UAE PDPL Readiness Checker
Answer 12 questions about your UAE processing activities and get an instant readiness score for the Federal PDPL (Decree-Law 45 of 2021) — including the DIFC/ADGM interaction, Article 22–23 transfer safeguards and DPO threshold.
Tool details
About this tool
A 12-question diagnostic for the UAE Federal PDPL (Decree-Law No. 45 of 2021). The questions cover the Decree-Law's live obligations, the DIFC DPL / ADGM DPR reconciliation and the Executive Regulations compliance clock (Art. 29) so you're ready the day the ERs publish.
What you'll get
- A readiness score with a traffic-light band.
- A gap list naming the specific Article the gap breaches or anticipates.
- A concrete remediation action per failed question.
- A view on whether your controls assume ER guidance that hasn't landed yet.
How it works
- Each 'yes' scores one point. ≥ 70% is 'PDPL Ready', 40–69% is 'Partially Ready', below 40% is 'Significant Gaps'.
- Twelve questions cover: lawful basis, RoPA, DPO threshold, DSR rights, DPIAs, breach, Art. 22–23 transfers, health-data localisation, DIFC/ADGM reconciliation, Arabic notice, retention and the Executive Regulations change log.
- No data leaves your browser; the result is yours alone.
Based on
- Federal Decree-Law No. 45 of 2021 on Personal Data Protection.
- UAE Data Office published guidance (as of the latest Decree-Law supplementary notes).
- DIFC Data Protection Law 2020 and ADGM Data Protection Regulations 2021 for free-zone reconciliation.
Have you identified the lawful basis for every processing activity?
Consent is the PDPL default; alternatives (contract, legal obligation, legitimate interests) require documented justification and a conflict-of-rights test.
Frequently asked questions
The Executive Regulations haven't been published. Why run the checker now?+
Article 29 of the Decree-Law starts a six-month compliance window the day the Executive Regulations publish. Starting that day is too late — the checker surfaces every gap you can close against the Decree-Law today, so the ER-dependent delta is small when the clock begins.
Does the PDPL apply to processing inside DIFC or ADGM?+
No. The federal PDPL does not apply inside the DIFC (governed by DPL 2020) or ADGM (governed by DPR 2021). Groups with mixed onshore + free-zone entities need the matrix we flag in question 9.
What about health data?+
Federal Law No. 2 of 2019 keeps certain patient-identifying health data onshore regardless of PDPL transfer safeguards. Question 8 specifically targets whether your transfer map carves out health data correctly.
What's the right DPO decision today?+
The DPO threshold moves to the Executive Regulations, but the roles the DPO fills (DPIAs, breach, DSRs, regulator liaison) are live now. Appoint a DPO (in-house or outsourced) regardless — they're the person who will run the six-month ER remediation sprint when it starts.
Can I run the quiz in Arabic?+
The checker UI is English today. Translation is on the roadmap; Arabic parity for your own privacy notices and DSR correspondence is tracked in question 10.
Other tools you might find useful
Need more than a free tool?
TruePrivacy is a full privacy operations platform. Automate DSRs, consent, vendor risk, and breach response.
Free 14-day trial · No credit card required · Setup in minutes