UAE PDPL: Data Protection in the UAE, DIFC and ADGM

The UAE PDPL, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, is the United Arab Emirates' federal privacy law. It took effect on 2 January 2022 and sets GDPR-like principles: processing needs consent or another lawful basis, individuals have rights over their data, and organisations must secure data, report breaches and control transfers abroad. It applies across the UAE mainland and most free zones, and to foreign organisations processing data of people in the UAE.

Two features make the UAE different. First, the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) have their own, separately enforced data protection laws. Second, the PDPL's Executive Regulations, which set out details, deadlines and penalties, had still not been issued as of October 2026. This guide explains the law, its exclusions, the free zone regimes, and how SaaS and IT companies should prepare.

What is the UAE PDPL?

The PDPL was issued in late 2021 as part of a package of laws modernising the UAE's legal framework, alongside Federal Decree-Law No. 44 of 2021 establishing the UAE Data Office as the federal data regulator. The law covers processing of personal data by electronic or other means, within or outside the UAE, of data subjects in the UAE. It applies to controllers and processors established in the UAE and to those outside the UAE that process personal data of data subjects inside it.

In 2026, the UAE announced the consolidation of the UAE Data Office with other bodies into a new federal authority for artificial intelligence and data, which is expected to take over data protection oversight.

What is excluded?

• Government data and government entities that control or process personal data.
• Personal data held by security and judicial authorities.
• Personal data processed for personal purposes.
• Health personal data covered by its own legislation.
• Banking and credit personal data covered by its own legislation.
• Companies and institutions located in free zones that have their own data protection legislation, namely the DIFC and ADGM.

Is it mandatory or voluntary?

The PDPL is mandatory law. However, the law contemplated Executive Regulations to set out procedures, deadlines for compliance and the details of many obligations, and an administrative penalties decision. As of October 2026, analyses reported that these had not been published, and no enforcement decisions under the PDPL had been made public. In practice, organisations should align now, because obligations exist in the law itself, clients expect compliance, and regulations could be issued with short transition periods.

Legal bases for processing

Processing generally requires the data subject's consent, which must be specific, clear and unambiguous, given through a clear positive action, and capable of withdrawal. The PDPL lists cases where processing is permitted without consent, including:

• processing necessary to perform a contract to which the data subject is party or to take steps at their request;
• processing necessary to comply with legal obligations;
• processing necessary to protect the data subject's interests;
• processing necessary for public interest, medical, public health or legal claims purposes, in specified circumstances;
• processing of data that the data subject has made public.

Unlike the GDPR, the PDPL does not include a general legitimate interests basis.

Data subject rights

• The right to obtain information about processing, including purposes, recipients, retention and safeguards.
• The right to data portability in a structured, machine-readable format, where technically feasible.
• The right to correction or erasure of inaccurate data or data no longer needed.
• The right to restrict processing in specified cases.
• The right to stop processing, including for direct marketing.
• The right to object to decisions based solely on automated processing that have legal or serious effects.

Controller and processor obligations

• Process data fairly, transparently and lawfully, for specific and clear purposes.
• Collect only adequate, relevant and limited data, and keep it accurate.
• Retain data only as long as necessary, then delete or anonymise it.
• Implement appropriate technical and organisational security measures, including privacy by design.
• Keep records of processing activities.
• Appoint processors with sufficient guarantees and bind them by contract; processors must follow instructions and keep records.
• Conduct data protection impact assessments for high-risk processing, such as new technologies or large-scale sensitive data.
• Appoint a data protection officer where processing involves high risk, systematic evaluation of sensitive data, or large-scale processing of sensitive data.

Sensitive data

Sensitive personal data includes data revealing family, racial or ethnic origin, political or philosophical opinions, religious beliefs, criminal records, biometric data, health data and genetic data. Processing it requires stronger protection and, in many cases, impact assessments and DPO involvement.

Breach notification

Controllers must notify the regulator of a personal data breach that would prejudice the privacy, confidentiality or security of personal data, as soon as they become aware, within the time and procedures to be set by the Executive Regulations, with details of the breach, its likely effects and measures taken. They must also notify affected data subjects where the breach would prejudice their privacy. Processors must notify controllers promptly. Until the regulations set a timeframe, organisations commonly plan for notification within a few days, in line with regional and international practice.

Cross-border transfers

Personal data may be transferred outside the UAE to countries with legislation providing an adequate level of protection, as approved by the regulator, or to countries without such approval in specified cases, such as through contracts that require the recipient to apply the PDPL's protections, with the data subject's express consent, where necessary for a contract or legal claims, or for international judicial cooperation. The detailed rules depend on the Executive Regulations. Sector rules, such as those of the Central Bank, health authorities and government entities, may impose stricter localisation.

DIFC and ADGM regimes

Regime	Law	Key features
UAE federal	Federal Decree-Law No. 45 of 2021	Applies outside DIFC and ADGM; Executive Regulations pending.
DIFC	DIFC Data Protection Law No. 5 of 2020 and regulations	GDPR-style law with an active Commissioner of Data Protection, fines, DPO and notification duties, and provisions on autonomous systems.
ADGM	ADGM Data Protection Regulations 2021	Closely modelled on the GDPR, with its own Office of Data Protection and enforcement.

Companies with entities in more than one jurisdiction may need to comply with several regimes. The DIFC and ADGM regimes are fully operational, with registration, notification and enforcement.

Why prepare before the regulations arrive

It is tempting to wait for the Executive Regulations, but there are good reasons not to. The law's core obligations, such as lawful processing, consent, rights, security and transfer conditions, are already in the decree-law. Large UAE clients, especially in regulated sectors and multinational groups, already require PDPL-aligned contracts and practices from vendors. When the regulations are issued, they may set transition periods that are short relative to the engineering work needed for consent management, data subject requests and logging. Organisations that have mapped data and built core processes will only need to fine-tune.

Vendors and offshore teams

Many UAE businesses outsource software development and support to teams in India and elsewhere. Access to UAE personal data from abroad is a cross-border transfer and must meet the PDPL's transfer conditions, and possibly sector restrictions. Practical measures include keeping production data in UAE regions where required, giving offshore teams access only to masked or synthetic data, using logged and approved support sessions for any production access, and signing processor agreements that set security, confidentiality, breach notification and deletion obligations. Documenting these measures helps both compliance and client trust.

Marketing and online tracking

The PDPL gives individuals the right to stop processing for direct marketing, and consent is the main basis for most marketing uses of personal data. Telecommunications rules also regulate unsolicited marketing messages. While the UAE has no dedicated cookie law like the EU's, using tracking technologies to collect personal data still needs a lawful basis under the PDPL, and DIFC and ADGM rules are stricter. Many businesses serving UAE users therefore use consent banners and preference centres similar to those used for EU audiences.

How to prepare, step by step

1. Determine which regimes apply: federal PDPL, DIFC, ADGM, and sector rules.
2. Map personal data, sensitive data, purposes, legal bases and transfers.
3. Review consent, since there is no general legitimate interests basis under the PDPL.
4. Publish clear privacy notices in Arabic and English.
5. Set up data subject request handling, including portability.
6. Keep records of processing and run impact assessments for high-risk processing.
7. Appoint a DPO where required.
8. Prepare breach procedures ready to align with regulatory timeframes.
9. Put transfer contracts in place and assess sector localisation rules.
10. Monitor for the Executive Regulations and new authority guidance.

Other free zones and emirate-level rules

The UAE has many free zones, but only the DIFC and ADGM have their own full data protection laws that displace the federal PDPL. Businesses in other free zones are generally subject to the federal law, alongside any free zone rules. Some emirates and sectors add their own requirements, such as health data rules in Dubai and Abu Dhabi, the Central Bank's rules for licensed financial institutions, and Dubai's data laws for government entities. Organisations should map which authority applies to each entity and data type before designing compliance programmes.

Data subject requests in practice

Even without final procedural rules, organisations should be ready to handle requests for information, access, correction, erasure, restriction and portability. A simple process includes a published contact point, identity verification, a tracking log, and target response times comparable to other regional laws. Self-service tools in customer accounts reduce manual effort and help when regulations set formal deadlines.

Documentation you will need

• Records of processing activities.
• Privacy notices and consent records.
• Data subject request logs.
• Impact assessments.
• Breach register and notification procedures.
• Processor contracts and transfer agreements.
• DPO appointment where applicable.

Timeline and cost considerations

Organisations aligned with the GDPR can adapt to the PDPL with modest effort, mainly reviewing legal bases, notices and transfer arrangements. The uncertainty around Executive Regulations means programmes should be flexible. Costs are mostly legal review, translation and process changes, with technical work for consent, rights requests and any localisation.

Common mistakes

• Waiting for regulations before doing anything.
• Relying on legitimate interests, which the PDPL does not provide.
• Applying the federal law to DIFC or ADGM entities, or vice versa.
• Ignoring sector localisation rules for financial and health data.
• No Arabic notices.

Best practices, tools and technologies

• Run a single regional privacy programme covering the UAE, Saudi Arabia and other Gulf laws.
• Use consent management with granular choices and records.
• Offer self-service access, correction, export and deletion.
• Host data in UAE regions where clients or sectors require it.
• Log access to personal data and monitor for breaches.
• Structure the programme with ISO/IEC 27701.

We build consent, privacy request, regional hosting and breach logging features into platforms through our web application development and SaaS product services.

How it relates to other laws

Law	Relationship
GDPR	Similar principles and rights; the PDPL lacks a general legitimate interests basis.
Saudi PDPL	Neighbouring law that is fully enforced with an active regulator.
India DPDP Act	Relevant for Indian vendors processing UAE data.
UK GDPR	Another common reference for organisations operating in the UAE.

Real-world example

An Indian SaaS company sells a booking platform to clinics in Dubai mainland and a wellness brand in the DIFC. For the clinics, health data falls under UAE health data rules with localisation, so the company hosts clinic data in a UAE region. For mainland non-health data, it follows the PDPL with consent-based processing, Arabic and English notices and a transfer contract for support access from India. For the DIFC client, it signs a DIFC-compliant processor agreement and follows DIFC breach notification requirements.

Next steps

1. Identify which UAE regimes apply.
2. Review consent and notices.
3. Set up rights handling and breach procedures.
4. Check transfers and localisation.
5. Watch for Executive Regulations.

Frequently asked questions

When did the UAE PDPL take effect?

On 2 January 2022, although detailed procedures and penalties await the Executive Regulations.

Have the Executive Regulations been issued?

Not as of October 2026, according to published analyses, so details, deadlines and penalties are still pending.

Does the PDPL apply in the DIFC and ADGM?

No. Those free zones have their own data protection laws and regulators.

Does the PDPL apply to foreign companies?

Yes, when they process personal data of data subjects in the UAE, even if they have no office there.

Is there a legitimate interests basis?

No. The PDPL relies on consent and specific listed exceptions.

What data is excluded?

Government data, security and judicial data, personal use, and health and banking data covered by their own laws.

Who regulates the PDPL?

The UAE Data Office, which in 2026 was being consolidated into a new federal authority for AI and data.

Do I need a DPO?

Where processing involves high risk or large-scale sensitive data, as set out in the law.

Can data be transferred outside the UAE?

Yes, to adequate countries or under specified safeguards and exceptions, subject to sector localisation rules.

What are the penalties?

They are to be set by a Cabinet decision on administrative penalties, which had not been published as of October 2026.

Should companies wait for the Executive Regulations?

No. Core obligations are in the law itself and clients expect compliance; waiting risks a rushed implementation once regulations appear.

Do other UAE free zones have their own data laws?

Only the DIFC and ADGM have full separate regimes; businesses in other free zones are generally under the federal PDPL.