Privacy & Data Protection · United Arab Emirates
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
The UAE's federal personal data protection law, applying across the mainland alongside separate data protection regimes already in place in the DIFC and ADGM financial free zones. It establishes GDPR-influenced principles for lawful processing.
REGULATORUAE Data Office
REGIONUnited Arab Emirates
EFFECTIVE2 January 2022
Who it applies to
- Organisations processing personal data of individuals in the UAE mainland
- Organisations outside the UAE processing data of UAE residents in connection with offering goods or services
- Note: DIFC and ADGM free zones operate their own separate data protection laws
Key requirements
- A lawful basis and documented purpose for processing
- Appointment of a Data Protection Officer where processing meets risk thresholds
- Notification of data breaches likely to prejudice individuals' rights
- Data Protection Impact Assessments for high-risk processing
- Restrictions on cross-border data transfers absent adequate safeguards
Maximum penaltyAdministrative fines set out in executive regulations, with amounts determined per violation type
Go to the source
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Start your compliance journey
See how Praeferre automates UAE PDPL compliance
Continuous monitoring, evidence and reporting for UAE PDPL — alongside every other framework you need to satisfy.