The UAE's PDPL, what it means for your business
Understand whether the law covers you, handle consent and data rights properly, and watch for the Executive Regulations.
Official sources
Use these official places to read the text and find the latest information.
Official website
The UAE Legislation portal publishes the English text of Federal Decree-Law No. 45 of 2021, with issue and effective dates.
Visit uaelegislation.gov.ae ↗Get the document
The law is published free on the UAE Legislation portal, with an English translation. The Arabic text prevails if the two differ. The u.ae government portal summarises the law and the UAE Data Office.
Open the official page ↗Works alongside
GDPR, the DPDP Act and ISO 27701 overlap with it. Free zones such as the DIFC have their own laws.
Browse all frameworks →What UAE PDPL is
Federal Decree-Law No. 45 of 2021 is the UAE's general data protection law. It governs how controllers and processors collect, use, share and move personal data, and gives people rights over their data.
It centres on consent or another listed ground, limited and secure use, breach reporting, data protection officers for higher-risk processing and rules for transfers abroad. Much of the detail, including some deadlines, depends on Executive Regulations.
How UAE PDPL got to where it is today
The milestones that changed what organisations have to do.
Health data law
Federal Law No. 2 of 2019 regulates use of information and communication technology in health fields. The PDPL leaves health data that has its own legislation outside its scope.
DIFC data protection law
The DIFC enacts Data Protection Law, DIFC Law No. 5 of 2020, on 21 May 2020, in force from 1 June 2020. The DIFC Commissioner of Data Protection supervises it.
PDPL issued
Federal Decree-Law No. 45 of 2021 is issued on 20 September 2021 and published in the Official Gazette on 26 September 2021.
UAE Data Office
Federal Decree-Law No. 44 of 2021 establishes the UAE Data Office, which acts as the federal data regulator.
PDPL in force
The PDPL takes effect on 2 January 2022.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
You process personal data of people in the UAE.
You are based in the UAE and handle personal data of people anywhere.
You use processors or cloud services that hold personal data.
You transfer personal data out of the UAE.
What it asks of you
The requirements fall into six areas.
Scope and lawful processing
Check that the law applies, and rely on consent or another permitted ground.
Processing principles
Fair, specific, limited, accurate, secure and time-limited use of data.
Controller and processor duties
Records of processing, processor contracts, security and impact assessments.
Data protection officer
Appoint a DPO in higher-risk cases and let them work independently.
Individual rights
Information, portability, correction, erasure, restriction, objection and review of automated decisions.
Transfers and breaches
Move data abroad only on a permitted basis and report breaches to the Data Office and individuals.
The 4 parts, 13 article groups and 56 obligations of the UAE PDPL
The UAE Personal Data Protection Law sets duties for controllers and processors, rights for individuals and rules for moving data abroad. Many details such as breach deadlines and transfer controls are left to Executive Regulations.
13 article groups · 56 obligations
SScope and lawful processingWhen the law applies and the basis and rules for processing personal data (Articles 2 to 6).3 article groups · 13 obligations
- Art. 2(1)
Apply the law if you process personal data of people in the UAE, or you are a controller or processor based in the UAE, or based abroad but processing data of people in the UAE.
What you do
- Record why the law applies
- Review when you enter new markets
- Art. 2(2)
Check the exclusions before assuming the law does not apply, such as government data, personal data held by security and judicial authorities, personal use, health and banking data under their own laws, and free zones with their own data protection laws.
What you do
- List any exclusion you rely on
- Keep the legal basis for it
- Art. 3
Check whether the UAE Data Office has exempted you, which can apply to establishments that do not process large volumes of personal data under the Executive Regulations.
What you do
- Do not assume an exemption without it being granted
- Record the decision
Evidence to keep
- Applicability assessment
- Record of exemptions relied on
- Art. 4
Do not process personal data without the owner's consent unless a listed exception applies, such as public interest, legal claims, contract performance, protecting the data owner's interests, or a legal obligation.
What you do
- Record the ground for each processing activity
- Review it when the purpose changes
- Art. 6(1)(a)
Be able to prove consent when you rely on it.
What you do
- Keep timestamped consent records
- Store the wording shown
- Art. 6(1)(b)
Present consent in a clear, simple, unambiguous and easily accessible form, in writing or electronically.
What you do
- Use plain-language prompts
- Avoid bundled consent
- Art. 6(1)(c) and 6(2)
Let people withdraw consent easily at any time, without affecting earlier lawful processing.
What you do
- Offer a one-click withdrawal
- Act on withdrawals promptly
Evidence to keep
- Record of processing grounds
- Consent records and wording
- Withdrawal log
- Art. 5(1)
Process personal data fairly, transparently and lawfully.
What you do
- Publish a clear privacy notice
- Review practices for fairness
- Art. 5(2)
Collect personal data for a specific and clear purpose and do not use it later in an incompatible way.
What you do
- Record the purpose for each dataset
- Check new uses against it
- Art. 5(3)
Keep personal data sufficient and limited to what is necessary for the purpose.
What you do
- Remove unneeded fields from forms
- Review collection yearly
- Art. 5(4) and 5(5)
Keep data accurate and up to date, and delete or correct wrong data.
What you do
- Offer ways to update records
- Run periodic data quality checks
- Art. 5(6)
Keep personal data secure against breach, unauthorised processing and tampering through appropriate technical and organisational measures.
What you do
- Apply access control and encryption
- Review controls yearly
- Art. 5(7)
Do not keep personal data after the purpose is exhausted, unless the person cannot be identified through an anonymisation mechanism.
What you do
- Set retention periods
- Delete or anonymise on expiry
Evidence to keep
- Data inventory with purposes
- Retention schedule
- Data quality and anonymisation procedures
CController and processor dutiesWhat organisations deciding on or carrying out processing must do (Articles 7 to 12, 20 and 21).5 article groups · 24 obligations
- Art. 7(1)
Apply technical and organisational measures to keep personal data confidential, private and protected from breach, destruction, alteration or tampering, in line with the risk.
What you do
- Run a risk-based security review
- Document the measures
- Art. 7(2)
Apply suitable measures when choosing means of processing and during processing to comply with the law, including pseudonymisation.
What you do
- Apply pseudonymisation in analytics
- Review designs for privacy
- Art. 7(3)
Use automatic settings so processing stays limited to its purpose, in volume, type, storage period and accessibility.
What you do
- Set privacy-friendly defaults
- Restrict access by role
- Art. 7(4)
Keep a special record of personal data that covers controller and DPO details, data categories, authorised access, processing times, deletion and change mechanisms, purposes, cross-border movement and security measures, and give it to the Office on request.
What you do
- Build a processing record
- Keep it up to date
- Art. 7(5)
Appoint processors that give sufficient guarantees of suitable technical and organisational measures.
What you do
- Assess processors before hiring
- Put guarantees in contracts
Evidence to keep
- Record of processing
- Processor due diligence and contracts
- Technical and organisational measures list
- Art. 8(1)
Process data only on the controller's instructions and under contracts that set scope, subject, purpose, nature, data type and category of data subjects.
What you do
- Sign a data processing contract
- Check the scope against actual use
- Art. 8(2) and 8(6)
Apply suitable technical and organisational protection from the design stage, and protect processing media and devices and the data on them.
What you do
- Secure systems by design
- Protect devices used for processing
- Art. 8(3) and 8(4)
Process for the stated purpose and period, tell the controller if the period must be extended, and erase data after expiry or on handover.
What you do
- Track processing end dates
- Confirm deletion in writing
- Art. 8(5)
Avoid disclosing personal data or results of processing except where the law allows.
What you do
- Restrict onward sharing
- Log disclosures
- Art. 8(7)
Keep a special record of the personal data processed for the controller and give it to the Office on request.
What you do
- Maintain the record
- Review it with each contract change
- Art. 8(8) and 8(9)
Provide the means to prove compliance when the controller or Office asks, and process under the law's rules and the Office's instructions.
What you do
- Keep audit evidence
- Respond quickly to requests
- Art. 8(10)
Where several processors take part, set their obligations, responsibilities and roles in a written contract, or they may be treated as jointly responsible.
What you do
- Sign written agreements with every processor
- Map the processing chain
Evidence to keep
- Processing contract
- Processor record of processing
- Deletion confirmations
- Art. 9(1)
Notify the UAE Data Office of a breach that would prejudice privacy, confidentiality or security within the period and in the way the Executive Regulations set, with a description of the breach, DPO details, likely effects, corrective measures and documents.
What you do
- Prepare a notification template
- Confirm the current deadline in the Executive Regulations
- Art. 9(2)
Tell the affected person about the breach and the measures taken, within the period set by the Executive Regulations, if it would prejudice their privacy or security.
What you do
- Draft plain-language notices
- Define who approves them
- Art. 9(3)
Have processors tell the controller as soon as they become aware of a breach.
What you do
- Add a processor notification clause
- Test the contact route
Evidence to keep
- Breach response procedure
- Breach register
- Notification templates
- Art. 10(1)
Appoint a DPO with sufficient skills if processing carries high risk through new technologies or data volume, involves systematic and comprehensive assessment of sensitive data including profiling and automated processing, or involves large volumes of sensitive data.
What you do
- Run a DPO need assessment
- Record the result
- Art. 10(2) and 10(3)
Allow the DPO to be an employee or an authorised person inside or outside the UAE, and give the Office the DPO's contact details.
What you do
- Publish the DPO contact
- Notify the Office
- Art. 11
Make sure the DPO checks compliance, receives requests and complaints, advises on assessments and intrusion prevention, links to the Office and keeps information confidential.
What you do
- Set the DPO's tasks in writing
- Provide a reporting line to senior management
- Art. 12
Involve the DPO in data protection matters, give them resources and support, do not dismiss or penalise them for doing their duties, and avoid giving them conflicting duties.
What you do
- Invite the DPO to project reviews
- Review the DPO's workload and independence
Evidence to keep
- DPO appointment record
- DPO role description
- Notification to the Office of DPO contact details
- Art. 20(1)
Apply technical and organisational measures for a high standard of information security suited to the risks, including encryption and pseudonymisation, confidentiality, integrity and resilience of systems, timely data recovery and regular testing of controls.
What you do
- Encrypt data at rest and in transit
- Test controls and recovery on a schedule
- Art. 20(2)
Take into account the risks of loss, alteration, unauthorised disclosure or access, and the cost, nature, scope and purposes of processing when judging the security level.
What you do
- Record the risk reasoning
- Revisit it when processing changes
- Art. 21(1) and 21(2)
Assess the impact on personal data protection before processing that uses modern technology posing a high risk, including systematic profiling with serious effects and large-scale processing of sensitive data.
What you do
- Screen new projects for impact assessment need
- Complete the assessment before launch
- Art. 21(3)
Make each assessment explain the processing and purpose, how necessary and proportionate it is, the risks to the data owner and the measures to reduce them.
What you do
- Use an assessment template
- Keep reviewer sign-off
- Art. 21(5) and 21(7)
Coordinate with the DPO on assessments and review the results regularly if risks change.
What you do
- Involve the DPO early
- Set a review date for each assessment
Evidence to keep
- Security measures documentation
- Impact assessment reports
- Testing and review records
RIndividual rightsWhat people can ask of you (Articles 13 to 19).3 article groups · 11 obligations
- Art. 13(1)
Give a person, free of charge on request, the types of data processed, purposes, automated decisions including profiling, who it is shared with, storage rules, correction and objection procedures, protection for cross-border processing, breach actions and how to complain to the Office.
What you do
- Build a request response pack
- Respond using a standard template
- Art. 13(2)
Before processing starts, tell the person the purposes, the recipients inside and outside the UAE, and the cross-border protection measures.
What you do
- Show a notice at the point of collection
- Keep a version history
- Art. 13(3)
Reject information requests only on the grounds the law allows, such as unrelated or excessively repetitive requests, conflict with investigations, harm to security efforts, or effect on third-party privacy.
What you do
- Document the reasons for each refusal
- Train staff on valid grounds
- Art. 14
Give people their data in an orderly, machine-readable form where processing is based on consent or contract and carried out by automated means, and transfer it to another controller when technically feasible.
What you do
- Offer a structured export
- Define a handover process
Evidence to keep
- Rights request log
- Privacy notice
- Data export procedure
- Art. 15(1)
Correct or complete inaccurate personal data without undue delay when asked.
What you do
- Offer a correction form
- Close requests within a set time
- Art. 15(2) and 15(3)
Erase personal data on request when it is no longer needed, consent is withdrawn, the person objects without a legitimate reason to continue, or processing is unlawful, subject to the exceptions in the law.
What you do
- Run erasure workflows across systems
- Record exceptions applied
- Art. 16
Restrict processing when accuracy is disputed, processing breaches agreed purposes or the law, and tell the person when a restriction ends.
What you do
- Tag restricted records
- Notify when lifting the restriction
- Art. 17
Stop processing when the person objects to direct marketing including profiling, to statistical surveys unless public interest applies, or when processing breaches Article 5.
What you do
- Honour marketing opt-outs promptly
- Suppress objected records
Evidence to keep
- Correction and erasure procedure
- Restriction register
- Objection and direct marketing opt-out records
- Art. 18(1) and 18(2)
Let people object to decisions made by automated processing, including profiling, that affect them legally or adversely, except where contract, other law or prior consent allows it.
What you do
- List automated decisions in use
- Note which exception applies
- Art. 18(3) and 18(4)
Protect privacy in exempt automated processing and involve a human reviewer when the person asks for a review of an automated decision.
What you do
- Provide a human review route
- Record review outcomes
- Art. 19
Provide clear and appropriate ways for people to contact you to exercise their rights.
What you do
- Publish a privacy contact point
- Test the request channel
Evidence to keep
- Automated decision register
- Human review procedure
- Request channel details
TTransfers, complaints and enforcementMoving data abroad, complaints to the Office and consequences (Articles 22 to 29).2 article groups · 8 obligations
- Art. 22
Transfer personal data outside the UAE where the Office approves the destination as having suitable data protection laws and a regulator, or where the UAE has a data protection agreement with it.
What you do
- Check the destination before transferring
- Record the basis relied on
- Art. 23(1)(a)
Transfer to a country without such laws only under a contract that obliges the recipient to apply the law's measures and the measures a court or regulator there may impose.
What you do
- Use a transfer contract
- Keep a copy on file
- Art. 23(1)(b) to (f)
Otherwise transfer only on a listed ground: explicit consent that does not harm public or security interests, legal claims, contract performance, international judicial cooperation or the public interest.
What you do
- Record the ground
- Ask for explicit consent where relying on it
- Art. 23(2)
Follow the controls the Executive Regulations set for transfers abroad.
What you do
- Watch for the Executive Regulations
- Update transfer procedures when they apply
Evidence to keep
- Transfer register
- Transfer contracts
- Consents for transfers
- Adequacy assessments
- Art. 24
Expect people to complain to the UAE Data Office, which examines complaints with you and can apply the administrative penalties.
What you do
- Set up an internal complaint route
- Keep response records
- Art. 25
Use the written grievance to the Office's General Director within 30 days of notice of a decision or penalty, before any challenge.
What you do
- Diarise the 30-day window
- Keep decision notices
- Art. 26
Expect administrative penalties to be set by a Council of Ministers decision on the Office's proposal.
What you do
- Track the penalty decision
- Check your exposure
- Art. 28 and 29
Regularise your status within six months of the Executive Regulations being issued, which the Council of Ministers may extend by a similar period.
What you do
- Check the current status of the Executive Regulations
- Plan compliance against the dates that apply
Evidence to keep
- Complaint handling procedure
- Penalty and grievance procedure
- Compliance programme records
Nothing matches. Clear the search or pick another part.
Outcomes and implementation examples are from Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data (UAE Legislation portal), published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
Check if the law covers you
Confirm whether you are in scope and whether an exclusion or free-zone law applies instead.
- 2
Map your personal data
List what you hold, why, where it goes and how long you keep it.
- 3
Fix consent and notices
Make consent clear, provable and easy to withdraw, and give clear information to people.
- 4
Secure and plan for breaches
Apply security measures, prepare a breach plan and decide whether you need a DPO.
- 5
Review transfers and processors
Check contracts and the legal basis for any transfer of data outside the UAE.
How Optimus GRC helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus GRC |
|---|---|
| Scope and lawful processing | Applicability assessment and consent records |
| Processing principles | Data inventory with purposes and retention |
| Controller and processor duties | Processing records and assessments |
| Data protection officer | DPO appointment and role records |
| Individual rights | Rights request tracker |
| Transfers and breaches | Transfer register and incident log |
Free UAE PDPL readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- Processing record template
- Consent notice and withdrawal text
- Data subject request procedure
- Breach response checklist
Share or cite this page
Writing about UAE PDPL? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/uae-pdpl/">UAE PDPL explained in plain English - Optimus CyberX</a>Common questions
Is the PDPL in force?
Yes. It came into force on 2 January 2022. Some duties, such as breach notification periods and transfer controls, rely on Executive Regulations, so check the UAE Data Office and the Legislation portal for the latest.
Does it apply to foreign companies?
Yes, where a controller or processor outside the UAE processes personal data of people in the UAE.
Do we need a data protection officer?
Only in the cases listed in Article 10, such as high-risk processing through new technologies or data volume, systematic assessment of sensitive data, or large volumes of sensitive data.
What about the DIFC?
Free zones with their own data protection legislation are outside the PDPL. The DIFC has Data Protection Law, DIFC Law No. 5 of 2020, supervised by its own Commissioner of Data Protection.
Related frameworks
See how ready you are for UAE PDPL
Answer questions across every area. We email you a report showing where you comply and where you do not.