For a biometric access control system in an Abu Dhabi office, face recognition is usually the faster, contactless choice: datasheets give about 0.2 s per face and up to 1.5 s per fingerprint. Neither is better everywhere. Both create biometric data, which the UAE's personal data law treats as sensitive, so plan consent, storage and a card fallback.
This guide summarises public texts as they stood in October 2026 and is not legal advice: for a specific workforce, ask a UAE-qualified lawyer. For the cameras on the same doors, see CCTV privacy law in the UAE.
Choosing a biometric access control system in Abu Dhabi: card, PIN, fingerprint or face
A card or phone proves that someone holds it, a PIN that someone knows it, and a fingerprint or face that the person is there. NIST's biometric specification for US government ID cards uses the same three factors: things a person has, knows and is (SP 800-76-2). Two together, such as card plus face, is multi-factor authentication, and both Hikvision and Dahua list it among their terminal functions.
| Credential | Proves | Datasheet recognition time (s) | Touched by every user | Can be lent or copied | Creates biometric data |
|---|---|---|---|---|---|
| Card or phone | Something you have | under 1 (card read) | No | Lent easily; older card types can be copied | No |
| PIN | Something you know | Not stated: set by the person typing | Yes, the keypad | Told or watched | No |
| Fingerprint | Something you are | under 1 (Hikvision); 0.5 to recognise, 1.5 to compare (Dahua) | Yes, the sensor | Cannot be lent; ask for spoofing tests | Yes |
| Face | Something you are | 0.2 (both) | No | Cannot be lent; ask for spoofing tests | Yes |
Times are from the Hikvision DS-K1T343MFX and Dahua ASI7214S-W datasheets, two terminals that read face, fingerprint and card. Fingerprint sensors and PIN keypads are touched by everyone who passes; cards, phones and face readers are not, which matters in clinics and food areas. Cards are a running cost, because every joiner, lost card and visitor needs one. Biometric terminals remove the card stock but add enrolment, a data protection workload and a second route for people who do not enrol.
Which is fastest at the morning peak?
At a turnstile, the reader must fit the lane's pace. Hikvision rates its DS-K3B530X swing barrier at 30 to 60 persons per minute, adding that real throughput depends on how people pass (datasheet). That leaves 1 to 2 s per person to walk up, present and pass.
A face match at about 0.2 s fits easily, and a card read is quoted at under 1 s. A fingerprint takes more: under 1 s on the Hikvision terminal, and on the Dahua terminal 0.5 s to recognise and 1.5 s to compare, before counting the time to place a finger cleanly. No datasheet gives a figure for a PIN, which depends on the person typing.
To size lanes, divide the arrivals in the busiest 15 minutes by 15: 300 people is 20 per minute, below the 30 to 60 per minute one lane is rated for, so on paper one lane is enough, before margin for visitors and failed reads.
Vendor accuracy figures (at least 99% for Hikvision, 99.9% for Dahua) come without test conditions, and conditions matter: NIST's 2019 study of face recognition algorithms found false positive rates often varying by factors of 10 to beyond 100 across demographic groups, in many but not all of the algorithms tested (NISTIR 8280). Test with your own staff during commissioning.
For sensitive doors, let the biometric confirm a card instead of searching the whole database. NIST notes that biometric-only, one-to-many search loses the "something you have" factor and must cope with an N-fold increase in false match rates, N being the number enrolled (SP 800-76-2).
Can access cards be cloned?
Older ones can. NIST's guidance on physical access says legacy access cards provide an identifying number but in most cases cannot respond to a cryptographic challenge, and that many can be copied easily (SP 800-116 Rev. 1, Appendix E). A card that sends the same number every time can be read by any reader and replayed.
| Card type | Frequency | What the card sends | Published finding |
|---|---|---|---|
| Proximity card | 125 kHz | A fixed number, no cryptography | Badges read from up to 3 feet (about 0.9 m) away and cloned onto blank cards (Black Hat USA 2013) |
| MIFARE Classic | 13.56 MHz | Data protected by a proprietary cipher | Secret key recovered in under a second from one or two attempts with a genuine reader, enough to clone a card (Garcia et al., 2008) |
| MIFARE DESFire EV3 | 13.56 MHz (ISO/IEC 14443) | Mutual three-pass authentication (challenge and response) with DES, 3DES or AES keys; data encrypted over the air | Chip hardware and software certified to Common Criteria EAL 5+; random ID option (NXP) |
Check what the specification buys: if a datasheet lists "M1" or "IC card", ask whether that means MIFARE Classic. The Dahua ASI7214S-W lists DESFire EV3 support, by default with Dahua's own cards, so confirm third-party cards with the supplier. Phones are the other route: Apple Wallet employee badges, available from supported partners, require multifactor authentication on the account the employee uses for the employer's app before a badge can be added, and can still open doors after the iPhone's battery runs out (Apple Platform Security).
Time attendance: from the terminal to payroll
A time attendance terminal is an access reader whose events go to HR: who, when and at which device; the Hikvision DS-K1T343MFX lists an attendance-only mode. The software applies shift rules and feeds payroll: HikCentral Professional, for example, can synchronise access records to a third-party database or export them as CSV or TXT files (user manual).
The record decides pay. UAE labour law sets normal hours at a maximum of 8 a day or 48 a week, limits overtime to 2 hours a day as a rule, and pays overtime at least 25% above the normal rate calculated on the basic wage, or at least 50% between 10 pm and 4 am for workers not on shifts (Federal Decree-Law No. 33 of 2021, Articles 17 and 19).
A card shows that the card was presented; a face or fingerprint shows that the person was there. Keep every terminal's clock synchronised and test a month's export into payroll before go-live. Retention is for HR and legal: the labour law requires employers to keep workers' files and records under Ministry rules, and each worker's file for at least two years after service ends (Article 13), and the personal data law says data must not be kept once its purpose is exhausted.
Is biometric data sensitive personal data under the UAE PDPL?
Yes. The Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, lists biometric data among sensitive personal data. It defines biometric data as data from processing a person's physical, physiological or behavioural characteristics that allows or confirms their unique identification, "such as facial images or fingerprints" (Article 1).
Processing without consent is prohibited unless a listed exception applies (Article 4). One covers obligations and rights in the field of employment, to the extent those laws permit; whether it covers a biometric clock is for your legal adviser. Where consent is the basis, the employer must be able to prove it, it must be clear and simple, and staff can withdraw it at any time (Article 6), so the system needs a card or PIN route for anyone who declines.
| PDPL article | What it requires | What it means for a biometric reader |
|---|---|---|
| Art. 5 | A specific purpose, data limited to what is necessary, kept securely, not kept after the purpose | Enrol for access or attendance only; delete leavers' templates |
| Art. 13 | Before processing: the purposes, who data is shared with, safeguards for transfers abroad | A written notice to staff before enrolment |
| Art. 20 | Security measures, which may include encryption and pseudonymisation | Encrypted storage and links between terminals and server |
| Art. 21 | An impact assessment before high-risk technologies; required for a large volume of sensitive data | Assess before enrolling a large workforce |
| Art. 22 and 23 | Conditions for transfers outside the UAE | Know where a cloud platform keeps templates |
A large volume of sensitive data also triggers a Data Protection Officer (Article 10), and the law leaves the criteria for "large volume" to its executive regulations. Those were due within six months (Article 28); at the time of writing the federal legislation portal lists none. The law names the UAE Data Office as regulator, and in June 2026 the government announced that the Data Office is being brought into a new Artificial Intelligence and Data Authority.
The PDPL does not apply to government entities, or to free zone companies that have their own data protection law (Article 2). In ADGM, the Commissioner of Data Protection lists collecting employees' biometric data to identify them, for example for building entry, among processing that needs a data protection impact assessment first.
What does a fingerprint or face terminal store?
Usually a template, not a picture. A fingerprint template is a list of minutiae, the points where ridges end or split, each with a position and a direction; NIST's specification stores them in INCITS 378 and ISO/IEC 19794-2 formats. A face terminal likewise computes a template from the image.
A template is still biometric data. NIST notes that many kinds of templates stored on a server can be reversed to produce a sample that matches (SP 800-76-2). ISO/IEC 24745:2022 sets requirements for the confidentiality, integrity and renewability of stored biometric references, where renewability means a protected template can be revoked and replaced.
Face terminals can keep more than a template. The Dahua ASI7214S-W lists a face image capacity of 50,000 and a capture function: check whether enrolment photos and event snapshots are stored, where, and for how long.
| Where the template lives | Example | Exposed if it is stolen | When someone leaves |
|---|---|---|---|
| On the terminal | DS-K1T343MFX: up to 1,500 faces and 3,000 fingerprints | That device's users | Delete from every terminal the template was sent to |
| On a central server | Management software that sends templates to the doors | Everyone enrolled | Delete centrally, then confirm the terminals followed |
| On the person's card | On-card comparison in NIST's ID card specification | One person | Collect or cancel the card |
Spoofing is the other check: datasheets say "face anti-spoofing" (Hikvision) or "liveness detection" (Dahua) without a test level, so ask for presentation attack detection results to ISO/IEC 30107-3:2023, the standard for how such tests are run and reported.
How UBM handles it
UBM designs, installs and maintains access control with its CCTV and network work, using Hikvision and Dahua terminals, and Digifort where video must work with access control and alarms (see Hikvision, Dahua or Digifort). We recommend the credential per door, not per building: face or card at the main lanes, card plus face or PIN where the risk is higher, and a card route for anyone who does not enrol. We recommend secure smart cards for new installations, and a door-by-door plan for moving an existing 125 kHz estate.
Before enrolment, the client's HR and legal team receive what each terminal stores, where, who sees it and how it is deleted. We put terminals and the management server on a segmented security network, switch off enrolment photos and event snapshots where they are not needed, delete a leaver's data from every device, and test a month of attendance export into payroll before go-live. See our physical security work, or talk to a UBM engineer about your doors.
Questions people ask
Is face recognition better than fingerprint for time attendance?
For most offices it is faster and nobody touches it: datasheets give about 0.2 s per face and up to 1.5 s per fingerprint. Test with your own staff, and keep a card or PIN route for anyone who does not enrol.
Do employees have to consent to biometric attendance in the UAE?
Under the PDPL, processing without consent is prohibited unless an Article 4 exception applies, such as employment obligations to the extent those laws permit. Which basis fits is a question for your lawyer; either way, staff must be told the purpose before processing starts (Article 13).
Can a 125 kHz access card be copied?
Many can. Common 125 kHz proximity badges, such as the HID and Indala cards in a Black Hat USA 2013 talk, send a fixed number with no cryptography; the talk showed them read from up to 3 feet away and cloned onto blank cards. Cards such as MIFARE DESFire EV3 use mutual authentication with secret keys instead.
Does a fingerprint reader store my fingerprint image?
Usually it stores a template of minutiae points, not the picture. NIST notes that templates on a server can be reversed into a matching sample, and the PDPL treats biometric data as sensitive either way. Face terminals may also keep photos, so check the settings.
What happens to my biometric data when I leave the company?
The PDPL says personal data must not be kept once its purpose is exhausted (Article 5) and lets you ask for erasure when it is no longer needed (Article 15). Your employer should delete your templates from every terminal and server.
Sources
- Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, Articles 1, 2, 4 to 6, 10, 13, 15, 20 to 23 and 28 (UAE Legislation portal, 2021)
- Federal Decree-Law No. 33 of 2021 Regulating Labour Relations, Articles 13, 17 and 19 (UAE Legislation portal, 2021, last updated 2024)
- Mohammed bin Rashid approves establishing Artificial Intelligence and Data Authority (Dubai Media Office, 14 June 2026)
- Guidance on the Data Protection Regulations 2021, Part 4: Data Protection Impact Assessments (ADGM Office of Data Protection, 2021)
- NIST SP 800-76-2, Biometric Specifications for Personal Identity Verification (NIST, 2013)
- NIST SP 800-116 Rev. 1, Guidelines for the Use of PIV Credentials in Facility Access (NIST, 2018)
- NISTIR 8280, Face Recognition Vendor Test (FRVT) Part 3: Demographic Effects (NIST, 2019)
- F. Brown, RFID Hacking: Live Free or RFID Hard (Black Hat USA, 2013)
- F. D. Garcia et al., Dismantling MIFARE Classic (ESORICS, 2008)
- MIFARE DESFire EV3 product information (NXP Semiconductors, 2026)
- Apple Platform Security: Access key types, employee badges (Apple, 2026)
- ISO/IEC 24745:2022, Biometric information protection (ISO, 2022)
- ISO/IEC 30107-3:2023, Biometric presentation attack detection, Part 3: Testing and reporting (ISO, 2023)
- DS-K1T343MFX Face Access Terminal datasheet (Hikvision, 2026)
- ASI7214S-W Face Recognition Access Controller specifications (Dahua, datasheet 2025)
- DS-K3B530X Pro Swing Barrier datasheet (Hikvision, 2025)
- HikCentral Professional user manual: Data Interchange (Hikvision, 2023)
Comments
Questions and experience from readers. A person reads every comment before it appears.
No comments yet. If something here does not match what you have seen on site, say so.