Driver-deletion request handling ÔÇö the structured response to customer requests for deletion of their personal data under UAE PDPL (Federal Decree-Law 45/2021) ÔÇö supports regulatory compliance and customer-rights respect while balancing operator-side legitimate data-retention needs.
PDPL grants UAE-resident data subjects rights including: data deletion right (subject to specific exceptions), data access right, data correction right, data portability right. The deletion right is among the most operationally impactful.
The deletion-request response framework
Receive request through documented channel. Verify requester identity (preventing fraudulent deletion). Assess applicability against PDPL exceptions (legitimate-interest retention, regulatory retention requirements, dispute-related retention). Execute deletion of qualifying data. Communicate completion to requester.
The retention-exception scenarios
Some data retention is required despite deletion request. FTA tax-record retention (5 years from relevant period). Insurance-claim-related retention through claim resolution. Active-dispute retention supporting resolution. Audit-evidence retention.
The discipline: per-data-category assessment of retention requirements, deletion of qualifying data, retention of required data with explanation to requester.
The technical execution
Identify customer records across systems (rental ERP, accounting system, marketing platform, communication archives, backup storage). Execute deletion per system requirements. Verify deletion completion. Document the deletion activity.
The PDPL response timeline
PDPL specifies response timeline for data-subject requests. Initial acknowledgment promptly, substantive response within statutory window.
Checklist: driver-deletion request discipline
- Documented channel for request receipt.
- Identity verification preventing fraudulent deletion.
- Per-data-category retention assessment.
- Deletion of qualifying data across all systems.
- Retention of required data with documented basis.
- Verification of deletion completion.
- Communication to requester within PDPL timeline.
- Documentation of deletion activity.
- Backup system handling per documented policy.
- Annual policy review against PDPL evolution.
Exit clauses: getting the car back cleanly
Pre-set exit triggers that should be in every lease-out contract: late payouts (more than 30 days), utilisation below an agreed floor for 3 consecutive months, damage events not recovered within agreed timeline, mileage cap breach, regulatory non-compliance by operator (licence lapse, insurance lapse), and end of agreed term. Each trigger should have specific notice periods and remediation pathways.
The clean exit checklist: 30-day written notice, joint inspection at handback, mileage and condition verified against original handover documents, settlement of any pending payouts and recovery of pending damages or fines, formal Mulkiya re-assignment if title is with operator, and signed release from any further obligations. Most disputes happen when these steps are skipped.
Power of Attorney scoping: tight, not general
A general POA gives the operator unlimited authority over the vehicle and the owner's name — a major risk concentration. A tightly-scoped POA for lease-out should limit authority to: RTA dealings related to the vehicle, traffic-fine processing, insurance liaison for the vehicle, parking and toll dispute handling, and cross-border NOC issuance. It should NOT include: vehicle sale authority, financing authority, owner's personal-bank-account access, or general legal representation.
The POA is notarised at the Public Notary; both parties sign. Term should match the lease term plus a short tail (typically 1-3 months) for wind-down. Owners should review the POA wording in detail before signing — the convenience of letting the operator handle all paperwork shouldn't come with overly-broad authority.
Frequently asked questions
Must I delete all customer data on request? No ÔÇö PDPL allows retention for specific legitimate purposes including tax, dispute, audit needs.
What is the typical response timeline? Per PDPL statutory window. Acknowledge promptly.
How do I verify requester identity? Standard customer-identification verification supporting against fraudulent deletion requests.
What about backup data? Documented backup-handling policy supporting eventual backup-data deletion.
Should I refuse deletion for active customers? No ÔÇö process the request applying retention exceptions where applicable.
How do I document deletion? Deletion-activity log with date, requester, scope, executor, completion verification.
What if customer disputes retention exception? Provide PDPL basis for retention, support dispute resolution through PDPL channels.
What is the most common driver-deletion mistake? Cursory response without proper retention-exception assessment.
{$CTA}