TRW & Co · Data protection
UAE Personal Data Protection Law (PDPL): Compliance Guide
The main UAE data protection law is the PDPL, Federal Decree-Law No. 45 of 2021, in force since 2 January 2022. It requires consent unless an exception applies, grants data subject rights, and regulates security, breaches, DPOs and transfers abroad. DIFC, ADGM and sector rules sit alongside it. Executive Regulations remain unconfirmed as of October 2026. Here is how to comply.
Key pointThe PDPL's compliance window runs from the issuance of the Executive Regulations, not from 2022, so businesses that build to the statute now will only need to fine-tune when the regulations are published, while those waiting will have to build an entire programme in a short window.
At a glance
In force since 2022
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data came into force on 2 January 2022 and applies to onshore and most free zone businesses.
Consent by default
Processing without consent is prohibited unless an exception applies, such as contract performance, legal obligations, employment, legal claims or public interest.
Regulations still awaited
As of October 2026 we could not confirm publication of the Executive Regulations or the Cabinet decision on penalties that the PDPL contemplates.
Separate DIFC and ADGM rules
Free zones with their own data protection laws, notably the DIFC and ADGM, are excluded from the PDPL and apply their own regimes and regulators.
Transfers need safeguards
Transfers abroad rely on adequacy, international agreements, binding contracts, express consent or specified necessity grounds such as contract performance or legal claims.
Swipe or scroll →
UAE data protection law: the short answer
The main UAE data protection law is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL), in force since 2 January 2022. It applies to processing of personal data of people in the UAE and to controllers and processors established in the UAE, wherever the processing happens, and it reaches overseas businesses that process the data of people in the UAE.
Its building blocks will be familiar to anyone who knows the GDPR: a default rule that processing needs consent unless an exception applies, transparency, data subject rights, security, breach notification, data protection officers in high-risk cases, impact assessments and controls on transfers abroad. The differences lie in the detail and in the enforcement picture.
That picture is unusual. The PDPL leaves much of the detail, and the sanctions, to Executive Regulations and a Cabinet decision on penalties. As of October 2026, we have not been able to confirm from official sources that either has been published, and the law gives businesses a compliance window that runs from the issuance of the Executive Regulations. The statute is in force, though, and its obligations are already relevant in contracts, regulator expectations and disputes. For advisory support, see our federal personal data protection page.
Which UAE data protection law applies to you
The UAE does not have a single privacy regime. Before building a programme, work out which rules apply to each entity and each data set.
| Regime | Who it covers | Regulator | Key point |
|---|---|---|---|
| Federal PDPL | Onshore and most free zone businesses; overseas processors of UAE residents' data | UAE Data Office | Executive Regulations and penalties decision awaited |
| DIFC Data Protection Law | Entities in the DIFC | DIFC Commissioner of Data Protection | Mature regime with its own guidance and enforcement |
| ADGM Data Protection Regulations 2021 | Entities in ADGM | ADGM Office of Data Protection | GDPR-style regime with its own guidance |
| Sector rules | Health data, banking and credit data and other regulated sectors | Sector regulators | Excluded from the PDPL where they have their own legislation |
The PDPL expressly excludes government data and government entities, data held by security and judicial authorities, personal data processed for purely personal purposes, health data and personal banking and credit data that have their own legislation, and free zones that have their own data protection laws. That is why entities in the DIFC and ADGM follow their own regimes. See our articles on the DIFC Data Protection Law and the ADGM Data Protection Regulations.
Core obligations under the PDPL
Consent and the exceptions
The starting point is strict: processing personal data without the data subject's consent is prohibited unless an exception applies. The exceptions are broad, however. They include processing necessary to perform a contract with the data subject, to comply with obligations under other UAE laws, to protect the data subject's interests, for employment and social security obligations, for legal claims, for certain medical and public-health purposes, for archiving and research, for public interest, and where the data subject has made the data public.
Where consent is used, the controller must be able to prove it. Consent must be specific, clear and unambiguous, given in writing or electronically, and capable of being withdrawn at any time, with withdrawal not affecting earlier lawful processing. In practice, most businesses should rely on contract and legal-obligation exceptions for core processing and reserve consent for marketing and optional uses.
Transparency and data subject rights
Data subjects have rights to information about the processing (purposes, recipients, retention, safeguards for transfers abroad and how to complain), to data portability in a structured, machine-readable format, to correction and, in defined circumstances, erasure, to restriction of processing, to object to direct marketing and certain statistical processing, and to object to automated decisions that have legal or serious effects. Controllers must provide clear channels for exercising these rights.
Security, DPIAs and records
Controllers and processors must apply appropriate technical and organisational measures, which the law illustrates with encryption, pseudonymisation, resilience, recovery and regular testing. A data protection impact assessment is required before high-risk processing, such as new technologies, large-scale profiling with significant effects or large-scale processing of sensitive data. Building this into product design is the core of privacy-by-design programmes.
Data protection officers
A DPO is required where processing poses a high risk because of new technologies or data volumes, involves systematic assessment of sensitive data including profiling, or involves large volumes of sensitive data. The DPO verifies compliance, handles requests and complaints, advises on assessments and security and liaises with the Data Office, and must be protected from penalty for doing that job.
Breach notification
Controllers must notify the Data Office on becoming aware of a breach that would prejudice the privacy, confidentiality or security of personal data, and must inform affected data subjects where the breach prejudices them. Processors must alert the controller as soon as they become aware. The detailed timing and content are left to the Executive Regulations. See data breach notification in the UAE.
Processors and contracts
Processors must act on the controller's instructions and apply appropriate security. The controller remains responsible for choosing processors that provide sufficient guarantees, so contracts with cloud providers, payroll firms and marketing platforms should cover instructions, security, sub-processing, breach notification, transfers, audit and return or deletion. See data processing agreements.
Cross-border transfers
Personal data may be transferred abroad where the destination has adequate data protection legislation and an enforcing authority, as approved by the Data Office, or where the UAE is party to a relevant bilateral or multilateral agreement. Where neither applies, transfers may proceed under binding contractual safeguards, with the data subject's express consent where that is not contrary to public or security interests, or where the transfer is necessary for purposes such as legal claims, performance of a contract or international judicial cooperation.
Because the adequacy approvals and detailed conditions are expected in implementing measures, many businesses use contractual safeguards modelled on international standard clauses as a practical baseline. Sector rules may impose stricter localisation, especially for health and some financial data. See cross-border data transfers and data localisation.
Enforcement status: Executive Regulations and penalties
The PDPL contemplated Executive Regulations within six months of its promulgation and left the list of violations and administrative penalties to a Cabinet decision. It also gives controllers and processors a period, from the issuance of the Executive Regulations and extendable by the Cabinet, to bring themselves into compliance. Fine figures quoted online for PDPL breaches should be treated with caution unless traced to a published Cabinet decision.
As of October 2026, we have not been able to confirm from official sources that the Executive Regulations or the penalties decision have been published. The UAE Government portal describes the UAE Data Office, established by Federal Decree-Law No. 44 of 2021, as the federal data regulator. Data subjects may complain to the Data Office, and challenges to its decisions require a prior grievance.
The pending detail is not a reason to wait. The statute is in force, multinational partners already demand PDPL-compliant terms, sector regulators expect data governance, and other laws such as the cybercrime law and civil liability rules apply to misuse of personal data. Once the regulations are published, the compliance window will be short for anyone starting from zero.
Build to the statute now and calibrate later. A programme based on the PDPL text, with records of processing, a lawful-basis map, notices, processor contracts, a breach plan and transfer safeguards, will need fine-tuning when the Executive Regulations appear, not rebuilding.
Building a PDPL compliance programme
- Map your entities and regimes. Identify which entities are onshore, in a free zone, in the DIFC or ADGM, or in a regulated sector, and which UAE data protection law applies to each.
- Inventory personal data. Record what data you hold, where it comes from, why you use it, who receives it, where it is stored and how long you keep it.
- Assign a lawful basis. For each processing activity, identify the PDPL exception relied on or the consent obtained, and fix gaps, especially in marketing.
- Update notices and rights handling. Publish clear notices and set up a process and timetable for access, correction, erasure, portability and objection requests.
- Contract with processors and for transfers. Put processor terms in place and adopt transfer safeguards for group and vendor data flows abroad.
- Secure and test. Apply security measures proportionate to risk, run DPIAs for high-risk processing and appoint a DPO where required.
- Prepare for breaches. Adopt an incident response plan with roles, evidence preservation and notification decision-making.
- Monitor developments. Track the Executive Regulations, any penalties decision and Data Office guidance, and adjust.
Applying the UAE data protection law to employees
HR data is where most businesses hold the largest volume of sensitive information: passports, visas, Emirates ID copies, medical certificates, family details and payroll records. The PDPL's employment and legal-obligation exceptions cover much of this processing without consent, but transparency still applies, so give staff a clear employee privacy notice explaining what is collected, why, who receives it (including group companies and payroll providers abroad) and how long it is kept.
Workplace monitoring, such as CCTV, email review and device tracking, should be proportionate, explained in policy and limited to legitimate purposes. Retention rules should reflect labour-law and immigration record-keeping requirements, then delete. Under the UAE data protection law, an employee can exercise access and correction rights, and such requests often surface during disputes, so prepare a process before the first one arrives.
Applying the UAE data protection law to marketing
Data subjects may object to processing for direct marketing, and marketing profiles built from browsing or purchase history are a classic consent use case. Keep proof of consent, honour objections promptly across every channel and vendor, and avoid buying lists whose provenance you cannot verify. Telecoms and consumer-protection rules may impose additional requirements on marketing messages, so check them alongside the PDPL.
Vendors and group sharing
Most data leaves a business through vendors and group companies: cloud hosting, CRM, payroll, call centres and parent-company analytics. Keep a register of processors and recipients, carry out proportionate due diligence on their security, and make sure every flow abroad has a transfer basis. When the UAE data protection law's Executive Regulations are published, this register will be the quickest way to identify contracts that need amending.
Illustrative scenario: a regional e-commerce platform
Illustrative only; generic parties. A Dubai mainland e-commerce company sells to customers across the UAE, stores data with a cloud provider abroad and runs targeted marketing. Its parent is in Singapore and accesses customer data for analytics.
Under the PDPL, it relies on contract performance for order processing and on consent for marketing profiles. It publishes a notice describing the overseas cloud and group access, and puts contractual transfer safeguards in place with the cloud provider and the parent. Because it profiles customers at scale, it carries out an impact assessment and appoints a DPO. When the Executive Regulations are published, it reviews breach-notification timing and any adequacy list rather than starting from scratch.
Common mistakes
Assuming the PDPL is not yet in force
The PDPL has been in force since 2 January 2022. What remains pending is detail and the penalties decision. Contract counterparties, regulators and courts already expect personal data to be handled lawfully, and other legislation, including the cybercrime law, applies to misuse of data. Treating the law as dormant leaves a business exposed when the regulations land and the compliance window starts.
Copying a GDPR policy unchanged
The PDPL resembles the GDPR but differs in structure: consent is the default rule with listed exceptions rather than one of six equal lawful bases, and exclusions, transfer rules and DPO triggers differ. A GDPR policy is a good start but needs UAE-specific adjustments, especially for transfers and for which regime applies to each entity.
Ignoring the DIFC and ADGM split
A group with an onshore company and a DIFC or ADGM entity must comply with different regimes, regulators and breach rules. One policy can serve both, but registrations, notifications and transfer mechanisms must reflect each regime.
Over-relying on consent
Consent can be withdrawn at any time and must be provable. Using it for core processing, such as employment or order fulfilment, creates fragility. Use the contract, legal-obligation and employment exceptions where they genuinely apply.
Forgetting sector rules
Health data and banking and credit data are governed by their own legislation and regulators, sometimes with localisation requirements. Healthcare providers, insurers and financial institutions should map sector rules first. See healthcare regulation.
Cross-border groups and AI
Groups with operations in Bangladesh, India, Saudi Arabia, the UK or Singapore face overlapping regimes. A single group framework works best when it is built to the strictest common standard and then supplemented with local requirements, including the UAE data protection law's transfer and breach rules.
AI use raises particular PDPL points: automated decisions with legal or serious effects, profiling, sensitive data and impact assessments. See AI regulation in the UAE.
Next steps
Start with the regime map and the data inventory; everything else depends on them. To scope a PDPL programme, review processor contracts or prepare for the Executive Regulations, contact TRW & Co.
Frequently asked questions
01Is the UAE PDPL in force?
Yes. Federal Decree-Law No. 45 of 2021 came into force on 2 January 2022. What remains pending is detail: the Executive Regulations that flesh out many obligations and the Cabinet decision that will list violations and penalties. The law gives businesses a compliance period running from the issuance of the Executive Regulations. As of October 2026, we have not been able to confirm from official sources that either instrument has been published, so check the latest position before relying on any timetable.
02Does the PDPL apply to companies in the DIFC or ADGM?
Generally no. The PDPL excludes free zones that have their own data protection legislation. The DIFC has its own Data Protection Law with a Commissioner of Data Protection, and ADGM has the Data Protection Regulations 2021 supervised by its Office of Data Protection. A group with entities onshore and in a financial free zone will usually need to comply with both regimes for the respective entities and data flows.
03Do I need a data protection officer under UAE law?
Under the PDPL, a DPO is required where processing poses a high risk because of new technologies or the volume of data, involves systematic assessment of sensitive data including profiling, or involves large volumes of sensitive data. The DPO may be an employee or an external appointee. Even where not mandatory, appointing someone responsible for privacy is good practice. DIFC and ADGM have their own DPO rules.
04What are the penalties for breaching the UAE data protection law?
The PDPL does not itself set fine amounts. It leaves the list of violations and administrative penalties to a Cabinet decision. As of October 2026, we have not been able to confirm that this decision has been published, so treat specific fine figures quoted online with caution. Separate liability can still arise under other laws, such as the cybercrime law, civil liability rules and sector regulations, and under contracts with business partners.
05Can personal data be transferred outside the UAE?
Yes, subject to conditions. Transfers are permitted to countries with adequate data protection laws approved by the Data Office or covered by relevant international agreements. Otherwise, they may be made under binding contractual safeguards, with the data subject's express consent where not contrary to public or security interests, or where necessary for purposes such as performing a contract or pursuing legal claims. Sector rules for health or financial data may impose stricter localisation.
06How is the UAE PDPL different from the GDPR?
The overall shape is similar, but there are important differences. Consent is the default requirement with listed exceptions, rather than one of several equal lawful bases. The law excludes government data, health and banking data covered by their own laws, and free zones with their own regimes. Much operational detail, including breach timelines, is left to Executive Regulations, and penalties depend on a Cabinet decision. A GDPR programme is a strong base but needs UAE-specific adaptation.
Sources and official materials
- Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data — Full text of the federal PDPL
- Data protection laws - UAE Government portal — Overview of the PDPL and the UAE Data Office
- ADGM Office of Data Protection — ADGM Data Protection Regulations 2021 and guidance
- Dubai International Financial Centre — DIFC Data Protection Law and Commissioner
- ADGM data protection guidance — Practical guidance on ADGM data protection obligations
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
