UAE PDPL Executive Regulations: Status and What to Do Now

Where the Executive Regulations Stand

Federal Decree-Law No. 45 of 2021 — the UAE's first federal personal data protection law — took effect on 2 January 2022. The law itself is live and enforceable, but a material part of its operational detail was deferred to the Executive Regulations (ERs) to be issued by the UAE Data Office under Article 29. As of October 2026 those ERs have not been published. The timeline most commonly cited by industry groups and regulator briefings is that the ERs will be issued once the Data Office completes its public consultation and inter-agency alignment; no fixed date has been committed.

Article 29 is important because it sets a six-month compliance window that only starts running when the ERs are published. In other words: your preparation time ends on the day the gazette carries the ERs, not before. Organisations that treat the current gap as a slow-start zone will be the ones scrambling when the clock begins.

What the ERs Are Expected to Resolve

The Decree-Law lays down the principles and the rights; the ERs are expected to fill the operational detail. The questions the industry has been waiting on are consistent across advisor and in-house briefings:

- **DPO threshold** — the Decree-Law requires a DPO where processing is high risk, where large volumes of sensitive data are processed, or where the ERs prescribe. The ERs are expected to set concrete criteria (likely a volume or category test, plus a public-sector trigger). - **Breach notification window and form** — Article 9 requires notification to the Data Office and affected data subjects for breaches that may harm their rights. The ERs are expected to specify a window (72 hours is the working assumption, aligned to the DIFC DPL 2020) and a notification form. - **DSR response window** — the Decree-Law establishes the rights but does not set a response SLA; the ERs will. 30 days aligned to GDPR is the working target. - **Cross-border transfer safeguards** — Article 22 adequacy decisions and Article 23 appropriate safeguards both require Data Office approval of specific mechanisms (model clauses, BCRs, certifications). The ERs are expected to publish the approved clauses and the authorisation route. - **Fees and administrative penalties** — the law empowers administrative penalties and corrective orders; the specific amounts and the enforcement procedure sit in the ERs. - **Registration or licensing of controllers/processors** — the Decree-Law hints at a register of controllers (Article 5). Whether registration is required for every controller, or only those crossing certain thresholds, will be clarified in the ERs.

What You Can — and Should — Do Today

The six-month window is short enough that organisations starting the day the ERs drop will be behind. The programme to build in the meantime is the one that satisfies the Decree-Law's live obligations and keeps a tight change log so the final tune to match the ERs is a weekend of edits, not a quarter of work.

1. **Ship the live obligations.** Consent capture with an immutable record. A Record of Processing. A DPIA process for high-risk and sensitive-data processing. A functioning DSR intake and workflow for access, rectification, erasure, portability, restriction and objection. These are enforceable today under the Decree-Law.

2. **Build to the stricter adjacent regime.** For most teams the natural anchor is GDPR or the DIFC DPL 2020, both of which already resolve most of the operational detail the UAE ERs will later confirm. GDPR's 72-hour breach notification and 30-day DSR SLA are safe planning assumptions.

3. **Appoint a DPO (even if not yet mandatory).** The DPO threshold is one of the few places where the ERs could move your decision. Having a DPO in post, in-house or outsourced, means you have the person who will run the six-month remediation sprint when the ERs land.

4. **Document your transfer map against Articles 22–23.** Every transfer out of the UAE should be tagged with the Article it relies on. When the ERs publish the approved clauses, you can map existing contracts to the new template in days rather than months.

5. **Reconcile with DIFC and ADGM.** If any group entity is in a free zone, run one controls matrix across all three laws so federal PDPL compliance work does not fork from your existing DIFC/ADGM programme.

6. **Keep a visible change log.** When the ERs are published you want an at-a-glance diff of what you built on assumption vs. what you need to adjust. A simple spreadsheet tagged `assumed`/`confirmed` against each ER-dependent control is enough.

What Changes the Day the ERs Publish

On publication day, start the Article 29 six-month clock and run four workstreams in parallel:

- **Policy refresh** — DPO appointment letter, privacy notice, breach notification template, DSR response SOP, retention schedule and cross-border transfer appendix all updated to cite the correct ER article numbers and timelines. - **Contract refresh** — swap your interim data processing clauses for the ER-approved contractual clauses on every active contract that involves processing or export of UAE personal data. The Data Office may provide a template; move fast on the ones that already export data. - **Operational refresh** — confirm the DSR response SLA your workflow enforces, confirm the breach notification channel and form, confirm the DPIA trigger table. - **Regulator liaison** — register the DPO (if a register is required), file any new Data Office authorisations required for Article 23 transfers, open the compliance dialogue so you are a known quantity before an inspection, not after.

Teams that have shipped points 1–6 above will treat ER publication as a sprint, not a crisis. Teams that haven't will find that six months is not very long when you are starting from a blank consent form.

We'll Keep This Post Updated

This is a timely update, not a static reference. We'll refresh it when the ERs are issued, the Data Office publishes approved transfer clauses, or any specific detail (DPO threshold, breach window, fine schedule) moves from working assumption to confirmed. The UAE PDPL hub at `/regulations/uae-pdpl` and the UAE PDPL readiness checker at `/tools/uae-pdpl-readiness-checker` are updated in step; the readiness score you get today is based on the Decree-Law obligations and the GDPR-aligned working assumptions above.