Client data

The personal data law

The UAE has Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). For a broker it comes down to three simple rules:

1. Collect only what the deal needs.
2. Collect it with the client's consent.
3. Keep it secure and don't share it with anyone who doesn't need it.

Client documents

Passports, Emirates IDs and title deeds are the most sensitive data you handle.

• Documents are uploaded only to the client card in the CRM.
• They are never sent to or kept in personal WhatsApp, Telegram, your phone's photos or personal email.
• If a client sends a passport to your personal messenger, upload it to the CRM, then delete it from the chat and from your phone's gallery.

The CRM is the only storage

Client data is stored only in the CRM. No personal spreadsheets of contacts, no exporting the database “just in case”. If you need a report, build it in the CRM.

When an employee leaves

All client data and conversations stay with the company. Access is revoked on the last working day. Copying contacts when you leave is a breach, not “my client base”.

Situation. On a Saturday evening, Priya N.'s client sends a photo of his passport to her personal WhatsApp: “So I don't forget by Monday.”

What to do. Priya thanks the client, uploads the photo to his card in the CRM and immediately deletes it from the chat and from her phone's gallery. Next time she offers the client a work channel for documents in advance.

In short

• PDPL: minimum data, client consent, secure storage.
• Documents go only into the CRM.
• Personal messengers and your gallery are not storage.
• The client base stays with the company when you leave.