UAE PDPL Compliance Checklist
A compliance checklist covering the UAE Federal PDPL (Decree-Law 45 of 2021) — RoPA, privacy notice, consent and lawful bases, DPO assessment, breach plan, Articles 22–23 transfers and reconciliation with DIFC/ADGM obligations.
What's included
- Professionally drafted, legally reviewed content
- Regulation-specific guidance notes
- Placeholder fields with clear instructions
- Version control and update log
- Customisation guide included
How to use this template
- Walk through the checklist in order; it tracks the Decree-Law obligations that are live now plus the controls that will unlock on Executive Regulations publication (Art. 29).
- Mark every item as either 'Confirmed' (grounded in the Decree-Law) or 'Assumed' (depends on pending Executive Regulations). The visible 'Confirmed/Assumed' tag is what turns the ER six-month remediation window into a weekend of edits.
- Use /tools/uae-pdpl-readiness-checker to pre-score the headline items in 12 questions.
- If the group includes DIFC or ADGM entities, run the DIFC DPL 2020 and ADGM DPR 2021 reconciliation column — one controls matrix across all three laws.
- Review on every UAE Data Office update and immediately on Executive Regulations publication.
Download template
Free to download. Just fill in your details.
Need an automated version of this document? TruePrivacy generates and maintains compliance documents automatically as your data processing activities change.
Try TruePrivacy freeFrequently asked questions
Is the checklist usable even though the Executive Regulations haven't published?+
Yes. The Decree-Law obligations (consent, lawful bases, RoPA, DSR rights, DPIA, breach, Art. 22–23 transfers) are live today. The checklist tags ER-dependent items so you build to the Decree-Law and the ER-specific edits are a short list, not a programme.
How does the checklist handle the DIFC and ADGM carve-outs?+
A dedicated reconciliation column maps each federal PDPL control to its DIFC DPL 2020 and ADGM DPR 2021 counterpart. Groups with mixed onshore + free-zone entities get a single matrix instead of three parallel programmes.
What about health data?+
Federal Law No. 2 of 2019 keeps certain patient-identifying health data onshore regardless of PDPL safeguards. The checklist carves out health data flows into their own section.
Should we appoint a DPO before the Executive Regulations publish?+
Yes. The DPO threshold moves to the Executive Regulations, but DPIAs, DSRs and breach workflows need an owner now. The DPO is the lead who will run the Art. 29 six-month remediation sprint when the ERs start the clock.
Is Arabic parity needed for every disclosure?+
The practical norm is yes — your privacy notice, DSR correspondence and consent request need an Arabic version for UAE-resident data principals. The checklist flags each customer-facing disclosure requiring Arabic parity.
Beyond templates: automated compliance
Static templates are a start. TruePrivacy keeps your privacy documentation accurate and up to date automatically.
Free 14-day trial · No credit card required · Setup in minutes