Article 9 of the GDPR holds a closed list of special categories: racial origin, political opinions, religion, trade union membership, genetic data, biometric data for unique identification, health data and sex life. A passport number is not on it. Neither is a name, a date of birth or a nationality. All of these are ordinary personal data, and a basis under Article 6 is enough.
But the list does include biometric data, and three words in that entry decide everything: "for unique identification". The photo inside a passport scan is not biometric data by itself. It becomes biometric when it undergoes specific technical processing aimed at uniquely identifying a person. That is how the Spanish regulator reads it in report 0036/2020, and it is the line between storing a photo and matching it.
For an agency the consequence is concrete. Accepting a passport scan, reading the MRZ, extracting name, number and expiry date is ordinary processing under a single Article 6 basis. Adding a selfie-to-passport face match is Article 9, and it needs a separate condition under Article 9(2) on top of the basis you already have — in practice usually explicit consent.
So one feature toggle in an OCR configuration changes the legal regime of the whole process. OCR vendor documentation does not say this: there it is simply another line on the price list.
The regime is set twice. Once by where the agency is established and processes data. Once by where the candidate data came from. An agency in Dubai recruiting in India falls under both, and neither cancels the other.
| Regime | Basis for processing | Cross-border transfer | Status |
|---|---|---|---|
| GDPR — EU, Poland, Czechia | Article 6, plus Article 9 for biometrics | Adequacy, SCCs, BCRs | Fully in force since 2018 |
| KVKK — Türkiye | Explicit consent or a statutory exception | Adequacy, appropriate safeguards, incidental cases | Amendments in force since 12.03.2024 |
| PDPL — UAE | Consent by default, ten exceptions | Adequacy determined by the Data Office | Executive Regulations not published |
| DPDP — India, source country | Consent | Rules notified 13.11.2025 | Core duties from 13.05.2027 |
Türkiye is the sharpest right now. After the 2024 amendments, cross-border transfer rests on three pillars: an adequacy decision, appropriate safeguards and incidental cases. The most common pillar is the standard contract. The trap is that signing it is not enough: the contract must be notified to the Board within five business days of signature, and failing to notify is itself grounds for an administrative penalty.
The UAE calls for honesty, because there is no clarity. The Executive Regulations to the PDPL were due within six months of the law being issued. According to the DLA Piper handbook, as of 6 January 2025 they had still not been published, and once they are, companies get a further six months to bring processes into line. Some secondary sources mention Cabinet Decision 33/2024, but none of them cites a primary instrument in the official gazette. The practical conclusion is simple: any vendor selling you "certified PDPL compliance" is selling something that cannot currently be verified.
India has a calendar, and it is already running. The DPDP Rules were notified on 13 November 2025. Consent Manager registration starts on 13 November 2026. The core duties — notice, security safeguards, breach intimation and data principal rights — take effect on 13 May 2027. For an agency recruiting in India that is a real deadline, not an abstraction.
GDPR is in force in full and has no transition period. If your process does not meet it today, it does not meet it today.
Agencies placing staff in the Gulf collect more than passports. A certificate of fitness to work is a mandatory document of the corridor, and it is health data. GDPR names it explicitly in Article 9, which means it needs its own basis, not the one you hold for the passport.
The UAE goes further: health data may not be transferred outside the country except in cases permitted by Federal Ministerial Decision 51/2021. So the decision to "put all of a candidate’s documents in one cloud folder" can be lawful for the passport and unlawful for the medical certificate sitting next to it.
This rarely occurs to anyone, because in the operational process both documents arrive from the same person on the same day and land in the same place.
This is the most common reason a Gulf corridor audit comes back with findings. Not the passports — the medical certificates stored beside them.
A common misconception is that GDPR requires data to stay in the EU. It does not. It requires a lawful transfer mechanism: an adequacy decision, standard contractual clauses or binding corporate rules. Storing in the EU simply takes the question off the table; it is not an obligation in itself.
For an agency running several corridors at once the practical difference is this. Cloud OCR hosted in the US means a cross-border transfer with every single scan, and that transfer has to be covered under each of the four regimes. OCR running on your own server removes the transfer as a fact — and with it most of the questions an audit will ask.
This is not an argument that self-hosted is always better. It is an argument that where processing happens is part of the legal construction, and that the person choosing it should not be the one who compared the price per thousand pages.
We are a software vendor, not a law firm. This describes how the regimes are built and which dates are already fixed — it is not legal advice. Before building a process on it, check with your counsel in each jurisdiction.
No. Article 9 holds a closed list and a passport number is not on it. It is ordinary personal data needing a basis under Article 6. Processing becomes a special category when you add biometric matching.
When the photo undergoes specific technical processing aimed at uniquely identifying a person — a selfie-to-passport match, for example. Reading the MRZ and storing the scan does not create that on its own.
Yes, if the transfer is covered by a lawful mechanism — an adequacy decision, standard contractual clauses or binding corporate rules. GDPR requires a mechanism, not a geography.
The PDPL itself is enacted, but as of the last update of the DLA Piper handbook the Executive Regulations had not been published, and once they are there will be a further six months to comply. Claims of "certified PDPL compliance" therefore cannot be verified today.
The core DPDP duties take effect on 13 May 2027. Consent Manager registration opens on 13 November 2026. The Rules themselves were notified on 13 November 2025.
Start with a short brief — we reply with an estimate.