Regulations › Rest of world › United Arab Emirates
PDPL (UAE)
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE)
WhenIn effect since 2 January 2022
Who enforces itUAE Data Office
Who it applies toProcessing of personal data in the UAE outside the free zones with their own laws, such as DIFC and ADGM.
Tell the regulatorNotify the Data Office on becoming aware of a breach prejudicing privacy, within a period the…
DPO requiredDPO required for high-risk processing, systematic assessment of sensitive data including profi…
RegistrationNo controller registration or licensing
Transfers abroadTransfer to countries with adequate protection approved by the Data Office, or via contract, e…
Request deadlineNo fixed response period
Maximum fineNo fines in force
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
3
Applies to controllers and processors outside the UAE that process personal data of data subjects inside the State.Art. 2(1)(c) · source ↗
Excludes government data, health and banking data under own laws, and free zones with their own laws (DIFC, ADGM) (Art. 2(2)).
Lawful basis
3
Processing without consent is prohibited except in listed cases (public interest, contract, legal obligation, public data and others); no legitimate interests ground.Art. 4 · source ↗
Consent
3
Controller must prove consent; it must be specific, clear, unambiguous, in writing or electronic form, and easy to withdraw.Arts. 1, 6 · source ↗
Sensitive data
1
Sensitive data is defined; no separate prohibition, but large-volume sensitive processing triggers DPO and DPIA duties.Arts. 1, 10(1)(c), 21(2) · source ↗
Children
0
No age threshold or child-specific rule in the Decree-Law.Not addressed · source ↗
Federal Decree-Law 26 of 2025 on Child Digital Safety (effective 1 Jan 2026) not reviewed.
People's rights
Rights
3
Information and access, portability, correction and erasure, restriction, objection (incl. direct marketing) and rights against automated decisions.Arts. 13-18 · source ↗
Counted 7 rights.
Request deadline
0
No fixed response period; correction 'without undue delay'. Periods left to Executive Regulations.Art. 15(1) · source ↗
Executive Regulations not issued as of Oct 2026; compliance period (Art. 29) has not started.
Marketing
1
Data subjects may object to processing for direct marketing, including related profiling.Art. 17(1) · source ↗
Governance
DPO required
1
DPO required for high-risk processing, systematic assessment of sensitive data including profiling, or large-volume sensitive data.Art. 10(1) · source ↗
Executive Regulations not issued as of Oct 2026; compliance period (Art. 29) has not started.
DPO qualifications
1
DPO needs sufficient skills and knowledge; no certification or residency rule.Art. 10(1) · source ↗
DPIA
2
Assess impact before high-risk processing, including large-scale sensitive data and systematic profiling with legal effects.Art. 21 · source ↗
Records
2
Keep a special record of processing including controller and DPO details; provide to the Data Office on request.Art. 7(4) · source ↗
Retention
1
Personal data must not be kept after the purpose is exhausted, unless anonymized.Art. 5 · source ↗
Breaches
Tell the regulator
1
Notify the Data Office on becoming aware of a breach prejudicing privacy, within a period the Executive Regulations will set.Art. 9(1) · source ↗
Executive Regulations not issued as of Oct 2026; compliance period (Art. 29) has not started.
Tell people
2
Notify data subjects where the breach would prejudice privacy, per Executive Regulations.Art. 9(2) · source ↗
Executive Regulations not issued as of Oct 2026; compliance period (Art. 29) has not started.
Transfers
Transfers abroad
2
Transfer to countries with adequate protection approved by the Data Office, or via contract, explicit consent and other listed grounds.Arts. 22-23 · source ↗
Localization
0
No general localization in the Decree-Law.Not addressed · source ↗
Sectoral rules (e.g. health data law) may require local storage; not reviewed.
Enforcement
Maximum fine
0
No fines in force; Cabinet decision defining violations and penalties not issued.Art. 26 · source ↗
Executive Regulations not issued as of Oct 2026; compliance period (Art. 29) has not started.
Criminal liability
0
No criminal offences in the Decree-Law; administrative penalties only.Art. 26 · source ↗
Private action
1
Data subjects may complain to the Data Office; no compensation or civil claim provision.Art. 24 · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws