Biometric Time & Attendance Software in Dubai 2026: Overtime Maths, PDPL Consent and Real Costs

Short answer: A compliant Dubai time and attendance system is not a fingerprint reader — it is an overtime engine with a consent record attached. UAE mainland law caps normal hours at 8 per day and 48 per week, prices overtime at 125% of the basic hourly wage (150% for hours worked between 22:00 and 04:00), and hard-stops at 2 extra hours a day and 144 hours over any three weeks. Hardware runs AED 295–5,000+ per device and cloud seats AED 5–30 per employee per month; the expensive part is the rule engine and the PDPL consent trail behind the biometrics.

Since 1 June 2026, wages are due by the 1st of the following month under Ministerial Resolution No. 340 of 2026. That single change turned attendance from an HR nicety into a dated dependency: if the month closes on the 31st and payroll must clear on the 1st, there is no room for a spreadsheet chase. We cover the payroll side in WPS-compliant HR and payroll software; this article is about the layer that feeds it.

Three numbers that set the stakes (awareness)

The population under these rules is enormous and still growing. More than 5.1 million private-sector workers fall under MOHRE jurisdiction in 2026. In Q1 2026 alone the private-sector workforce grew 2.5%, skilled workers grew 1.5% and the number of operating companies grew 0.4% — headcount is expanding faster than the number of employers absorbing it, which means average payroll complexity per company rises every quarter.

Dubai employers are buying their way out of manual timesheets. The UAE workforce management market was worth about USD 111.5 million in 2025 and is forecast to reach USD 167.8 million by 2030 on an 8.5% CAGR. Time and attendance is the single largest slice of that spend, at 34.3% of workforce management revenue in 2024.

And the payroll clock got shorter. MR 340 of 2026 replaced the old 15-day window with a 1st-of-month deadline, set the compliance threshold at 85% of total wages transferred on time, and layered automatic escalation on top: electronic monitoring from day 1, a logged warning on day 2, suspension of new work permits from day 5, administrative fines and category downgrade from day 11, automatic labour disputes from day 16.

Most Dubai businesses get this wrong: they shop for a device. A facial-recognition terminal tells you who stood in front of it. It does not know that your Ramadan day is six hours, that 22:05 is a 150% hour, that the DIFC entity in the same group has no statutory overtime at all, or that under PDPL the fingerprint it just stored is sensitive personal data needing its own consent. The hardware is the cheapest part of the project — and the part that never fails an audit.

The overtime maths your system has to get right (consideration)

UAE Federal Decree-Law No. 33 of 2021 and its executive regulations set the arithmetic. Overtime is calculated on basic salary only — housing, transport and other allowances are excluded — and the hourly rate is derived as monthly basic / (30 days × 8 hours). Get the divisor wrong and every overtime line in the company is wrong.

Scenario	Statutory rate	Basis	Where systems fail
Normal day, beyond 8 hours	125% of hourly wage	Basic salary only	Allowances included in the base, inflating cost 20–40%
Hours between 22:00 and 04:00	150% of hourly wage	Basic salary only	Shift split at the wrong minute; night premium applied to the whole shift
Work on the weekly rest day	Compensatory day off plus 50%, or 150% pay	Basic salary only	No ledger of compensatory days owed, so the liability is invisible
Public holiday	Day off plus 50%, or 150% pay	Basic salary only	Hard-coded holiday list that misses moon-sighting changes
Ramadan	Normal day reduced by 2 hours	All employees	Overtime still triggering at 8 hours instead of 6
Daily overtime ceiling	Maximum 2 extra hours per day	Hard limit	No block or alert at the point of approval
Three-week ceiling	144 total hours per 3 weeks	Rolling window	Calculated per calendar month, which is not the same window

One group, two rule books. Mainland Dubai entities run the rates above. A DIFC entity does not: DIFC employment law caps average weekly hours at 48 over a seven-day period, allows a written opt-out from that cap, and carries no statutory overtime premium at all — additional-hours pay is whatever the contract says. Holding companies with a DIFC or ADGM arm plus a mainland operating company therefore need two configurable rule sets in one system, not one averaged compromise. Most off-the-shelf products ship a single global policy and make you fake the rest with manual adjustments, which is exactly where audit exposure accumulates.

Field and shift work is where the clock gets argued about. Office badge-in is trivial. The real Dubai cases are a maintenance crew across six towers, a guarding roster on 12-hour shifts, or a delivery fleet paid per route. Those need geofenced mobile punches, offline capture with later sync, shift-pattern rosters and an approval chain — the same plumbing we build into field service management platforms, guard patrol systems and manpower supply software.

What it costs in Dubai, honestly (consideration)

There are three cost layers and they are usually quoted as one number, which is how projects surprise people.

Layer	Dubai 2026 range	Notes
Fingerprint terminal, entry level	AED 295–1,700 per device	Standalone units commonly AED 300–600
Multi-biometric with WiFi and cloud	AED 600–1,200 + VAT per device	Fingerprint plus RFID card, mobile app access
Facial recognition terminal	From AED 2,000, over AED 5,000 at the top	AI detection, ERP integration capability
Installation per device	AED 100–500	Wiring, network, commissioning
Cloud attendance software	AED 5–30 per employee per month	Full-feature HR suites quoted up to AED 100 per user per month
Integration and rule-engine build	AED 25,000–60,000 (Aquarius range)	UAE overtime rules, SIF or payroll handoff, approvals, exports
Custom multi-entity attendance platform	AED 70,000–180,000 (Aquarius range)	Mainland plus DIFC rule sets, mobile geofencing, PDPL consent ledger

Read that table with one eye on scale. At AED 20 per employee per month, a 400-person Dubai contractor pays AED 96,000 a year, every year, for software it does not own and cannot extend — against a one-off custom build in the AED 70,000–180,000 band that it does own. Below roughly 80 employees, subscription almost always wins. Above 300, with two or more legal entities and a payroll that must land on the 1st, the maths flips. We walk through that decision in custom software development costs in Dubai.

The part nobody budgets for: PDPL and biometrics

Under UAE Federal Decree-Law No. 45 of 2021 (PDPL), biometric data — fingerprints, facial templates — is sensitive personal data. That changes the obligations in four concrete ways, and penalties for processing sensitive data without a lawful basis run to AED 5 million.

• Explicit consent, separate from the employment contract. It must be specific to the biometric purpose, informed, freely given and easily withdrawable. Consent buried in an onboarding bundle, or made a condition of employment, is not freely given.
• A real fallback. Because consent must be withdrawable, the system needs a non-biometric path — card, PIN or mobile punch — that produces the same attendance record. If withdrawing consent means the employee cannot clock in, the consent was never genuine.
• A DPIA. Systematic biometric recognition triggers the impact-assessment requirement, and it has to be documented and audit-ready, not a slide.
• Template storage, not images. Store irreversible templates rather than raw fingerprint or face images, keep them encrypted, set a retention period, and put a data-processing agreement in place with the device vendor and the cloud host. Our UAE PDPL compliance checklist has the full build-side list.

Build it, buy it, or fix what you have (decision)

The cost of leaving it manual is measurable. American Payroll Association benchmarks put the error rate on traditional manual timecards at 1–8% of total payroll, and estimate that time theft adds roughly 1.5–5% to gross payroll. Apply the conservative end to a Dubai company with 120 staff on an average basic of AED 4,000: a monthly payroll of AED 480,000 leaks AED 9,600 a month at 2%, or AED 115,000 a year. That is the entire custom build, recovered inside twelve months — before counting the day-5 work-permit suspension that follows a missed WPS cycle.

Buy when you are a single mainland entity under about 80 people with standard shifts: a cloud product at AED 5–30 per employee per month plus a few terminals gets you compliant this month, and that is the right answer. Build or extend when any of these are true — two or more legal entities under different employment regimes, shift patterns the product cannot express, field staff needing offline geofenced punches, an existing ERP or payroll that must receive clean hours before the 1st, or a PDPL position you cannot evidence today.

How Aquarius does it

We start with the rule engine, not the hardware, because the rules are what get audited. That means a configurable policy per legal entity, the overtime bands and ceilings encoded as tested rules with a worked example per scenario, a rolling 144-hour check, a compensatory-day ledger, and an exception queue for the 2% of punches humans actually need to look at. Biometric capture layers on top with an explicit-consent ledger, a non-biometric fallback and a documented DPIA. Integration is fixed-price and fixed-date, you own the repository and the database from day one, and the handoff to payroll is reconciled line by line against the 1st-of-month deadline rather than hoped at. Bands are on the pricing page and the delivery scope on our services page.

FAQ

What is the overtime rate in the UAE in 2026?

Overtime beyond eight normal hours is paid at at least 125% of the basic hourly wage. Hours worked between 22:00 and 04:00 attract 150%. Work on a weekly rest day or public holiday is compensated with a day off plus a 50% premium, or 150% pay if no day off is granted. All of it is calculated on basic salary only, with the hourly rate derived as monthly basic divided by 30 days and 8 hours.

How many overtime hours are legal per day in the UAE?

Two. Normal hours are capped at 8 per day and 48 per week, overtime may not exceed 2 hours in a day, and total working time may not exceed 144 hours over any three-week period. A compliant system blocks or flags the third overtime hour at the point of approval, and evaluates the 144-hour limit on a rolling window rather than per calendar month.

Is a biometric attendance system legal in Dubai under PDPL?

Yes, but biometric data is sensitive personal data under Federal Decree-Law No. 45 of 2021. You need explicit, specific, informed and withdrawable consent that is separate from the employment contract, a documented data protection impact assessment, encrypted irreversible templates rather than stored images, a defined retention period, and a non-biometric clock-in alternative. Penalties for processing sensitive data without a lawful basis reach AED 5 million.

How much does a time and attendance system cost in Dubai?

Hardware is AED 295–1,700 for entry-level fingerprint terminals, AED 600–1,200 plus VAT for multi-biometric cloud units and AED 2,000–5,000+ for facial recognition, plus AED 100–500 installation per device. Cloud software is AED 5–30 per employee per month. A custom UAE rule engine with payroll integration is typically AED 25,000–60,000, and a multi-entity platform AED 70,000–180,000.

Do DIFC employees get overtime pay?

Not by statute. DIFC employment law limits average working time to 48 hours over a seven-day period and permits a written opt-out from that cap, but contains no statutory overtime premium — any additional-hours pay comes from the employment contract or company policy. A group with both DIFC and mainland entities needs two separate rule sets in its attendance system.

How does attendance software affect WPS compliance?

Directly, since 1 June 2026. Ministerial Resolution No. 340 of 2026 requires wages for a month to be transferred by the 1st of the following month, with an 85% on-time threshold and automatic escalation — monitoring from day 1, warning on day 2, suspension of new work permits from day 5, fines from day 11. Attendance is the input to that transfer, so hours have to be closed, approved and exported inside a one-day window instead of the old fifteen.

Does Ramadan change overtime calculations?

Yes. Normal daily working hours reduce by two hours during Ramadan for all employees, so overtime begins after six hours, not eight. Systems with a fixed 8-hour threshold silently underpay for a month every year, and the holiday calendar also has to absorb moon-sighting changes rather than hard-coded dates.

Running two entities, a shift roster your product cannot express, or a biometric setup you cannot evidence under PDPL? Send us your headcount, entity structure and payroll cut-off and we will come back with a fixed-price scope for the rule engine and the integration — audit trail included.