TRW & Co · Data, Privacy & Cyber
Privacy Compliance Programmes in the UAE
Privacy compliance programmes in the UAE turn data protection law into daily practice: records of processing, impact assessments, privacy by design, DPOs, supplier controls and board reporting. With the federal PDPL, the DIFC and ADGM regimes and sector rules all in play, a well-built programme is what regulators, banks and investors now ask to see.
Key pointOnshore businesses that wait for the PDPL Executive Regulations are taking a risk: the statutory duties already apply, and in the DIFC individuals have been able to sue for compensation directly since July 2025.
At a glance
Three main regimes
Federal Decree-Law No. 45 of 2021 applies onshore and in most free zones; the DIFC and ADGM run their own GDPR-style data protection laws.
PDPL regulations pending
The PDPL has applied since 2 January 2022, but its Executive Regulations, including penalties and timelines, had not been published at the time of writing.
DIFC private claims
Amendments in force from 15 July 2025 let individuals claim compensation in the DIFC Courts and make processors directly liable for their own failings.
Impact assessments required
All three regimes expect an assessment before high-risk processing begins, such as new technologies, large-scale sensitive data or systematic profiling.
Children's data rules
The Child Digital Safety Law took effect on 1 January 2026, restricting platforms' processing of under-13s' data, with a one-year compliance window.
Swipe or scroll →
What privacy compliance programmes in the UAE cover
Privacy compliance programmes in the UAE are the standing governance, processes and evidence an organisation uses to handle personal data lawfully every day, not just when something goes wrong. A programme answers four questions on an ongoing basis: what personal data do we hold, why and under which law, who is accountable for it, and how can we prove we are in control.
That makes a programme different from a one-off policy exercise. A privacy notice and a consent banner are outputs; the programme is the machinery behind them: a record of processing, a risk assessment method, privacy-by-design checkpoints in product and procurement, a rights-handling workflow, supplier controls, training and periodic assurance. Regulators in the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) expect to see that machinery working, and the federal regime is built on the same accountability idea.
The question usually becomes urgent at a predictable moment: a licence application or renewal in a financial free zone, a bank or government customer sending a security and privacy questionnaire, a new app or AI feature about to launch, a group expanding from a free zone onshore, or an investor's due diligence. In each case the organisation is asked to show its programme, not describe its intentions.
The legal map a privacy programme has to cover
The first design task is to map which regimes apply to which entity and which dataset. The UAE does not have one privacy law; it has a federal law, two common-law-style free-zone regimes, and sector and emirate rules layered on top. Privacy compliance programmes in the UAE that ignore this layering tend to over-engineer one area and miss another.
The federal Personal Data Protection Law
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL) has applied since 2 January 2022 to processing onshore and in free zones that do not have their own data protection law. The text is available on the UAE Legislation portal.
Article 2 excludes, among other things, government data, health and banking or credit data governed by their own legislation, and entities in free zones with their own regimes. The law sets processing principles (Article 5), conditions for valid consent (Article 6), controller and processor duties (Articles 7 and 8), a duty to appoint a data protection officer for high-risk or large-scale sensitive processing (Article 10), and a duty to assess the impact of high-risk processing before it starts (Article 21).
The Executive Regulations that are meant to fill in detail, including penalties and timelines, had still not been published at the time of writing, and onshore enforcement has been limited.
The UAE Data Office, created by Federal Decree-Law No. 44 of 2021, is the named regulator; in June 2026 the government approved a new federal authority for artificial intelligence and data that brings the Data Office together with other digital-government functions. A programme should be built to the statutory text now, so that it needs adjusting rather than rebuilding when the regulations arrive. The government's data protection laws overview lists the federal and emirate instruments, and our page on federal personal data protection covers the PDPL in detail.
DIFC and ADGM
The DIFC Data Protection Law, DIFC Law No. 5 of 2020, is the most prescriptive programme regime in the country. Controllers and processors must file and keep updated a notification with the Commissioner of Data Protection; DIFC bodies and firms carrying out high-risk processing on a systematic or regular basis must appoint a data protection officer, who completes an annual assessment in the Commissioner's form.
The DIFC Data Protection Regulations were extended in 2023 to address processing through autonomous and AI systems. The DIFC publishes the law, regulations and filing portal. Amendments made by DIFC Law No. 1 of 2025, in force from 15 July 2025, gave individuals a right to claim compensation directly in the DIFC Courts and made processors directly liable. See our page on DIFC data protection.
The ADGM Data Protection Regulations 2021 follow the GDPR closely: a data protection fee and registration with the Commissioner, impact assessments for high-risk processing, a data protection officer in defined cases, and administrative fines of up to USD 28 million. The ADGM Office of Data Protection publishes guidance and templates, and our page on ADGM data protection explains the regime.
Sector and emirate overlays
Health data is governed by Federal Law No. 2 of 2019 on the use of information and communications technology in health fields, which applies in free zones too and restricts storing and transferring health data outside the UAE except as permitted, alongside emirate health authority standards.
Financial institutions licensed by the Central Bank of the UAE face consumer protection and data rules and, since 2026, a new operational risk regulation. Dubai government data is governed by Dubai Law No. 26 of 2015 on data dissemination and exchange.
The Child Digital Safety Law, Federal Decree-Law No. 26 of 2025, in force from 1 January 2026 with a one-year compliance window, restricts processing the personal data of children under 13 by digital platforms without verifiable guardian consent and bars targeted advertising to them.
| Programme element | Federal PDPL | DIFC DP Law 2020 | ADGM DPR 2021 |
|---|---|---|---|
| Registration or notification | No general registration in force | Notification to the Commissioner, kept up to date; public register | Registration and annual data protection fee |
| Data protection officer | Required for high-risk or large-scale sensitive processing (Art. 10) | Required for DIFC bodies and systematic high-risk processing; UAE residence expected | Required in defined cases, including high-risk processing |
| Impact assessment | Before high-risk processing, including new technologies (Art. 21) | Before high-risk processing | Before processing likely to create high risk |
| Annual assurance | Not specified pending Executive Regulations | DPO annual assessment to the Commissioner | Accountability records available on request |
| Private claims | Complaints route; detail awaited | Direct compensation claims in the DIFC Courts since July 2025 | Compensation claims available under the Regulations |
Privacy by design: what the law actually requires
"Privacy by design" is often treated as a slogan. In the UAE it has concrete legal anchors. The PDPL requires controllers to apply appropriate technical and organisational measures and to collect only what is necessary for a specified purpose. The DIFC law requires appropriate security measures and, for online services, default settings that collect no more than the minimum data needed. The ADGM regulations, modelled on the GDPR, expressly require data protection by design and by default.
In practice, privacy by design means inserting decision points into the processes that create new processing. The three that matter most are product development (new apps, features, analytics and AI models), procurement (any supplier that will touch personal data) and change management (new systems, migrations and integrations). At each point a short screening questionnaire decides whether a full impact assessment is needed, and the outcome is recorded.
A regulator will not ask whether you have a privacy policy. It will ask to see the impact assessment for the feature you launched last quarter, and who signed it off.
For AI features, the screening should capture whether the system makes or supports decisions about individuals, what training and input data it uses, and whether outputs could reveal personal data. Our page on AI governance in the UAE covers model governance; the privacy programme should own the personal data questions and feed into that governance rather than duplicate it.
Key design decisions for privacy compliance programmes in the UAE
One group programme or one per regime?
Most groups with entities onshore, in a free zone and in the DIFC or ADGM do best with one group standard set to the strictest common requirements, plus short regime-specific annexes for registrations, DPO duties and filings. Running three separate programmes multiplies documents without improving control. The exception is a regulated financial entity whose regulator expects to see entity-level governance; it needs its own accountable owner even within a group framework.
Who is the data protection officer?
The DPO decision is legal as well as organisational. The DIFC expects the DPO to be resident in the UAE unless a group employee performs the role internationally, and the role must be independent enough to challenge the business. An outsourced DPO can work for smaller entities, but the board still owns the risk. Where the PDPL threshold is met, a DPO must be appointed onshore too, with access to senior management and adequate resources.
Lawful basis strategy
The PDPL leans more heavily on consent than the GDPR, with listed exceptions rather than a broad legitimate interests ground. A programme designed in Europe that relies on legitimate interests for marketing, analytics or employee monitoring needs re-mapping onshore. In the DIFC and ADGM, legitimate interests are available but need a documented balancing test.
Centralised or embedded operations
Rights requests, supplier reviews and impact assessments can run from a central privacy team or be embedded in business units with central oversight. Embedded models scale better but need clear templates, training and a register that the central team can monitor. Either way, decide who can approve high-risk processing, and write it down.
Do not wait for the PDPL Executive Regulations before building an onshore programme. The statutory duties already apply, the regulations are expected to give a short compliance window when they arrive, and counterparties such as banks and government buyers already ask for the evidence a programme produces.
Building the programme step by step
A workable programme can be built in phases. The sequence below is the one we use for privacy compliance programmes in the UAE, scaled to the size and risk of the business.
- Scope the entities and regimes. List every legal entity, where it is licensed (onshore emirate, free zone, DIFC or ADGM), its regulators and the countries whose residents' data it handles. This determines which laws and filings apply.
- Map the data. Build a record of processing for each entity: categories of data and individuals, purposes, lawful basis, systems, recipients, transfers abroad and retention. Start with the highest-risk activities: HR, customer onboarding, health, biometrics, children and marketing.
- Set governance. Appoint the DPO where required, name accountable owners in each business unit, and agree board reporting. Document who can approve high-risk processing and cross-border transfers.
- Write the core framework. Adopt a group data protection policy, a privacy-by-design and impact assessment procedure, a rights-handling procedure, a retention schedule, a transfer procedure and an incident procedure that links to your data breach response plan.
- Fix the supply chain. Inventory suppliers that process personal data, risk-rank them, and put compliant terms in place. Our page on data processing agreements sets out the clauses each regime expects.
- Make the filings. Complete DIFC notifications or ADGM registration and fees, confirm DPO details with the relevant Commissioner, and diarise renewals and the DIFC annual assessment.
- Train and embed. Run role-based training for HR, marketing, product, IT and customer teams, and add privacy checkpoints to product and procurement workflows so the programme operates without the privacy team in every meeting.
- Assure and report. Test controls at least annually, track metrics such as rights requests, impact assessments completed and supplier reviews, and report to the board with a short remediation plan.
Documents and evidence a programme should produce
The value of privacy compliance programmes in the UAE lies in the evidence they generate. If a regulator, investor or customer asks, the following should exist and be current:
- Record of processing activities for each entity, owned by a named person and reviewed at least annually.
- Impact assessments for high-risk processing, with the screening decision for processing that did not need a full assessment.
- Privacy notices for customers, employees, candidates and website users, in Arabic and English where the audience requires it.
- Lawful basis and consent records, including how consent was captured and how it can be withdrawn.
- Transfer assessments for data leaving the UAE or the relevant free zone, with the mechanism relied on. Our page on cross-border data transfers explains the options.
- Supplier register and contracts showing due diligence and processing terms.
- Rights request log showing receipt, verification, response and timing.
- Training records, board minutes and annual assurance reports, including the DIFC DPO annual assessment where applicable.
Employee data deserves particular care because it is often the largest and least governed dataset. Monitoring, background checks and biometric access controls should be covered by impact assessments and reflected in your employment policies.
Risks and common mistakes
Copying a GDPR programme without adapting it
Many groups import a European programme and assume it covers the UAE. It covers much of the DIFC and ADGM.
Onshore, however, the PDPL's narrower lawful bases, its exclusions for health and banking data, and sector data localisation rules mean some processing needs a different legal footing. Health data held by a clinic in Dubai, for example, is governed by the federal health ICT law and emirate standards rather than the PDPL. The fix is a UAE gap assessment that maps each high-risk activity to the regime that actually governs it, then adjusts lawful bases, notices and transfer mechanisms accordingly.
Treating "no Executive Regulations" as "no obligations"
The absence of PDPL Executive Regulations has led some onshore businesses to defer compliance. That is a risky reading. The statutory duties, including lawful processing, security, impact assessment and breach notification, are in force. Counterparties increasingly impose PDPL compliance contractually, and when the regulations are issued the compliance window may be short. Building a proportionate programme now spreads the cost and avoids a rushed remediation later. It also positions the business better if a complaint or incident reaches the regulator before the detailed rules exist.
Missing DIFC or ADGM filings and renewals
Free-zone filings are easy to miss because they sit outside the commercial licence renewal cycle. A DIFC entity whose notification is out of date, or whose DPO has left without a replacement being notified, is in breach regardless of how good its policies are. ADGM registration and fees have their own timetable. These are among the most visible failures because the Commissioners can check them from their own records. Put every filing, renewal and DPO change into a compliance calendar with a named owner.
Impact assessments done after launch
An impact assessment completed after a product or system goes live is evidence that the programme did not work. It also forfeits the main benefit: the chance to change design choices cheaply. Common examples are customer analytics, CCTV and biometric access, employee monitoring tools and AI features added to existing products. Build a short screening step into product approval and procurement, so that high-risk processing is caught before contracts are signed and code is shipped.
Ignoring children's data
Apps, games, education and retail platforms often process children's data without realising it. The Child Digital Safety Law, in force since 1 January 2026, sets specific restrictions for children under 13 and age-verification expectations for platforms, with a one-year window for compliance. A programme should identify any service likely to be used by children and assess consent, profiling and advertising practices against that law as well as the general data protection regime.
Cross-border angle: aligning with the UK, EU, Saudi Arabia, India, Singapore, China and Bangladesh
UAE groups rarely process data only in the UAE. A group with a UK or EU presence will already run UK GDPR or GDPR controls; the UAE programme should reuse those artefacts but re-check lawful bases onshore and the DIFC and ADGM filings. Saudi Arabia's Personal Data Protection Law has its own registration, transfer and DPO rules, so Gulf groups need a GCC view rather than assuming one regime covers both.
India's Digital Personal Data Protection Act 2023 and Singapore's PDPA matter for shared service centres and outsourced operations, which often sit in those countries. China's Personal Information Protection Law imposes strict outbound transfer controls, so data flowing from China into a UAE hub may need assessments at the Chinese end before it arrives. For groups with operations in Bangladesh, where data protection legislation has been developing, contractual controls and group policies do most of the work and should be drafted with likely future requirements in mind.
The practical answer is a single group control set with jurisdiction annexes and a transfer map showing where each dataset flows. TRW & Co's offices in Dhaka, Singapore and London help coordinate those annexes with local counsel where needed.
How TRW & Co helps with privacy compliance programmes in the UAE
We design and run privacy compliance programmes in the UAE that are proportionate to the business and produce evidence a regulator or customer will accept.
Regime mapping and gap assessment
We map each entity and dataset to the PDPL, DIFC, ADGM and sector rules, and deliver a prioritised gap list. The output tells you what to fix first and what can wait.
Programme design and documentation
We draft the group policy, impact assessment method, retention schedule, rights procedure and regime annexes. Documents are written to be used by operational teams, not filed.
Privacy by design for products and AI
We build screening questionnaires and impact assessments into product and procurement workflows, and review new features, analytics and AI tools before launch.
DPO support and filings
We support appointed DPOs, prepare DIFC notifications and annual assessments, and ADGM registrations. Where an interim or outsourced DPO model is needed, we help structure it.
Supplier and transfer controls
We review supplier contracts, negotiate processing terms with cloud and SaaS providers and build transfer assessments for data leaving the UAE or a free zone.
Assurance and board reporting
We test the programme against its own standards, prepare board reports and help you respond to regulator enquiries, customer audits and investor due diligence.
Where a matter turns into a dispute before the DIFC Courts, ADGM Courts or UAE onshore courts, we work alongside locally licensed advocates and registered practitioners. See our practices for related services, or contact us to scope a programme review.
Checklist for decision-makers
- Do we know, for each entity, whether the PDPL, DIFC law, ADGM regulations or a sector law governs our main datasets?
- Is there a current record of processing for each entity, with a named owner?
- Have we appointed a DPO where the PDPL, DIFC or ADGM thresholds are met, and notified the relevant Commissioner?
- Do new products, AI tools and suppliers pass a privacy screening before launch or signature?
- Are our DIFC notification and annual assessment, or ADGM registration and fee, up to date?
- Have we mapped data flows out of the UAE and documented the transfer basis for each?
- Do we know whether any service is used by children, and have we assessed it against the Child Digital Safety Law?
- Does the board receive a privacy report at least annually, with metrics and a remediation plan?
A mature programme is the foundation for every other privacy question, from transfers to incidents. If any answer above is "not sure", privacy compliance programmes in the UAE should be on the next board agenda.
Frequently asked questions
01Is the UAE PDPL actually enforceable without its Executive Regulations?
The PDPL has applied since 2 January 2022, and its core duties, including lawful processing, security, impact assessments and breach notification, are in the statute itself. What is missing is the detail on penalties, timelines and procedures, which is left to Executive Regulations that had not been published at the time of writing. Onshore enforcement has therefore been limited. The practical risk is contractual and reputational as much as regulatory: banks, government buyers and investors already require PDPL compliance, and a short window is expected once the regulations are issued.
02Do we need a data protection officer in the UAE?
It depends on the regime and the processing. Under Article 10 of the PDPL, a DPO is required for high-risk processing or large-scale sensitive data. In the DIFC, DIFC bodies and firms carrying out high-risk processing on a systematic or regular basis must appoint one, generally resident in the UAE, who completes an annual assessment. In the ADGM, a DPO is required in defined cases including high-risk processing. Many groups appoint one DPO with local deputies, provided each entity can access the DPO easily.
03What does privacy by design mean in practice?
It means building privacy checks into the processes that create new processing, rather than reviewing after the event. In practice that is a short screening questionnaire in product development, procurement and IT change management, which decides whether a full impact assessment is needed. The assessment records risks, mitigations and sign-off. The ADGM regulations expressly require data protection by design and by default, and the PDPL and DIFC law require appropriate technical and organisational measures and data minimisation.
04Can one group programme cover onshore, DIFC and ADGM entities?
Yes, and it is usually the most efficient approach. Set one group standard at the strictest common level, then add short annexes for each regime's registrations, DPO duties, filings and lawful-basis differences. The PDPL's narrower lawful bases mean some onshore activities need separate treatment. Regulated financial entities in the DIFC or ADGM should still have an accountable owner at entity level, because their regulators expect entity-specific governance.
05How long does it take to build a privacy programme?
For a mid-sized group, a first phase covering regime mapping, records of processing for high-risk activities, core policies and urgent filings can often be completed within a few months, depending on the number of entities and how much documentation exists. Embedding privacy by design, supplier remediation and training typically runs over a longer period. The priority order matters more than speed: filings, high-risk processing and supplier contracts first, then refinement.
06How do privacy programmes interact with AI tools?
AI tools often involve new technology, profiling or large-scale data, which are exactly the triggers for an impact assessment under the PDPL, DIFC and ADGM regimes. The DIFC also updated its regulations in 2023 to address processing through autonomous and AI systems. The privacy programme should screen AI tools before adoption, assess training and input data, and feed into wider AI governance rather than duplicating it.
07What do regulators or customers usually ask to see?
Typically the record of processing, recent impact assessments, privacy notices, the DPO appointment, supplier contracts and due diligence, transfer assessments, the rights-request log, training records and board reporting. In the DIFC, the DPO's annual assessment and the entity's notification are also checked. Having these ready, current and consistent with each other is the clearest evidence that a programme works.
Sources and official materials
- UAE data protection laws (u.ae) — Official overview of the PDPL, Data Office and related laws
- UAE Legislation portal — Federal Decree-Laws No. 44 and 45 of 2021 and other federal texts
- ADGM Office of Data Protection — ADGM Data Protection Regulations 2021, guidance and registration
- Dubai International Financial Centre — DIFC Data Protection Law 2020, Regulations and Commissioner
- Central Bank of the UAE — Consumer protection and operational rules for licensed institutions
- Telecommunications and Digital Government Regulatory Authority — Federal digital government and information assurance policy
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
