UAE PDPL
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
The UAE's first federal personal data protection law, applying to processing of UAE residents' data onshore and sitting alongside the DIFC DPL 2020 and ADGM DPR 2021.
Automate UAE PDPL compliance
TruePrivacy ships every control UAE PDPL asks for — in one platform.
Data discovery, consent, DSR, RoPA, breach workflows, cross-border transfer safeguards and audit evidence — all mapped to the obligations on this page.
Overview
The UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL") is the country's first federal personal data protection law. It applies across onshore UAE and sits alongside the DIFC Data Protection Law (DPL 2020) and the ADGM Data Protection Regulations 2021, which continue to govern businesses established in those financial free zones. The PDPL took effect on 2 January 2022 and establishes a modern consent-based framework modelled on international standards.
The PDPL is administered by the UAE Data Office, a federal authority empowered to issue regulations, approve codes of conduct, authorise cross-border transfers and investigate complaints. Article 29 of the PDPL requires controllers and processors to come into compliance within six months of the Executive Regulations being issued. At the time of writing the Executive Regulations are still outstanding, which means the operational details — notification form, specific fines, DPO threshold — remain in draft; obligations in the law itself (consent, lawful bases, subject rights) are already live and enforceable.
For organisations with a federal UAE establishment the practical path is to build to the Decree-Law today, keep Executive Regulations tracking in your change log and reconcile with your DIFC/ADGM programme (if any) through a shared controls matrix.
Scope & Applicability
The PDPL applies to processing of personal data of UAE residents, whether the data subject is in the UAE or abroad, by (i) controllers and processors established in the UAE and (ii) controllers and processors outside the UAE that process the personal data of individuals inside the country. It does NOT apply to processing within the DIFC or ADGM (which have their own laws), to government data, to personal/household processing, to banking data regulated by the Central Bank, or to health data regulated by the Health Data Law (Federal Law No. 2 of 2019). Pseudonymised and anonymised data outside the definition of personal data are also carved out.
Key Principles
- 1Lawful, fair and transparent processing — a specific lawful basis is required and the data subject must be told what will happen to their data
- 2Purpose limitation — data is collected for a specified, lawful purpose and not further processed in a manner incompatible with that purpose
- 3Data minimisation — only data that is necessary, adequate and relevant for the purpose may be collected
- 4Accuracy — reasonable steps must be taken to keep personal data accurate and up to date
- 5Storage limitation — personal data must be kept for no longer than is necessary; retention schedules are mandatory
- 6Integrity and confidentiality — appropriate technical and organisational measures must protect the data from loss, misuse or unauthorised disclosure
- 7Accountability — the controller must be able to demonstrate compliance (records of processing, DPIA, DPO where applicable)
Data Subject Rights
Data subjects can obtain information about processing and request a copy of their personal data in a structured, commonly used, machine-readable format.
Data subjects can require inaccurate or incomplete personal data to be corrected without undue delay.
Where consent is withdrawn, the purpose has ended, or processing was unlawful, the controller must erase the personal data — subject to overriding legal obligations.
Processing may be restricted while the accuracy of data is contested or while an objection is being reviewed.
Where processing is based on consent or contract and carried out by automated means, data subjects can receive their data in a portable format and have it transmitted to another controller.
Data subjects can object to processing (including direct marketing) and are protected against solely automated decisions, including profiling, with significant effects.
Complaints can be submitted to the controller first, and escalated to the UAE Data Office where unresolved.
Business Obligations
Obtain a Valid Lawful Basis Before Processing
Consent is the default lawful basis under the PDPL. Alternatives include contractual necessity, legal obligation, protection of vital interests, archiving/research, and the controller's or a third party's legitimate interests — but only where no conflict with the data subject's rights exists.
Maintain a Record of Processing (RoPA)
Controllers and processors must document processing activities, categories of data, purposes, retention, security measures and cross-border transfers. The Data Office may request this record at any time.
Appoint a Data Protection Officer where thresholds apply
A DPO is required where processing may create high risk to data subjects, where large volumes of sensitive data are processed, or where the Executive Regulations prescribe. The DPO's contact details must be made available to the Data Office and to data subjects.
Conduct Data Protection Impact Assessments
A DPIA is required for new technologies, large-scale processing of sensitive personal data, and processing that is likely to result in a high risk to the rights and interests of data subjects.
Breach Notification
Controllers must notify the UAE Data Office and affected data subjects of any breach that may cause harm or infringe their privacy; timing and form will be specified in the Executive Regulations.
Honour Data Subject Rights
Mechanisms must be in place to receive, verify and respond to subject rights requests. Fees cannot be charged except for manifestly unfounded or excessive requests.
Cross-Border Transfer Safeguards
Transfers outside the UAE are permitted to "adequate" jurisdictions or under one of the safeguards in Articles 22–23 (contractual clauses, binding corporate rules, explicit consent, performance of a contract, substantial public interest or legal claims).
Cross-Border Transfer Rules
Articles 22 and 23 of the PDPL govern cross-border transfers. Transfers are permitted to jurisdictions deemed adequate by the UAE Data Office. In the absence of an adequacy decision, transfers can rely on appropriate safeguards — contractual clauses approved by the Data Office, binding corporate rules, explicit consent after the data subject has been informed of the risks, performance of a contract with or in the interest of the data subject, important reasons of public interest, or the establishment, exercise or defence of legal claims. Note that health data remains subject to the stricter localisation rules of Federal Law No. 2 of 2019: certain categories of patient-identifying health data cannot leave the UAE at all, regardless of the PDPL route used.
Breach Notification Requirements
To be prescribed by the Executive Regulations (expected to align with the 72-hour standard). Until issued, controllers should notify as soon as possible after awareness, and document the timeline for later review.
UAE Data Office
Affected data subjects must be notified where the breach may cause harm to their privacy or rights; the exact wording and timing are expected in the Executive Regulations.
How TruePrivacy Helps
Purpose-built tools for every UAE PDPL obligation.
Collect explicit, purpose-specific consent and store an immutable record (version, timestamp, legal basis) that satisfies the PDPL's accountability requirement.
Automatically populate your RoPA from live data discovery across SaaS, databases, and cloud storage — including purpose, retention, lawful basis, and recipients.
A single control catalogue reconciles federal PDPL, DIFC DPL 2020 and ADGM DPR 2021 obligations so groups with mixed free-zone and onshore entities run one programme, not three.
Track every cross-border flow, the Article 22/23 safeguard it relies on, and the status of any Data Office authorisation — plus a localisation guardrail for Federal Health Data.
Receive, verify and fulfil access, rectification, erasure, portability, restriction and objection requests on a single workflow — including Arabic-language subject correspondence.
Trigger DPIAs on high-risk processing (new technologies, sensitive data, large-scale), capture outcomes, and give the appointed DPO a single workspace for assessments, breaches and regulator queries.
Ready to achieve UAE PDPL compliance?
TruePrivacy automates your compliance workflows so your team can focus on what matters.
Free 14-day trial · No credit card required · Setup in minutes