Photo & Video Consent and Release (UAE)

A Photo and Video Consent and Release in the United Arab Emirates is a formal written document by which an individual — the subject — grants a photographer, videographer, company, or organisation the right to capture, edit, publish, and use photographs and video recordings featuring the subject's image, likeness, voice, and biographical information. The document operates simultaneously as a consent form under UAE privacy and data protection law and as a copyright licence under UAE intellectual property law, making it an essential instrument for media productions, corporate communications, advertising campaigns, educational content, and social media activity in the UAE.

The Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), administered by the UAE Data Office, is the primary statute governing the use of photographic and video content in the UAE. A photograph or video recording that identifies or is capable of identifying a natural person constitutes personal data under Article 1 of the PDPL, and its capture, storage, publication, and distribution are all forms of 'processing' requiring a lawful basis under the law. The most common lawful basis for processing a subject's image for commercial or media purposes is the subject's explicit consent under Article 11 of the PDPL, which must be freely given, specific, informed, and unambiguous. The UAE Data Office has published guidance confirming that image and voice data are personal data, and that marketing and advertising use of such data requires explicit consent.

The UAE Cybercrime Law (Federal Decree-Law No. 34 of 2021) reinforces privacy protections by criminalising the publication of images or recordings that violate a person's privacy without consent. Article 44 of the Cybercrime Law makes it an offence to publish, re-publish, or distribute audio recordings, photos, or videos of a person without their consent, with penalties including fines and imprisonment. The same statute covers online publication, making social media posting of another person's image without consent a potential criminal offence in the United Arab Emirates.

The UAE Copyright Law (Federal Decree-Law No. 38 of 2021, as amended) protects both the photographer or videographer as the creator of the work and the subject's moral rights in relation to their likeness. A commissioned portrait, for example, may belong to the subject rather than the photographer under Article 17 of the Copyright Law. A clear consent and release that addresses both the intellectual property aspects and the data protection aspects removes ambiguity about who owns the content and who may use it.

In the business context, advertising agencies, events companies, hotels, airlines, and educational institutions in Dubai, Abu Dhabi, and other UAE emirates routinely obtain signed consent and release forms from employees, models, guests, students, and event participants before using their images in marketing materials, annual reports, training content, and social media campaigns. The Ministry of Economy and free-zone authorities such as DMCC and Dubai Media City require media companies to document the consent they hold for personal data processed in content production, as part of broader PDPL compliance obligations.

A Photo and Video Consent and Release in the United Arab Emirates is needed whenever a person's image, likeness, or voice will be captured and used beyond the immediate, private context in which the capture takes place.

Commercial advertising and marketing campaigns require signed consent from every identifiable person featured. UAE-based advertising agencies, brands, and production companies that create campaigns for publication in print, broadcast, digital, and out-of-home media must hold documented consent. The Emirates Advertising Association standards and the Dubai Media Incorporated content policies reflect this requirement, and the UAE Data Office's PDPL guidance makes clear that using a person's recognisable image in advertising without explicit consent constitutes unlawful processing of personal data.

Corporate photography for websites, LinkedIn profiles, employee handbooks, and investor relations materials requires consent from the employees, consultants, or visitors depicted. Companies licensed by the Dubai Health Authority (DHA), the Abu Dhabi Department of Economic Development, or any free-zone registrar that process employee photographs as part of their operations need documented PDPL consent, and HR departments are responsible for maintaining consent records.

Social media content created by businesses or influencers licensed in the UAE requires consent when identifiable individuals appear. The National Media Council (NMC) and the Telecommunications and Digital Government Regulatory Authority (TDRA) regulate digital content creation, and content published to Instagram, TikTok, YouTube, or Facebook that includes recognisable persons without consent risks a complaint to the UAE Data Office or, in extreme cases, a report to the relevant police authority under the Cybercrime Law (Federal Decree-Law No. 34 of 2021).

Educational institutions — schools, universities, and vocational training centres registered with the Knowledge and Human Development Authority (KHDA) in Dubai or the Abu Dhabi Department of Education and Knowledge (ADEK) — require photo and video consent at enrolment to use student images in prospectuses, graduation photos, and social media. For minor students, the consent must be given by a parent or guardian.

Event photography and live-streaming at conferences, exhibitions, and social events held at UAE venues require either general consent notices displayed at entry or individual signed consents, depending on how the footage will be used. Venues licensed by the relevant municipality typically require event organisers to display notices informing attendees that filming is taking place.

A Photo and Video Consent and Release compliant with UAE law — particularly the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and the Cybercrime Law (Federal Decree-Law No. 34 of 2021) — must contain specific elements to protect both the creator and the subject. The forms-legal.com UAE Photo and Video Consent and Release template addresses each of these requirements.

Identification of the subject: the full legal name, Emirates ID number, and any other identifier of the person whose image and likeness is being captured. For minor subjects, the parent or guardian's name and relationship must also be recorded. The UAE Data Office guidance requires that personal data subjects be clearly identified in consent documents.

Identification of the creator or organisation: the full legal name, trade licence number (if a company), and contact address of the photographer, videographer, or organisation requesting and holding the consent. This identifies the data controller responsible for the personal data under the PDPL.

Description of content: a specific description of the photographs, videos, or audio recordings to be captured — the medium, the occasion, and the subject matter. A vague description such as 'various content' is insufficient; the PDPL requires consent to be specific to the processing purpose.

Permitted uses: each platform, medium, and purpose for which the content may be used must be listed. Uses not listed in the consent form may not be legitimate without further consent. Common permitted uses for UAE commercial consents include: website publication, social media accounts, print advertising, broadcast media, internal training materials, and investor communications.

Period of consent: the timeframe for which the consent applies. A perpetual licence reduces the need for renewal but gives the subject less control. A time-limited consent — for example, two years — requires renewal if the content is still to be used after the period expires.

Commercial use clause: explicitly state whether the content may be used in paid advertising or commercial promotional material. The UAE Data Office and advertising regulators expect commercial consent to be separate and specific.

PDPL data protection obligations: the creator's obligations to process the subject's personal data only for the stated purpose, to apply security measures, and to comply with data subject rights — access, correction, and deletion — under the PDPL.

Cybercrime Law release and exclusions: a release of claims for permitted uses, with a clear exclusion for defamatory, false-light, or privacy-violating uses that breach the Cybercrime Law (Federal Decree-Law No. 34 of 2021).

Withdrawal of consent: a statement of the subject's right to withdraw consent prospectively under the PDPL.

Governing law and signature: UAE law, the competent forum, the subject's signature, and electronic execution validity under the Electronic Transactions and Trust Services Law (Federal Decree-Law No. 46 of 2021).

Completing a Photo and Video Consent and Release for use in the United Arab Emirates requires both the creator or organisation and the subject to engage with the form carefully to ensure compliance with the PDPL (Federal Decree-Law No. 45 of 2021) and the Cybercrime Law (Federal Decree-Law No. 34 of 2021).

Step one: identify the subject. Enter the subject's full legal name and Emirates ID or passport number. For a minor subject, also enter the parent or guardian's full name. The PDPL requires that the data controller (the creator) can demonstrate who gave consent and that the consent was freely given.

Step two: identify the creator or organisation. Enter the full legal name of the photographer, videographer, production company, or brand requesting consent, plus the contact address. For UAE-registered companies, the trade licence details confirm the legal entity responsible for PDPL compliance.

Step three: enter the consent date in DD/MM/YYYY format. The date confirms the consent was obtained before content capture, not retrospectively.

Step four: describe the content specifically. State the type of content — photographs, video, audio — the occasion or campaign, and the subject matter. A description such as 'Product launch photography for the Al Futtaim Group wellness campaign, Dubai Mall, 15/03/2026' is specific enough to satisfy the PDPL's specificity requirement.

Step five: list every permitted use. Identify each platform and medium: the company's Instagram and LinkedIn pages, the corporate website, print advertisements in UAE newspapers, the annual report. Do not use a blanket phrase — if certain uses are excluded, state them explicitly.

Step six: select the period of use. Consider whether a time-limited period or a perpetual licence better reflects the commercial relationship. Advertising agencies in Dubai and Abu Dhabi typically seek two- to five-year licences for campaign content.

Step seven: address commercial consent. Mark 'Yes' or 'No' to use in paid advertising. Commercial use of a person's image in the UAE without explicit consent can constitute a PDPL breach and may attract compensation claims.

Step eight: state the compensation in AED (dirhams) or note that the consent is given voluntarily without payment. Where a fee is agreed, record it here for clarity.

Step nine: obtain the subject's signature — wet-ink or electronic under the Electronic Transactions and Trust Services Law (Federal Decree-Law No. 46 of 2021). The creator or organisation representative acknowledges receipt. Retain a signed copy with the creator's PDPL compliance records.

Photo and video consent in the United Arab Emirates is governed by multiple overlapping legal frameworks. The Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) is the primary law: Article 1 defines personal data to include photographs, voice recordings, and video recordings that identify or can identify a natural person, and Articles 8 to 11 require a lawful basis for processing, with explicit consent being the most appropriate basis for image capture used in marketing and media.

The PDPL requires that consent be freely given, specific, informed, and unambiguous. A consent that is buried in a long terms and conditions document without being clearly drawn to the subject's attention does not satisfy the PDPL's requirements. The UAE Data Office, which enforces the PDPL, has published guidance on consent management for data controllers, including photographers and media companies.

The Cybercrime Law (Federal Decree-Law No. 34 of 2021) criminalises the publication of images or recordings of a person without their consent in Article 44. Penalties include fines of up to AED 2,000,000 and imprisonment. This law applies to digital publication — including social media, messaging apps, and websites — making it directly relevant to any business that shares individual photographs online.

The Copyright Law (Federal Decree-Law No. 38 of 2021, as amended) protects the photographer's creative work and the subject's moral rights in their likeness. Where the subject commissioned the photograph, copyright may vest in the subject under Article 17 of the Copyright Law. The consent and release should therefore address intellectual property ownership as well as data protection.

For minors, consent must be given by a parent or legal guardian under the rules of guardianship in Federal Decree-Law No. 41 of 2024 on Personal Status. The Knowledge and Human Development Authority (KHDA) in Dubai and the Abu Dhabi Department of Education and Knowledge (ADEK) require schools and educational institutions to obtain parental photo consent at enrolment. Electronic consent is valid under the Electronic Transactions and Trust Services Law (Federal Decree-Law No. 46 of 2021) for most commercial purposes.

Photo and video consent errors in the United Arab Emirates frequently expose creators, brands, and businesses to liability under the PDPL and the Cybercrime Law. The following mistakes are the most common.

The first mistake is using a single blanket consent covering all future uses. The PDPL requires consent to be specific: a consent that purports to cover any and all uses without identifying the platforms or purposes is unlikely to satisfy the UAE Data Office's standards, and may be challenged by the subject.

The second mistake is obtaining consent after publication. Consent must be obtained before the content is captured or, at the latest, before it is published. Retroactive consent does not cure a PDPL breach or a Cybercrime Law violation that has already occurred.

The third mistake is failing to distinguish commercial from non-commercial use. A subject who consents to their image being used on an internal company intranet may not consent to it being used in paid advertisements. The consent form must specify whether commercial advertising use is permitted, and this should be agreed explicitly rather than implied.

The fourth mistake is ignoring the right of withdrawal. The PDPL grants subjects the right to withdraw consent, and the consent form must acknowledge this right. A form that states consent is irrevocable conflicts with the PDPL and may be unenforceable on that specific point.

The fifth mistake is not accounting for minor subjects. Content featuring minors requires parental consent in the UAE. Schools, sports clubs, and event organisers frequently overlook this requirement, creating exposure to regulatory complaint and reputational damage.

The sixth mistake is failing to maintain consent records. The UAE Data Office can request evidence of consent as part of a PDPL audit. A creator or company that cannot produce signed consent forms for content it has published online risks enforcement action, including fines under the PDPL and, where images were published without any consent at all, prosecution under the Cybercrime Law (Federal Decree-Law No. 34 of 2021).