UAE PDPL Compliance Guide: What Organizations Must Do Now
Who the UAE Personal Data Protection Law applies to, what it excludes, the rights and breach duties it creates, and how to prepare while the Executive Regulations are awaited.
The law in one paragraph
The UAE Personal Data Protection Law — Federal Decree-Law No. 45 of 2021 — is the UAE's federal data protection law. It governs the processing of personal data of individuals in the UAE, and processing by controllers and processors established in the UAE, including processing of data about people outside the country. Its structure will be familiar from GDPR: lawful bases for processing with consent at the centre, principles of purpose limitation and minimisation, data subject rights, security obligations, breach notification and controls on cross-border transfers.
What it does not cover
The PDPL is the main regime for mainland entities, but several categories sit outside it. Free zones with their own data protection laws — notably the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) — are governed by those regimes. Government data and government entities, data held by security and judicial authorities, and personal data processed for purely personal purposes are excluded, and health and banking data that are regulated by their own sector legislation follow those laws. The first compliance question for any UAE organisation is therefore which regime — or regimes — actually apply.
Rights and breach duties
Data subjects have rights to information and access, rectification, erasure, restriction of processing, data portability, objection, and to object to decisions based solely on automated processing, subject to exemptions. Controllers must provide clear mechanisms to exercise these rights. On breaches, the controller must notify the UAE Data Office once it becomes aware of a breach that would prejudice the privacy, confidentiality or security of personal data, and notify affected data subjects in specified cases. Unlike GDPR, the law itself does not fix a notification period — that is left to the Executive Regulations.
Preparing while the Executive Regulations are awaited
The Executive Regulations are expected to settle notification timelines, thresholds for appointing a Data Protection Officer, and penalties, and practitioners widely expect a transition period once they are issued. Waiting for them is a mistake: the operational work — a data inventory and records of processing, lawful-basis analysis, consent capture and withdrawal, rights-request workflows, vendor contracts with processor terms, transfer assessments and an incident response plan — is the same under any final text, and takes months. Organisations that also operate in India, the UK or the EU can build one privacy programme and map it to the PDPL, DPDP Act and GDPR with modest per-regime additions.
Where security standards fit
The PDPL requires appropriate technical and organisational security measures but does not prescribe controls. In practice UAE organisations evidence them through the UAE Information Assurance (IA) Standards originally issued by NESA, the Dubai Electronic Security Center (DESC) standards for Dubai entities, sector rules such as the UAE Central Bank's cyber security regulations, and ISO 27001. A single control framework mapped across these is far cheaper to run than parallel programmes.