UAE PDPL

What is the UAE PDPL?

Federal Decree-Law No. 45 of 2021 is the UAE’s first federal law dedicated to personal data protection. It follows familiar international principles: lawful processing, purpose limitation, minimisation, accuracy, security and accountability. It also created the UAE Data Office as the regulator.

Who does it apply to?

Processing of personal data of people residing or working in the UAE, by controllers and processors inside the UAE, and by those abroad processing data of people in the UAE. It does not apply to:

• government data and government bodies;
• free zones with their own data protection laws, notably the Dubai International Financial Centre (DIFC), with its Data Protection Law 2020, and Abu Dhabi Global Market (ADGM), with its Data Protection Regulations 2021;
• certain categories already governed by specific legislation, such as health and banking or credit data.

Key duties

• Process personal data on a valid basis, with consent as the default and specified exceptions.
• Give data subjects rights to information, access, portability, correction and erasure, restriction, objection, and objection to automated processing.
• Apply appropriate security measures, keep records of processing, and appoint a data protection officer in specified cases.
• Carry out impact assessments for high-risk processing, such as new technologies or large-scale sensitive data.
• Notify the Data Office, and affected individuals where needed, of breaches that may compromise privacy.
• Transfer data abroad only to adequate jurisdictions or under the safeguards the law allows.

Practical note

Many operational details depend on executive regulations. Organisations in DIFC or ADGM should follow their free-zone law, whose regulators have issued detailed guidance and enforce actively.

How does it relate to other frameworks?

DIFC’s and ADGM’s regimes are closely modelled on the GDPR. A GDPR-style programme gives a strong base for all three UAE regimes.