UAE Federal PDPL: Data Protection Law No. 45 of 2021

It applies to processing of personal data of data subjects residing in or having a place of business in the UAE, by controllers or processors inside the country (outside the financial free zones) or abroad. Carved out: government entities and government data, personal data held by security and judicial authorities, health data regulated by its own federal law (No. 2 of 2019, the ICT Health Law), banking and credit data subject to Central Bank rules, and companies in DIFC and ADGM, which apply their own data protection laws with independent commissioners. Scoping a UAE program therefore starts with which regime each entity and dataset sits under.

Consent is the anchor: prior, clear, unambiguous, evidenced, and withdrawable. Article 4 lists the exceptions where processing may proceed without it, including: protection of public interest, processing related to legal claims and judicial procedures, protection of the data subject's interests, contract performance or pre-contract steps at the data subject's request, compliance with other UAE laws, and specified employment-related processing. There is no general legitimate-interest basis comparable to GDPR Article 6(1)(f), which is the single biggest structural difference for EU-calibrated programs.

A GDPR-recognizable catalogue: the right to receive information about processing, access and obtain a copy, request correction and erasure, restrict or object to processing (including direct marketing and automated processing), portability, and the right not to be subject to fully automated decisions producing legal effects without human review. Response timelines and fee rules are among the details assigned to the executive regulations; pending those, well-advised controllers run the requests on GDPR-style one-month clocks and document their reasoning.

The law took effect January 2, 2022, and states that the executive regulations will specify its operational machinery, breach notification periods, DPO appointment cases, cross-border transfer mechanics, and administrative penalties. As of mid-2026 the regulations remain unpublished, and the UAE Data Office has correspondingly not run a public penalty docket. That is not a compliance holiday: the statutory duties are in force, sector regulators (Central Bank, TDRA, health authorities) enforce their own rules now, and the penal code and cybercrime law criminalize unlawful disclosure. Build now, tune when the regulations land.

It does not apply inside them. DIFC runs DP Law No. 5 of 2020 with its own Commissioner of Data Protection, and ADGM its Data Protection Regulations 2021 with an Office of Data Protection, both closer to the GDPR, with active guidance, registration duties, and fines. A UAE group commonly spans all three regimes: mainland entities under the federal PDPL, a DIFC-booked finance arm under DIFC law, and an ADGM vehicle under ADGM regulations. Contracts, notices, and transfer mechanics must be assigned per entity; the free-zone regimes also have their own adequacy lists and SCC forms for transfers.