The UAE's federal personal data protection law, in force since January 2022, establishes controller and processor obligations across the Emirates, though its executive regulations remain incomplete, leaving several operational details unresolved.
Source: IQWorks Glossary — iqworks.ai | Last updated: 2026-08-09
Last verified: August 9, 2026
UAE PDPL Regulation Guide
Requirements, penalties, individual rights, and enforcement details
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data is the United Arab Emirates' first federal data protection statute. It entered into force on 2 January 2022 and is overseen by the UAE Data Office. The law applies to controllers and processors inside the UAE, and to those outside the UAE that process the personal data of data subjects inside it.
The substantive framework will be familiar to anyone who has implemented the GDPR. Processing requires consent or one of a set of enumerated alternative bases, controllers must maintain records of processing, appoint a Data Protection Officer where processing is high risk or involves large volumes of sensitive data, carry out impact assessments, and report breaches. Data subjects hold rights of access, rectification, erasure, restriction, portability and objection.
The practical complication is that the executive regulations, which were expected to set out timelines, registration mechanics and transfer conditions in detail, remain incomplete. Organizations should therefore build to the obligations the Decree-Law states directly, document the judgment calls made where the law is silent, and structure their programme so the remaining details can be slotted in without rework. Note also that the DIFC and ADGM financial free zones operate their own separate data protection regimes, so an entity established in either is governed by that free zone's law rather than the federal one.
How IQWorks Helps
Related Terms
PDPL (Saudi Personal Data Protection Law)
Saudi Arabia's Personal Data Protection Law, issued under Royal Decree M/19 and enforced by SDAIA, governs the processing of personal data of individuals in the Kingdom, with fines reaching SAR 5 million and criminal liability for sensitive-data disclosure.
DIFC Data Protection Law (DIFC Law No. 5 of 2020)
The Dubai International Financial Centre's own GDPR-aligned data protection law, enforced by the DIFC Commissioner of Data Protection, substantially amended in July 2025 to add a private right of action.
ADGM Data Protection Regulations 2021
Abu Dhabi Global Market's free-zone data protection regime, enforced by the independent ADGM Office of Data Protection, with fines for serious breaches capped at USD 28 million.
Data Subject Rights (DSR)
Data Subject Rights are the legal rights granted to individuals under data protection laws, enabling them to control how their personal data is collected, used, stored, and shared by organizations.
Data Breach Notification
Data breach notification is the legal requirement for organizations to inform supervisory authorities and affected individuals when a security incident results in unauthorized access to, or loss of, personal data.