UAE Data Protection Law: Legal Obligations and Compliance Requirements for Businesses

Introduction

Picture a Dubai online shop. It collects customers' names, phone numbers and delivery addresses, keeps them on a cloud platform hosted abroad, and sends offers through a third-party email tool. The owner probably doesn't think of this as running a data operation. Under UAE data protection law, it is.

This guide explains who has to comply, what UAE PDPL compliance involves today, which parts of the rules are still unsettled in 2026, and what to do first. It is written for business owners, HR and operations managers and in-house teams, not only for lawyers.

What Is the UAE Personal Data Protection Law (PDPL)?

The PDPL is the cornerstone of UAE data protection law and the country's first general federal law on personal data. Before it, businesses relied on scattered rules in the criminal, cybercrime and sector laws. The PDPL brings the main ideas of modern privacy law together in one place: fair and transparent processing, limits on how long data is kept, rights for individuals, security duties and rules for sending data abroad. Anyone familiar with the GDPR will recognise the structure, although the details differ.

Personal data, controllers and processors

Personal data means any information that relates to an identifiable person, directly or indirectly. A name, a voice recording, a photo, an ID number, an online identifier or a location all count. Some categories are treated as sensitive: family details, ethnic origin, political or philosophical opinions, religious beliefs, criminal record, biometrics, and health, genetic or sexual information.

The law also draws a line between two roles. A controller decides why and how personal data is used. A processor handles it on the controller's behalf, such as a payroll provider or a cloud host. Both have duties, but the controller carries most of them.

A patchwork, not a single rulebook

The PDPL sits alongside other laws. The Cybercrime Law and the Crimes and Penalties Law protect privacy, and banks, payment providers, health providers and telecom companies have their own sector rules. UAE data privacy law is best read as layers, with the PDPL as the general base.

Who Must Comply With UAE Data Privacy Law?

Whether the UAE Personal Data Protection Law applies depends on factors including where the organisation operates, the nature of its data processing and the applicable legal regime. Certain processing by organisations outside the UAE may also fall within the law's scope. Businesses established in the DIFC or ADGM must assess their separate data protection frameworks.

Setting up in a free zone? Our guide to FZE and FZCO formation covers the corporate side.

Foreign companies are covered too

Article 2 of the PDPL reaches controllers and processors outside the country when they process data about people in the UAE. An overseas software company with UAE users can't assume the law is someone else's problem.

What the PDPL does not cover

The law excludes government entities and government data, data held by security and judicial authorities, individuals handling their own data for personal reasons, and health or banking and credit data that already have their own legislation. It also leaves in place the rules of Dubai Healthcare City.

What about small businesses?

Article 3 lets the regulator exempt businesses that don't process large volumes of personal data, but the criteria sit in regulations that haven't been published. Until you have a written exemption, don't assume you qualify. A ten-person company with a customer database is still a controller.

Where UAE PDPL Compliance Stands in 2026

The UAE Personal Data Protection Law (PDPL), Federal Decree-Law No. 45 of 2021, establishes the federal framework for protecting personal data. Businesses should assess their obligations under the law while monitoring the implementing regulations and related decisions.

• Executive Regulations: Article 28 provides for Executive Regulations to support the implementation of the PDPL. Before publication, businesses should check the official UAE legislation portal for the latest status of these regulations rather than rely solely on secondary sources.
• Compliance period: Article 29 addresses the period for controllers and processors to regularise their position following the issuance of the Executive Regulations. The applicable period and any extension should be confirmed against the current legal text and subsequent official decisions.
• Administrative penalties: Article 26 provides for a Cabinet decision specifying administrative violations and penalties. Businesses should verify whether a relevant decision has been issued and published before relying on any particular penalty figures.
• Regulatory developments: Businesses should also monitor announcements from the relevant UAE federal authority responsible for artificial intelligence and data, including official guidance affecting personal data protection.
• What should businesses do now? Businesses should review the personal data they collect, the purposes for which they use it, their privacy notices, vendor arrangements, security measures and procedures for responding to data requests or breaches. They should also monitor official legislative updates and seek legal advice on the requirements applicable to their operations.

Businesses should not assume that the absence of an identified implementing decision removes their existing obligations under applicable law.

Data Protection Requirements in the UAE: Core Obligations

The UAE Personal Data Protection Law establishes key requirements for handling personal data. Businesses should assess their obligations under the law and check the latest implementing regulations and official guidance.

Have a valid basis for processing

Article 4 starts from a simple rule: you can't process personal data without the person's consent unless an exception applies. The exceptions include performing a contract, meeting a legal obligation, employment and social security duties, legal claims and the public interest. Unlike the GDPR, the PDPL has no general "legitimate interests" ground, so businesses often have to lean on consent or contract. Where you do rely on consent, Article 6 expects you to be able to prove it, to ask in clear and simple terms, and to make withdrawal easy.

Be open with people

Before you start processing, tell people why you're collecting their data, who it will be shared with inside and outside the UAE, and what safeguards apply to any cross-border transfer (Article 13). A plain-language privacy notice does this job.

Respect individual rights

People can ask what you hold about them, free of charge. They can have inaccurate data corrected, ask for erasure in set cases, restrict or object to processing, object to direct marketing, receive their data in a portable format, and challenge decisions that result from automated processing (Articles 13 to 18). You can refuse requests that are excessive or would affect other people's privacy or an investigation. Give people a clear way to reach you (Article 19) and keep a log of every request.

Keep records, secure the data and assess risk

Controllers and processors keep a record of processing and hand it to the regulator on request (Articles 7 and 8). Article 20 requires security measures suited to the risk, such as encryption, pseudonymisation, resilience and regular testing. Before high-risk processing, such as profiling people or handling large volumes of sensitive data, you need an impact assessment (Article 21). Our UAE corporate compliance checklist shows how this fits with the rest of your governance.

Appoint a data protection officer when needed

Article 10 requires a DPO where processing is high risk because of new technology or data volume, involves systematic assessment of sensitive data including profiling, or involves large volumes of sensitive data. The officer can be an employee or an outside provider, inside or outside the UAE. The regulations are meant to define the thresholds, so document your decision either way.

Control your vendors

Processors must follow your documented instructions, delete data when the work ends and be able to show compliance (Article 8). A written data processing agreement with every payroll, cloud, marketing and analytics provider is the practical way to prove it.

Report breaches

When you become aware of a breach that could prejudice people's privacy or security, Article 9 requires you to notify the regulator and, where their privacy is affected, the individuals concerned. The deadline and procedure are left to the regulations. Many guides quote a fixed 72-hour rule, but we haven't found that figure in the statute. Use 72 hours as an internal target, not as a legal safe harbour. Processors must tell the controller as soon as they know.

Transfer data abroad carefully

Articles 22 and 23 allow transfers to countries with adequate protection, as approved by the regulator, and otherwise in limited cases: under a contract binding the recipient to PDPL standards, with explicit consent, to perform a contract, for legal claims, or to protect the public interest. Map every vendor that receives UAE personal data and note the country it sits in. Cloud hosting, offshore payroll and overseas support teams are the usual blind spots.

DIFC and ADGM: Free Zone Data Protection Rules

The UAE's two financial free zones add their own layer of data protection law. If your business is licensed in the DIFC or ADGM, the PDPL generally doesn't apply. You follow a local law instead, and both are closer to the GDPR than the federal law is.

DIFC

The DIFC Data Protection Law No. 5 of 2020 was amended by DIFC Law No. 1 of 2025, which took effect on 15 July 2025. Individuals can now claim compensation directly in the DIFC Courts, without going through the Commissioner first. The law also applies to DIFC-incorporated entities even where processing happens outside the DIFC. Fines rose too: failing to carry out a required impact assessment can now cost up to USD 50,000.

ADGM

The ADGM Data Protection Regulations 2021 require controllers to notify the Commissioner annually and pay a data protection fee, keep records, use written processor terms, run impact assessments where needed and report breaches within 72 hours. Fines are reported at up to USD 28 million.

Groups with more than one licence

A group with entities in different jurisdictions may face more than one regime. An onshore company serving customers based in the DIFC, for example, can end up dealing with both the PDPL and the DIFC law for that data. Map each entity and data set separately.

Penalties for Breaching UAE Data Protection Law

Article 26 of the UAE Personal Data Protection Law (PDPL) provides for a Cabinet decision specifying violations and the applicable administrative penalties. The current status of any such decision should be verified against official UAE legislation before publication.

Some online sources quote administrative fines ranging from AED 50,000 to AED 5 million for data protection violations. These figures should not be attributed to the federal PDPL without identifying the specific legal provision or applicable Cabinet decision that establishes them. Some appear to come from other laws. Article 13 of Federal Decree-Law No. 34 of 2021, the UAE Cybercrime Law, provides for criminal penalties for specified unlawful collection, keeping or processing of personal data using information technology. Whether this provision applies to a particular PDPL breach depends on the statutory requirements and the circumstances of the case. For further details, refer to the UAE Cyber Laws resource.

These are criminal provisions enforced by police and prosecutors, not administrative fines from the data regulator. Our article on the punishment for cybercrime in the UAE explains how those offences work.

Potential consequences may extend beyond administrative penalties. Depending on the circumstances, other UAE laws may provide for privacy-related offences, complaints to the competent authority or civil claims. The applicability of these provisions depends on the relevant law and the facts of the case.

UAE PDPL Compliance Checklist

Use this checklist as a starting point for assessing your UAE PDPL compliance. Confirm which requirements apply to your business and monitor relevant regulations and official decisions.

1. Confirm which regime applies. Check each entity's licence: PDPL, DIFC or ADGM.
2. Map your data. Record what you collect, why, where it's stored, who can see it and where it goes.
3. Fix your legal basis. Pick a basis for each activity, refresh consent wording and keep proof of consent.
4. Publish a privacy notice. Cover the purposes, recipients and cross-border safeguards (Article 13(2)).
5. Build a record of processing. Keep it current for every significant activity.
6. Decide on a DPO. Document the decision either way.
7. Run impact assessments. Do them before profiling, new technology or large-scale sensitive data.
8. Review vendor contracts. Cover instructions, deletion, security and transfer terms.
9. Prepare for requests and breaches. Set up a rights-request process and a breach plan built around a 72-hour target.
10. Train staff and monitor updates. Watch for the Executive Regulations and any penalties decision.

A worked example

Take the Dubai online shop from the start of this article (an illustration, not a real client). Mapping its data shows three flows: customer details in the shop platform, card payments through a payment provider, and email addresses in a marketing tool hosted abroad. The owner adds a clear opt-in to the marketing sign-up, publishes a privacy notice, signs written processing terms with the payment and email providers, and adds a transfer clause for the overseas marketing tool. None of that is expensive, and each step maps to a specific PDPL article. If the shop has staff, the same exercise applies to employee records, so HR teams should also review recent UAE employment law updates.

UAE Data Protection Law: Frequently Asked Questions

Does the UAE data protection law apply to small businesses?

Yes. The PDPL has no general size threshold. Article 3 lets the regulator exempt businesses that don't process large volumes of personal data, but the criteria depend on regulations that haven't been published. Assume you're covered unless you hold a written exemption.

Is the UAE PDPL being enforced?

The law has been in force since 2 January 2022, and its duties apply. The current status of the Executive Regulations, administrative penalty decisions and federal enforcement developments should be confirmed through official UAE sources. Businesses should assess their applicable obligations rather than assume that the absence of an identified decision removes their responsibilities.

Do I need a data protection officer in the UAE?

Only in the cases listed in Article 10: high-risk processing because of new technology or data volume, systematic assessment of sensitive data including profiling, or large volumes of sensitive data. The DPO can be an employee or an external provider, inside or outside the UAE.

How long do I have to report a data breach in the UAE?

The PDPL doesn't state a number of hours. Article 9 requires notification when you become aware of a qualifying breach, within a period the Executive Regulations will set. Treat 72 hours as a sensible internal target.

Can I store UAE customer data on servers abroad?

Often yes, but you need a lawful route under Articles 22 and 23, such as a contract binding the recipient to PDPL standards or the individual's explicit consent. Health data and some financial data have stricter local rules, so check your sector.

Conclusion: Take Steps Towards UAE PDPL Compliance

UAE data protection law provides an important framework for protecting personal data. Businesses should review their current obligations and verify the latest status of implementing regulations and administrative penalty decisions before determining their compliance timelines.

Businesses can prepare by mapping their data, reviewing consent practices and privacy notices, and checking vendor contracts while monitoring official updates on applicable compliance deadlines.

If you're unsure where your business stands, or you want a review ahead of the regulations, our team can help. See our corporate and commercial practice or get in touch directly.

Legal note: This article is provided for general information only and does not constitute legal advice. The application of data protection law depends on your licence, sector, the data you hold and how it is used. You should obtain advice from a qualified lawyer before taking or refraining from any action.