UAE PDPL
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
The UAE's federal personal data protection law, in force since January 2022, establishes controller and processor obligations across the Emirates, though its executive regulations remain incomplete, leaving several operational details unresolved.
Source: IQWorks — iqworks.ai | Last updated: 2026-03-20
Effective
Jan 2, 2022
Jurisdiction
United Arab Emirates
Max Penalty
Administrative penalties to be set by Cabinet resolution in the executive regulations, which remain incomplete
Enforced By
UAE Data Office
Who Does UAE PDPL Apply To?
Controllers and processors established in the UAE, and those outside the UAE that process the personal data of data subjects inside it. Entities registered in the DIFC or ADGM free zones are governed by those free zones' own laws instead.
Key Requirements
Lawful Basis for Processing
Processing requires the data subject's consent or one of the enumerated alternative bases, including performance of a contract, protection of the public interest, and compliance with a legal obligation.
Records of Processing
Controllers and processors must maintain a record of processing activities and make it available to the UAE Data Office on request.
Data Protection Officer
A DPO must be appointed where processing is likely to present a high risk to the confidentiality and privacy of personal data, involves large-scale automated evaluation, or involves large volumes of sensitive personal data.
Impact Assessments
A data protection impact assessment is required before processing that uses new technologies or that presents a high risk to data subjects by virtue of its nature, scope or purpose.
Breach Notification
Controllers must notify the UAE Data Office of a breach that would prejudice the privacy, confidentiality or security of personal data, and inform affected data subjects where the breach would cause them harm.
Executive Regulations Still Pending
Several operational details, including registration mechanics, response timelines and the full cross-border transfer conditions, were left to executive regulations that remain incomplete. Build to the obligations stated directly in the Decree-Law, and document the judgment calls made where it is silent.
Individual Rights Under UAE PDPL
Frequently Asked Questions
What is UAE PDPL?
The UAE's federal personal data protection law, in force since January 2022, establishes controller and processor obligations across the Emirates, though its executive regulations remain incomplete, leaving several operational details unresolved.
What are the penalties for UAE PDPL non-compliance?
The maximum penalty under UAE PDPL is Administrative penalties to be set by Cabinet resolution in the executive regulations, which remain incomplete. Enforcement is handled by UAE Data Office.
Who does UAE PDPL apply to?
Controllers and processors established in the UAE, and those outside the UAE that process the personal data of data subjects inside it. Entities registered in the DIFC or ADGM free zones are governed by those free zones' own laws instead.
When did UAE PDPL take effect?
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data was enacted in 2021 and became effective on January 2, 2022.
Compare UAE PDPL
Compliance Guides
Related Regulations
Automate UAE PDPL Compliance
IQWorks helps organizations achieve and maintain UAE PDPL compliance with AI-powered automation.
Request Demo