbs in the second limb are the part a production needs to notice. Preparing, copying and retaining sit alongside transmitting and publishing. Read that way, the exposure is not limited to what goes out. Rushes are retained images, and an archive is a retained archive.

The accident and disaster limb deserves its own line for anyone filming in public. It is described as specifically criminal to photograph the injured or the deceased and transmit or publish those images without authorisation, which is worth briefing to any crew that might find itself near an incident with a camera already running.

Regional media described the position in the same terms when the law came into force, with Khaleej Times and Gulf News both reporting fines of up to AED 500,000 for taking photographs of people without consent.

Watch out

Warning

Everything in this section is how two UAE law firms and two regional outlets describe the provision, and they agree with each other. The decree's own text was not retrieved for this article, so treat none of the phrasing here as a quotation from the instrument. If a shoot turns on the precise scope, read the decree or take advice on it rather than working from a description.

The penalties, and the intent question

Two findings run in opposite directions here, and both belong in a producer's head at the same time.

On exposure, the law firms describe a basic violation carrying imprisonment of not less than six months and a fine between AED 150,000 and AED 500,000. Where images have been altered, the reported band rises to imprisonment of not less than one year and a fine between AED 250,000 and AED 500,000.

On liability, the UAE firm Al Suwaidi reports a judgment holding that criminal liability under Article 44 requires both the prohibited act and criminal intent, and that the absence of intent to violate privacy or misuse an image defeats prosecution even where the photographing occurred. The facts matter to how far that travels. The accused had photographed someone engaged in potentially unlawful conduct, had not shared or circulated the image, and had retained it solely to document suspected wrongdoing. BSA makes the same point from the other side, that malicious intent is negated where a person believes they are fulfilling a legal duty such as reporting a crime.

Neither firm identifies an exemption for professional photographers or production companies.

The honest reading sits between the two. Intent is a real element, and it is why an ordinary commercial shoot with a legitimate purpose is not what this provision is aimed at. It is also not a plan. A production that expects to argue about intent has already found itself in the argument it should have avoided, and by then the shoot is finished, the client is waiting, and the answer costs money either way.

As reported by UAE law firms · not quoted from the decree

Criminal, not administrative

6 months
Minimum, basic violation
With a fine reported between AED 150,000 and AED 500,000.
1 year
Minimum, altered images
With a fine reported between AED 250,000 and AED 500,000.

A court has separately held that criminal intent is a required element alongside the act. That is a limit on the provision, not a production plan.

The second regime: images as personal data

There is a separate law running alongside, and most productions have never been briefed on it.

Advisory analyses of Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, in force since 2 January 2022, describe personal data as including a picture or voice by which a natural person can be identified directly or indirectly, treat a facial image as biometric data, and set out that processing requires the data subject's consent outside listed exceptions.

Two regimes, two different questions. The privacy provision asks whether someone's privacy was infringed. The data regime asks whether identifiable personal data is being processed lawfully, and processing includes storage rather than only publication.

The practical consequence is about paperwork rather than philosophy. A release is not only permission to publish. It is part of the record that the processing was consented to, which makes the release archive as important as the release itself, and makes both of them things that need to survive the campaign that prompted them.

Good to know

Info

These personal-data points come from advisory summaries rather than from the primary text, and how the two regimes interact for crowd or background footage was not resolved in this research. Where a shoot involves significant crowd coverage, that gap is worth closing with proper advice rather than with an assumption.

People who are already covered by something else

Some of the people in front of a camera sit inside a further regime, and each has its own rules.

In a DHA-licensed facility, written consent must be obtained and documented from any individual whose pictures, images, videos or statements are used, and that consent is limited to the subject it was requested for and the period it was granted for. The facility is also liable for all content filmed within its premises, however it was captured, which extends the problem to staff and visitors as well as patients. The Journal covers the clinic position in its own articles.

Performers are different again. Where a performer agrees to the audiovisual fixation of their performance, the exclusive economic rights to license that fixed performance transfer to the producer unless otherwise agreed in writing, while performers' moral rights remain perpetual and unassignable. That sits in the copyright decree-law and the Journal covers it separately.

Which produces the synthesis worth carrying: a single person on camera can sit inside three regimes at once, privacy, data protection and performers' rights. One release, drafted properly, does the work of all three. A verbal nod on a busy set does none of it.

Crew silhouettes on set at dusk

Consent works when the first assistant and the location manager hold it, not when the producer remembers it at lunch.

The consent plan

Clear the space rather than clearing the people. A closed set, a cordoned area or a private location removes the problem instead of managing it, and it is usually cheaper than the alternative once the cost of managing is counted honestly.

Where a space cannot be closed, control the frame. This is counter-intuitive for most crews: a long lens that isolates one person across a plaza creates more exposure, not less, while a wide composition that reduces faces to unidentifiable scale creates less. The instinct to grab the beautiful telephoto shot of a stranger is the instinct to manage.

Capture releases on set, at the moment of filming, with a name, a date, a scope and a signature. A release chased afterwards is a person chased afterwards, and they have no reason to reply.

Children need parental or guardian consent, and the verifiable parental consent standard used in the healthcare rules is a reasonable benchmark for any production.

Budget a blur pass as a normal post task. Planned into the schedule it is inexpensive. Two days before a launch, with a client waiting and an edit locked, it is not.

Keep the release archive with the footage archive. The retention question outlives the campaign, and so should the paperwork.

And the point in-house teams most often miss: staff and third parties on a client's own premises are individuals for consent purposes, exactly as members of the public are. Employment does not imply consent to appear in an advertisement.

Plan for the person who says no, because someone will. The workable answer is prepared in advance rather than negotiated on the day: a second setup that does not include them, a repositioned camera, or a note to the editor. A crew that treats a refusal as an obstacle creates a scene. A crew that treats it as a normal production variable moves on in thirty seconds, which is also the version that protects the client's name in a building they have to keep working in.

Plan for the person who changes their mind afterwards too. It happens most often with staff who have since left, and it is far easier to honour a withdrawal when the releases are indexed against shot numbers and the footage is still online. That is an archiving decision made months earlier, not a favour anyone can do at short notice.

Watch out

Warning

Two honest limits belong here. Whether a filmed crowd notice, of the kind posted at the entrance to a controlled area on European productions, is recognised in UAE practice as establishing consent was not established in this research. Treat the notice as sensible practice paired with a person at the entrance, not as a legal mechanism. And how the provision treats incidental background presence in a commercial film, as distinct from photography aimed at an individual, was also not established. The practical answer where that is in doubt is to reduce identifiability in camera and blur in post.

What this changes on a shoot day

Decide the consent position at the recce rather than on the day. The recce is where a location either can be controlled or cannot, and that is a scheduling decision as much as a legal one.

Give it an owner. Consent works when the first assistant and the location manager hold it, not when the producer remembers it at lunch. Releases travel in the same folder as the call sheet, because a form nobody can find is a form nobody uses.

Aerial work deserves its own line, because a drone changes what is in frame without anyone on the ground noticing. A camera at altitude sees balconies, private terraces, pool decks and neighbouring buildings that no location agreement covers and no release was ever collected for. The aerial permit answers the airspace question and nothing else. The framing question stays with the production, and the answer is usually a tighter flight path, a different time of day, or an orbit that keeps the neighbours out of the shot rather than a discussion afterwards about whether anyone was identifiable.

Grolez Films plans consent as a production department rather than as a form signed at the end. Cleared spaces where the treatment allows, controlled frames where it does not, releases captured on the day with the scope written on them, a blur pass in the post schedule, and an archive that stays with the footage rather than in somebody's inbox.

The alternative is familiar enough. A crew that treats consent as paperwork for later spends the edit chasing signatures, or spends the night before a launch blurring faces. The film usually survives that. The launch date sometimes does not.

Common questions

Can we film people in a public place in Dubai without asking?

Not on the assumption that a public place makes it permissible. The analyses of Article 44 of Federal Decree-Law No. 34 of 2021 are consistent that there is no blanket public-place exception, and that the provision reaches both public and private settings where privacy is infringed without consent. Consent is the operative permission, with circumstances legally permitted as the alternative.

Guests are in the background of our hotel film. Is that a problem?

How Article 44 applies to incidental background presence, as distinct from targeted photography of an individual, was not established by this research. The sources address photography of persons rather than crowd coverage. The workable production answer does not depend on resolving it: signage, a controlled area, and a plan for anyone who does not want to be filmed cost almost nothing and remove the question.

What are the penalties?

For the basic violation, imprisonment of not less than six months and a fine of AED 150,000 to AED 500,000, per the law-firm analyses. Where images have been altered, imprisonment of not less than one year and a fine of AED 250,000 to AED 500,000. The exact statutory wording was not extracted from a primary source for this article, so those figures rest on those descriptions rather than on the decree text.

Does intent matter?

Yes, and it is an important qualification to carry alongside any penalty figure. A court has held that criminal liability under Article 44 requires both the prohibited act and criminal intent, and that absence of intent to violate privacy or misuse an image defeats prosecution. In the reported case the photograph had been retained to document suspected wrongdoing and was never shared or circulated. That is a genuine nuance rather than a general defence to plan around.

Is a verbal yes enough?

Treat it as insufficient. Willingness to stand in front of a camera is not the same as consent to publication, and the separate personal-data regime treats a picture or voice by which a person can be identified as personal data and a facial image as biometric data, requiring the data subject's consent for processing outside listed exceptions. Written consent is the only version of this that survives a question later.

What about patients or clients in a clinic film?

A further layer applies. The DHA's standards for medical advertisement content on social media require written consent to be obtained and documented from any individual whose pictures, images, videos or statements are used, limited to the subject and the period for which it was granted. That is stricter than the general position and it is time-bound, which means consent can expire while the film is still running.

Can we blur faces instead of taking consent?

It is a mitigation rather than a substitute, and it is best planned rather than retrofitted. Deciding at treatment stage which shots depend on identifiable faces, and which can be composed to avoid them, is cheaper than an edit-stage rescue and produces better images than a blur. Where a face is load-bearing, take written consent.

What to hold onto, in one pass

There is no blanket public-place exception in the UAE, and the privacy provision is described as reaching the preparing, copying and retaining of images as well as their publication. The penalties are criminal rather than administrative, reported at six months and AED 150,000 to 500,000 for the basic violation and higher for altered images. A court has held that criminal intent is a required element, which is why an ordinary commercial shoot is not the target, and which is not a substitute for a consent plan. Images of identifiable people are also personal data, so storage matters as much as publication. And permission to be in the place, permission to film the people and ownership of the film are three separate permissions.

This article describes how UAE law firms and regional media describe the position, not the text of the law. The exposure is criminal, so take advice on your own production rather than relying on an article.

Grolez Films: consent planned into the shoot

We plan the consent position at the recce, choose locations that can be controlled, brief the frame as carefully as the schedule, capture releases on the day with their scope written on them, and budget the blur pass before anyone needs it.

Luis Grolez, the founder, pitches this personally, founder to founder. Get in touch about a specific brief and a specific quarter.

Sources and methodology

The description of Article 44 of Federal Decree-Law No. 34 of 2021, its five methods of privacy infringement, the absence of a blanket public-place exception and the penalty bands rest on law-firm analyses and regional media rather than on the decree text, which was not extracted from a primary source for this article. Those sources describe the provision consistently, and the limitation is stated here rather than hidden. The mens rea point comes from one law firm's note on one judgment: it is a genuine and important nuance and it is not a general defence a production should plan around. The personal-data layer, treating an identifying picture or voice as personal data and a facial image as biometric data under Federal Decree-Law No. 45 of 2021, comes from legal commentary. The healthcare consent requirement is taken from the DHA's own published standards for medical advertisement content on social media, clauses 9.1 and 6.10.1. How Article 44 applies to incidental background presence in a commercial film, as distinct from targeted photography of an individual, was not established and is presented as an open question. This article is informational and is not legal advice. Confirm your position with counsel before relying on it. Prepared 11 August 2026.

  • BSA Law, legal risks of photography and technology use under Federal Decree-Law No. 34 of 2021: bsalaw.com
  • Al Suwaidi, on the court's clarification of criminal intent under Article 44: alsuwaidi.ae
  • Khaleej Times, on fines for taking photographs of people without consent: khaleejtimes.com
  • Securiti, overview of Federal Decree-Law No. 45 of 2021 on personal data protection: securiti.ai
  • Lexology, on Federal Decree-Law No. 45 of 2021: lexology.com
  • Dubai Health Authority, Standards for Medical Advertisement Content in Social Media, clauses 9.1 and 6.10.1: dha.gov.ae