UAE Data Protection Landscape: Federal, DIFC, ADGM, Sector

Geography and registration decide. Companies incorporated in DIFC follow DIFC DP Law No. 5 of 2020 regardless of where their customers are; ADGM-registered entities follow the ADGM Data Protection Regulations 2021; everything else onshore falls under the federal PDPL, subject to sector carve-outs (health, banking, government). A Dubai group can hold all three in one org chart: a mainland trading entity (federal), a DIFC-regulated asset manager (DIFC), and an ADGM SPV (ADGM). Each has its own notice, records, DPO analysis, and transfer rules; intra-group data sharing across the boundary is a regulated transfer, not an internal transaction.

They are the closest things to GDPR in the Gulf, deliberately, since both zones seek EU adequacy-style recognition. Both require lawful bases including legitimate interest, registration/notification with fees, DPOs for high-risk processing (DIFC), breach notification, DPIAs, and transfer mechanisms with adequacy lists and standard clauses. Enforcement is real: DIFC's Commissioner has issued fines and direction notices, and ADGM's regulations authorize penalties up to USD 28 million for the most serious contraventions. EU-compliant programs port to the free zones with modest re-papering.

Under Federal Law No. 2 of 2019 (the ICT Health Law), which applies to health information originating in the UAE across providers, insurers, and health-tech: it mandates confidentiality, purpose limitation, and, most consequentially, prohibits storing or transferring UAE health data outside the country except with health-authority approval, one of the few hard localization rules in the Emirates. Dubai and Abu Dhabi health authorities (DHA, DoH) layer their own data rules. Health-tech companies should treat the ICT Health Law, not the PDPL, as their primary constraint.

Marketing on the mainland leans on the federal PDPL's consent default plus TDRA's rules on unsolicited electronic communications; the free zones apply their own direct-marketing provisions (opt-out rights, lawful-basis discipline). Employee monitoring must respect the applicable regime's necessity and transparency rules, plus constitutional privacy protections and cybercrime-law limits on interception. Cookies have no dedicated UAE statute; they resolve through the consent/notice frameworks of whichever regime applies, with free-zone guidance closest to EU practice. The pragmatic pattern is GDPR-style banner behavior UAE-wide.

Per-regime. DIFC and ADGM maintain adequacy lists (both recognize the EU/EEA, UK, and several others) and their own standard contractual clauses for non-adequate destinations, transfers from a DIFC entity follow DIFC instruments even if the recipient is the group's mainland parent. The federal PDPL's transfer article follows the adequacy/safeguards pattern, with detail pending the executive regulations. Health data localization and Central Bank expectations override the general frameworks for their datasets. Run a transfer register keyed by exporting entity and regime, and treat cross-regime intra-group flows with the same rigor as international ones.