Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
The UAE's federal personal data protection law, applying across the mainland alongside separate data protection regimes already in place in the DIFC and ADGM financial free zones. It establishes GDPR-influenced principles for lawful processing.
Who it applies to
- Organisations processing personal data of individuals in the UAE mainland
- Organisations outside the UAE processing data of UAE residents in connection with offering goods or services
- Note: DIFC and ADGM free zones operate their own separate data protection laws
Key requirements
- A lawful basis and documented purpose for processing
- Appointment of a Data Protection Officer where processing meets risk thresholds
- Notification of data breaches likely to prejudice individuals' rights
- Data Protection Impact Assessments for high-risk processing
- Restrictions on cross-border data transfers absent adequate safeguards
Maximum penaltyAdministrative fines set out in executive regulations, with amounts determined per violation type
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Questions we get asked
The UAE PDPL applies to: Organisations processing personal data of individuals in the UAE mainland; Organisations outside the UAE processing data of UAE residents in connection with offering goods or services; Note: DIFC and ADGM free zones operate their own separate data protection laws.
The core obligations are: A lawful basis and documented purpose for processing; Appointment of a Data Protection Officer where processing meets risk thresholds; Notification of data breaches likely to prejudice individuals' rights; Data Protection Impact Assessments for high-risk processing; Restrictions on cross-border data transfers absent adequate safeguards. Each is summarised in plain English above, with a link to the official text.
Effective: 2 January 2022. Regulator: UAE Data Office.
Administrative fines set out in executive regulations, with amounts determined per violation type.
Praeferre's GRC Automation engine monitors the policies, document repositories and web pages that carry your risk under the UAE PDPL, on a cadence you set, and turns every scan into an audit trail you can put in front of an auditor or regulator. Alongside it, where the UAE PDPL expects a Data Protection Officer, DPO as a Service can provide a named, accredited one.
See how Praeferre automates UAE PDPL compliance
Continuous monitoring, evidence and reporting for UAE PDPL — alongside every other framework you need to satisfy.