PDPA vs UAE PDPL vs DPDP Act: Key Differences

Three Modern Laws, Three Operational Models

Singapore's Personal Data Protection Act (PDPA), the UAE's Federal Decree-Law No. 45 of 2021 (the UAE PDPL) and India's Digital Personal Data Protection Act 2023 (the DPDP Act) all share the modern privacy ambition: a consent-anchored regime, enforceable individual rights, mandatory breach notification and a competent authority. But each law makes different operational trade-offs — on lawful basis, on who the regulator is, on how fast a breach has to be filed and on how transfers are policed. For groups operating across all three jurisdictions the right strategy is one unified controls programme that satisfies the strictest timeline on each dimension, with jurisdiction-specific collateral stacked on top.

Territorial Scope

The **PDPA** applies to private-sector organisations that collect, use or disclose personal data in Singapore. Business contact information used for business purposes is excluded from most obligations.

The **UAE PDPL** applies to any processing of UAE residents' personal data by controllers established in the UAE and by controllers abroad that process data of individuals inside the UAE. It does not apply to processing inside the DIFC or ADGM free zones — which have their own laws (DIFC DPL 2020 and ADGM DPR 2021) — nor to government data, banking data regulated by the Central Bank, or health data regulated by Federal Law No. 2 of 2019.

The **DPDP Act** applies to the processing of digital personal data within India, and to processing abroad that is connected with offering goods or services to Data Principals in India. Non-digital personal data is out of scope.

Lawful Basis for Processing

The three laws diverge most sharply here, and getting this wrong is the main source of unplanned compliance work for groups rolling out a single programme.

**PDPA** — consent is the default basis, backed by `deemed consent` (by notification or by contractual necessity) and a defined list of exceptions in the First Schedule. The 2021 amendments added a `legitimate interests` exception that is narrower than GDPR's and must survive a balancing test.

**UAE PDPL** — consent is the default, with alternative bases close to GDPR Article 6 (contract, legal obligation, vital interests, public interest, legitimate interests). Legitimate interests exists but is bounded by a conflict-of-rights test and remains to be fleshed out in the Executive Regulations.

**DPDP Act** — consent dominates. There is no `legitimate interests` basis. Non-consent processing is squeezed into a defined list of `Certain Legitimate Uses` in Section 7 (employment, legal obligations, medical emergencies, specified public interest activities). GDPR-style programmes that rely heavily on legitimate interests for analytics and marketing have to be re-engineered as explicit-consent flows for DPDP.

Data Subject Rights

**PDPA** provides access, correction, consent withdrawal, opt-out of direct marketing (through the DNC Registry), and a future data portability right the PDPC may activate by regulation.

**UAE PDPL** has the most GDPR-like list: access, rectification, erasure, restriction, portability, objection and protection against solely automated decisions.

**DPDP Act** gives four rights — access, correction/erasure, grievance redressal, and the right of nomination (so another individual can exercise the Data Principal's rights after death or incapacity). It does not currently provide restriction or objection rights.

Response timelines are the second gap: PDPA requires `as soon as reasonably possible`, UAE PDPL's timelines will be fixed by the Executive Regulations (expect roughly 30 days), and DPDP will be set by the published grievance redressal period of each Data Fiduciary. The pragmatic rule is to target 30 days as the ceiling and track the regulator-published number per jurisdiction as it crystallises.

Breach Notification Windows

**PDPA** — notify the PDPC within **3 calendar days** of determining a breach is notifiable (significant harm or 500+ affected individuals). Affected individuals must be notified as soon as practicable thereafter.

**UAE PDPL** — notify the UAE Data Office and affected individuals of any breach that may harm their rights. The exact window and form are deferred to the Executive Regulations; a 72-hour standard is the working assumption.

**DPDP Act** — intimate the Data Protection Board and affected Data Principals **without delay**, with a detailed report to the Board within 72 hours (extendable on written request). There is no risk threshold under DPDP — every personal data breach is notifiable.

Unified operational rule: build the pipeline for a 72-hour decision but execute on 3 days for Singapore to stay compliant with the strictest window.

Cross-Border Transfers

**PDPA (Transfer Limitation Obligation)** — transfers abroad require a `comparable standard of protection` through binding contracts, model clauses issued by the PDPC, BCRs, or APEC CBPR / PRP certification. Consent and contractual necessity are also available routes.

**UAE PDPL (Articles 22–23)** — transfers are permitted to adequate jurisdictions (Article 22) or, in their absence, under Article 23 safeguards: approved contractual clauses, BCRs, explicit consent, performance of a contract with or in the interest of the data subject, important public interest or legal claims. A separate localisation regime continues to apply to patient-identifying health data under Federal Law No. 2 of 2019.

**DPDP Act** — cross-border transfers are permitted by default. The Central Government may restrict transfers to specified countries by notification. There is no adequacy or SCC regime; the control lives in the government's negative list.

Regulator, Penalties and Enforcement

**PDPA** — enforced by the Personal Data Protection Commission (PDPC). Financial penalties can reach the greater of SGD 1 million or 10% of annual turnover (local). The PDPC publishes detailed enforcement decisions and the regime leans facilitative, with the enforcement bar highest for repeat or egregious breaches.

**UAE PDPL** — enforced by the UAE Data Office. Specific administrative fines are to be fixed in the Executive Regulations; the Data Office is empowered to order corrective measures, suspensions and public censure in the meantime.

**DPDP Act** — enforced by the Data Protection Board of India (DPBI). Monetary penalties are set in absolute rupee amounts, capped at ₹250 crore (~USD 30 million) per breach of obligations. Unlike GDPR's percentage-of-turnover model, the DPDP cap is category-based and non-escalating with revenue.

Children's Data

**PDPA** does not have a hard age gate but requires `appropriate measures` where processing affects minors and recommends treating under-13s with heightened care. The PDPC's Advisory Guidelines on Children's Personal Data are the operational reference.

**UAE PDPL** does not currently prescribe an age threshold; parental or guardian consent is implicit through the general consent requirement and may be fleshed out in the Executive Regulations.

**DPDP Act** sets a bright-line **under-18** age gate and requires `verifiable parental consent` for every child, plus a prohibition on tracking, behavioural monitoring or targeted advertising directed at children. This is one of the strictest children's regimes anywhere.

Common Programme, Jurisdiction-Specific Collateral

For groups operating in Singapore, the UAE and India (and often GDPR too) the practical build is one data map, one DSR workflow, one consent service and one breach-triage runbook — with jurisdiction-specific instances where the operational detail differs:

- **Notices and consent copy**: Singapore in English, UAE in Arabic + English, India in English and the 22 Eighth Schedule languages. - **DSR response SLA**: a single 30-day target, with per-jurisdiction overrides as regulators publish timelines. - **Breach triage**: triage within 24 hours of awareness, filing decision within 48, PDPC notification within 72 hours (which still beats Singapore's 3-day clock), DPBI 72-hour detailed report with the same evidence pack, UAE Data Office notification using the same package as soon as the Executive Regulations are published. - **Transfer register**: one register, two schema fields — Article 22/23 safeguard for the UAE, DPDP country-blocklist check for India, SCCs or APEC CBPR for Singapore.

Built to the strictest sub-rule in each dimension, this programme costs materially less than three parallel compliance stacks and leaves fewer gaps when any of the three regulators changes the detail. A GDPR deployment, in most cases, becomes the baseline — Singapore adds the DNC regime, the UAE adds the DIFC/ADGM reconciliation, and India adds the 22-language notice fabric and the verifiable parental consent flow.