TRW & Co · Data, Privacy & Cyber
Data Processing Agreements in the UAE
Data processing agreements in the UAE govern how vendors handle personal data for you: instructions, security, sub-processors, breach notice, audits, deletion and liability. The federal PDPL, the DIFC and the ADGM each set different contract rules, and with DIFC private claims since July 2025 and a new federal data authority, weak vendor terms now carry real cost.
Key pointIn the DIFC and ADGM, a processing contract that omits any statutory element puts the controller itself in breach, so a vendor's generic EU-style addendum needs checking line by line against Article 24 or section 26.
At a glance
Federal PDPL
Article 8 sets processor duties under Federal Decree-Law No. 45 of 2021; detailed contract rules await Executive Regulations still unissued in October 2026.
DIFC Article 24
Requires a legally binding written agreement with prescribed content, prior written consent to sub-processors and full processor liability for them.
ADGM section 26
Sets GDPR-style processor terms, with template processor clauses published by the ADGM Office of Data Protection.
DIFC private claims
Amendments in force from 15 July 2025 created a private right of action in the DIFC Courts, raising the stakes of liability clauses.
New federal authority
A Federal Authority for Artificial Intelligence and Data, announced on 14 June 2026, consolidates the UAE Data Office with other digital functions.
Swipe or scroll →
What data processing agreements in the UAE cover
Data processing agreements in the UAE are the contracts that govern how a service provider handles personal data on behalf of a business that decides why and how that data is used. They set the instructions, security standards, confidentiality duties, sub-contracting rules, breach reporting, audit rights, return and deletion of data, and the allocation of liability between the parties.
Almost every outsourced function needs one: payroll and HR platforms, cloud hosting, CRM and marketing tools, call centres, IT support, background screening, logistics, analytics and AI services. The agreement may be a schedule to a master services agreement, the provider's standard data processing addendum, or a bespoke contract negotiated for a large outsourcing.
The legal question arises at signature, when the customer must check that the terms meet the applicable regime, and again when something goes wrong: a breach at the vendor, a regulator request, an unexpected sub-processor, or a dispute over who pays for notification costs. A well-drafted agreement turns those moments into a process; a weak one turns them into an argument.
Three regimes, three sets of contract rules
The federal PDPL
Onshore and in most free zones, the governing law is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), issued on 20 September 2021 and in force since 2 January 2022. The official text defines a processor as a person who processes personal data on behalf of the controller, as directed and instructed by it. Article 8 sets out the processor's general obligations, including processing in accordance with the controller's instructions and the agreement between them, applying appropriate security measures and not retaining data beyond what the processing requires.
Article 9 requires a processor to notify the controller once it becomes aware of a breach, and the duties to keep a record of processing and, in defined high-risk cases, to appoint a data protection officer under Article 10, apply to processors as well as controllers. The PDPL does not apply to certain categories, including government data and health and banking data governed by their own legislation, nor to the DIFC and ADGM, which have their own laws. The UAE government portal summarises the federal framework.
The PDPL leaves many details, including any prescribed contract content and sub-processing rules, to Executive Regulations that had still not been issued by October 2026. On 14 June 2026 the government announced a Federal Authority for Artificial Intelligence and Data, bringing together the UAE Data Office and other digital government functions. Until its rules emerge, contracts should be drafted to the statutory text and to international practice.
DIFC Data Protection Law 2020
The DIFC regime is the most prescriptive. Article 24 of DIFC Law No. 5 of 2020 requires processing by a processor to be governed by a legally binding written agreement, permits controllers to use only processors that give sufficient assurances, and bars processors from appointing sub-processors without the controller's prior written authorisation. The contract must state the subject matter, duration, nature and purpose of processing, the types of data and categories of data subjects, and the controller's rights and obligations.
It must also oblige the processor to act only on documented instructions, bind authorised staff to confidentiality and remain fully liable for its sub-processors. The DIFC Laws Amendment Law, in force from 15 July 2025, introduced a private right of action through the DIFC Courts and clarified the law's scope, which makes the indemnity and liability clauses of a DIFC agreement more consequential. See our page on DIFC data protection.
ADGM Data Protection Regulations 2021
In Abu Dhabi Global Market, section 26 of the Data Protection Regulations 2021 sets the processor contract requirements, closely modelled on the GDPR. The ADGM Office of Data Protection publishes template processor standard contractual clauses designed to satisfy section 26, alongside separate clauses for international transfers and guidance on the regime. The section 26 terms are needed even where the processor sits in a jurisdiction ADGM treats as adequate. Our page on ADGM data protection covers the wider rules.
| Issue | Federal PDPL | DIFC DPL 2020 | ADGM DPR 2021 |
|---|---|---|---|
| Written contract required | Processing must follow the controller's instructions and the agreement; detail awaited in Executive Regulations | Yes, legally binding written agreement (Article 24) | Yes, section 26 terms |
| Prescribed content | Not yet prescribed in detail | Subject matter, duration, nature, purpose, data types, data subjects, rights and obligations | GDPR-style list; template processor clauses available |
| Sub-processors | No express statutory regime yet; contract should control | Prior written authorisation; processor fully liable | Prior authorisation and flow-down of terms |
| Breach notice by processor | To controller once aware (Article 9) | To controller without undue delay | To controller without undue delay |
| Private claims | Under general civil liability and contract | Private right of action in DIFC Courts since July 2025 | Compensation claims available under the Regulations |
Controller, processor or both: getting the roles right
Before drafting, decide the roles. A provider that decides the purposes of processing is a controller, even if the contract calls it a processor. Payroll bureaus and cloud hosts are usually processors; recruitment agencies, banks, insurers, auditors and professional advisers often act as independent controllers for much of what they do. Joint controllers, regulated in the DIFC under Article 23, need an arrangement that allocates responsibilities rather than a processing agreement.
Mislabelling has consequences. A data processing agreement signed with a provider that really acts as a controller does not authorise its use of the data and can conceal a transfer that needs its own legal basis. Conversely, treating a processor as an independent controller can leave the customer without instruction rights, audit rights or deletion obligations. Many relationships are mixed: a SaaS provider is a processor for customer content but a controller for its billing and product analytics, and the contract should say so.
Role analysis also affects regulated firms. A bank's outsourced call centre may be a processor, but the bank's regulator will still expect oversight, audit access and exit planning in the contract. For that reason, data processing agreements in the UAE for regulated businesses usually sit inside a wider outsourcing agreement rather than standing alone.
The most expensive clause in a data processing agreement is usually the one nobody negotiated: the liability cap that quietly treats a data breach like a late invoice.
The clauses that matter most
Instructions, purpose and data description
A schedule describing the processing, including categories of data subjects, types of data, special category data, purposes, duration and locations, is the backbone of data processing agreements in the UAE. It drives the risk assessment, the security requirements and the transfer analysis. Generic descriptions such as "customer data as required for the services" fall short in the DIFC and ADGM and are unhelpful everywhere else.
Security and breach notification
Security clauses should reference concrete standards, such as ISO 27001 certification, encryption, access controls and penetration testing, rather than "appropriate measures" alone. Breach clauses should set a short contractual deadline for notifying the customer, often 24 to 72 hours, the information to be provided and cooperation in investigations, so that the customer can meet its own regulator deadlines. Our page on data breach response explains those deadlines.
Sub-processing and international transfers
Providers want general authorisation with notice of changes; customers want a list, advance notice and a right to object. A workable middle ground is general authorisation subject to a published list, advance notice and a termination right if an objection cannot be resolved. Where sub-processors sit abroad, the agreement must also deal with transfer mechanisms, covered on our page on cross-border data transfers.
Governing law and disputes
Data processing agreements in the UAE often inherit the governing law of the master contract, which may be English law or New York law. That is workable, but the statutory duties of each party still come from the UAE regime that applies to it, and a DIFC data subject can sue in the DIFC Courts regardless of the contract's choice of forum. Align dispute resolution with the main agreement and avoid clauses that purport to waive regulatory duties.
Audit, deletion and liability
Audit rights are usually satisfied first through certifications and reports, with on-site audits reserved for regulators, serious incidents or regulated sectors. Return and deletion clauses should set timelines and require certification. Liability is the hardest point: a separate, higher cap for data protection breaches and indemnities for regulatory fines, where lawful, and third-party claims, especially for DIFC-facing processing after the 2025 amendments.
Putting data processing agreements in place: the process
- Map vendors and data flows. List every provider touching personal data, what data it handles, where it processes and which group entity contracts with it.
- Classify roles. Decide whether each provider is a processor, independent controller or joint controller, data set by data set.
- Identify the regime. Confirm whether the contracting entity is onshore, in a free zone, in the DIFC or in the ADGM, and whether sector rules apply.
- Choose the template. Use your own standard where you have leverage; otherwise review the provider's addendum against a checklist for each regime.
- Negotiate the key points. Focus on breach notice, sub-processors, transfers, audit, deletion and liability rather than redrafting boilerplate.
- Sign and record. Store the executed agreement with the main contract, update the record of processing and note renewal and review dates.
- Monitor in life. Track sub-processor notices, certifications and incidents, and revisit terms when services or laws change.
Documents and evidence to assemble
A defensible position rests on a vendor register, the executed agreements and processing schedules, the provider's security certifications and audit reports, due diligence questionnaires, transfer impact assessments where required, sub-processor lists, breach notifications received, and records of deletion at contract end. For the DIFC and ADGM, a record of processing activities is mandatory for controllers and processors.
Regulators and courts look at what the parties actually did. A strong agreement that is never monitored will not protect a controller that ignored warning signs about a provider's security. Keep evidence of periodic reviews and of how concerns were followed up.
For groups with entities onshore, in the DIFC and in the ADGM, build one master data processing agreement with regime-specific schedules rather than three separate templates. It keeps negotiation consistent, satisfies Article 24 in the DIFC and section 26 in the ADGM, and positions the onshore entities for whatever the PDPL Executive Regulations eventually require.
Risks and common mistakes with data processing agreements in the UAE
Signing the vendor's addendum without reading it
Large providers publish standard addenda drafted for the EU or US. They often include broad rights to use data for product improvement, general sub-processor authorisation with notice only by website update, audit rights limited to reports, and liability caps shared with all other claims. These terms may be acceptable, but only after a conscious decision. For DIFC and ADGM entities, check that the addendum covers every element of Article 24 or section 26; many omit a clear statement of data types or the controller's rights, which leaves the controller in breach.
Missing intra-group agreements
Shared service centres, group HR systems and regional IT teams process data for many group companies. Without intra-group data processing agreements, each entity lacks the contractual basis that its regime requires, and transfers between a DIFC entity and an onshore affiliate may be unsupported. An intra-group framework agreement, with accession deeds for new entities and schedules for each regime, is the usual solution. It should be kept up to date as the group restructures.
Ignoring sector rules
Health data falls under Federal Law No. 2 of 2019 on the use of ICT in health fields and the health authorities' rules, which restrict processing and storage outside the UAE. Banks, insurers and payment firms face Central Bank outsourcing and data requirements, and DFSA or FSRA rules in the financial free zones. A processing agreement that satisfies the PDPL may still fail sector requirements on location, audit access for the regulator and termination assistance. Our page on financial services outsourcing explains the overlay.
Under-pricing data breach liability
Liability caps of twelve months' fees can be trivial against the cost of investigation, notification, regulator engagement and claims. With private claims available in the DIFC since July 2025 and significant ADGM fining powers, controllers should seek a separate super-cap or uncapped liability for data protection breaches and confidentiality, and require cyber insurance. Providers will resist, so prioritise according to the sensitivity and volume of data, and accept lower protection for low-risk services.
No exit plan
Deletion clauses that simply say data will be deleted "on termination" leave open format, timing and verification. Customers need data returned in a usable format, a transition period, deletion from backups within a defined time and written certification. Without these, a controller cannot show that it controlled data at the end of the relationship, and migration to a new provider becomes slow and expensive.
Cross-border angle: EU and UK clauses, Saudi Arabia, India, Singapore, China and Bangladesh
Many data processing agreements in the UAE sit within global contracts written for the EU GDPR or UK GDPR. These are a sound starting point, since the DIFC and ADGM regimes are closely aligned, but they need UAE-specific additions: the governing regime for each entity, references to the right Commissioner, transfer mechanisms recognised in the DIFC or ADGM, and sector localisation rules. ADGM also offers an addendum approach for parties already using EU clauses.
Saudi Arabia. The Saudi PDPL imposes its own processor and transfer requirements, so GCC-wide vendors need country schedules. India and Bangladesh. Many UAE businesses use service centres in India or Bangladesh; the agreement must address security, onward transfer and local law access to data. Singapore. The PDPA regulates data intermediaries and transfers, which matters for Asia-Pacific hubs. China. Providers processing data in China face local transfer and security rules that may affect audit and deletion promises. TRW & Co coordinates with counsel in each jurisdiction through its network.
How TRW & Co helps with data processing agreements in the UAE
Templates and playbooks
We prepare controller-side and processor-side templates with regime-specific schedules, plus a negotiation playbook setting fallback positions for each key clause.
Vendor contract reviews
We review provider addenda and master agreements against the PDPL, Article 24 of the DIFC law and section 26 of the ADGM Regulations, and negotiate the points that matter.
Intra-group frameworks
We design intra-group processing and transfer frameworks for groups spanning the mainland, free zones, the DIFC, the ADGM and overseas affiliates.
Regulated outsourcing
We align processing terms with Central Bank, DFSA, FSRA and health sector requirements on location, regulator access and exit.
SaaS and technology providers
For providers selling into the UAE, we build processor terms that customers in each regime can accept, reducing negotiation time. See SaaS and technology contracts.
Incidents and disputes
We advise on notification and cost allocation when a vendor suffers a breach, and on claims. Where representation before the DIFC or ADGM Courts is required, we work alongside registered practitioners.
This work often sits alongside cloud and outsourcing projects and privacy-by-design programmes. Read our guide to the UAE PDPL, see our practices, or contact us to review a template or a live negotiation.
Checklist for decision-makers
- Do we have a register of every provider processing personal data, with the contracting entity and regime for each?
- Have we classified each provider as processor, independent controller or joint controller?
- Do DIFC and ADGM agreements contain every element required by Article 24 or section 26?
- Is there a contractual breach notice deadline short enough for our own regulatory deadlines?
- Do we know each provider's sub-processors and where they process data?
- Are transfer mechanisms and sector localisation rules addressed in the agreement?
- Does the liability position reflect the volume and sensitivity of the data?
- Are intra-group arrangements documented and current?
- Is there an exit and deletion process with certification?
Data processing agreements in the UAE are moving from formality to front-line risk control. Getting the roles, schedules and liability right now will also make it easier to adapt when the federal regulator issues its detailed rules.
Frequently asked questions
01Is a data processing agreement legally required in the UAE?
In the DIFC and ADGM, yes: Article 24 of the DIFC Data Protection Law 2020 and section 26 of the ADGM Data Protection Regulations 2021 require a binding written contract with prescribed content. Under the federal PDPL, processors must act under the controller's instructions and the agreement between them, and detailed requirements are expected in Executive Regulations. In practice, a written agreement is the only reliable way to show compliance in all three regimes.
02Can we use our EU GDPR data processing addendum in the UAE?
It is a good base, because the DIFC and ADGM regimes are closely aligned with the GDPR. It still needs UAE schedules: the applicable regime for each contracting entity, the correct regulator, recognised transfer mechanisms, sector localisation rules such as those for health and payments, and dispute resolution that works in the UAE. For DIFC and ADGM processing, check each statutory element is present.
03Who is liable if our vendor suffers a data breach?
The controller remains responsible to regulators and data subjects for choosing a suitable processor and overseeing it, while the processor is liable for its own failures and, in the DIFC, fully liable to the controller for its sub-processors. Allocation between the parties depends on the contract: notification costs, investigation, regulatory penalties where recoverable and third-party claims should be addressed expressly, with a liability cap that reflects the risk.
04Do processors in the UAE need a data protection officer?
Under the PDPL, both controllers and processors must appoint a data protection officer in defined high-risk cases, such as large-scale processing of sensitive data or use of new technologies, with thresholds to be clarified by Executive Regulations. The DIFC requires DPOs for certain controllers and processors, including those carrying out high-risk processing on a systematic basis. ADGM has its own criteria. Check the regime for each entity.
05How should sub-processors be handled?
The DIFC requires the controller's prior written authorisation and makes the processor fully liable for sub-processors. ADGM follows a similar model. The PDPL is silent so far, so the contract must fill the gap. A common approach is general authorisation for listed sub-processors, advance notice of changes, a right to object and termination if objections cannot be resolved, with the same data protection terms flowed down.
06What happens to data when the contract ends?
The agreement should require the processor to return data in a usable format and delete remaining copies, including backups within a defined period, and to certify deletion in writing, unless law requires retention. Without clear exit terms, the controller may be unable to show it controlled data at the end of the relationship, and migration to a new provider becomes slower and more expensive.
07Does the new federal AI and data authority change our contracts now?
Not immediately. The Federal Authority for Artificial Intelligence and Data was announced on 14 June 2026 and brings together the UAE Data Office and other digital government functions. The PDPL's Executive Regulations were still awaited in October 2026. Draft agreements to the statutory text and international practice now, and include a change-in-law clause so that terms can be updated when detailed rules are issued.
Sources and official materials
- Federal Decree-Law No. 45 of 2021 (UAE Legislation) — Official text and status of the federal PDPL
- UAE Government portal: Data protection laws — Overview of federal, DIFC and sector data laws
- DIFC Data Protection Law, DIFC Law No. 5 of 2020 — Article 24 processor and sub-processor requirements
- ADGM processor standard contractual clauses — Template clauses for section 26 of the ADGM DPR 2021
- ADGM Office of Data Protection guidance — Guidance on the ADGM Data Protection Regulations 2021
- Dubai Media Office: DIFC Laws Amendment Law (July 2025) — Private right of action and scope changes from 15 July 2025
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
