1. Decide what you actually need
The card gives you everything at once, but most workflows need a fraction of it. An age check needs only the date of birth. A visitor log needs a name and a masked ID. A tenancy contract needs the legal name and full ID number. Design each screen to keep only its fields.
2. Mask by default
Show and store 784-****-*******-1 wherever staff do not need the full number, especially in logs, dashboards and exports. Keep the full number only in the record that legally requires it.
3. Treat the photo as sensitive
Photos are the most sensitive field and the least often needed after the moment of identification. Display them for the staff member to compare, then discard them unless you have a documented reason to keep them.
4. Set retention and deletion
- Define how long each record type is kept, and why.
- Automate deletion or anonymisation when that period ends.
- Include backups and exports in the plan, not just the live database.
5. Secure the reader service
- Run the local service on
localhostonly, and firewall it if LAN access is required. - Allow only your application's web origin to receive card data.
- Make sure logs mask ID numbers, and rotate and archive them.
- Keep toolkit configuration files out of shared drives and code repositories.
6. Know which rules apply to you
The UAE Federal Personal Data Protection Law applies broadly, and some free zones such as DIFC and ADGM have their own data-protection regimes. Sector regulators in health, finance and tourism add their own requirements. This checklist is practical guidance, not legal advice. Confirm your obligations with counsel for your sector and jurisdiction.
Privacy by design, in practice
Our age-check example answers allowed or not allowed and stores nothing at all, and the visitor kiosk keeps only a masked ID. Both are free to explore for learning.
Work with us
ElephantClock builds and supports Emirates ID integrations for UAE typing centres, clinics, hotels, real-estate offices and visitor desks. Our developer tools are free for personal and educational use, and commercial deployments are licensed with installation and support.