UAE

Substantial

Federal Decree-Law No. 45 of 2021 (PDPL)

Authority: UAE Data Office | Enforcement: Active | Enacted: January 2022

Overview

The UAE enacted a comprehensive federal data protection law in 2021, effective January 2022, with the implementing regulations issued in 2023. The DIFC and ADGM free zones maintain their own data protection regimes. The law aligns broadly with GDPR principles.

14-Topic Coverage

Data Protection Authority

Fully Addressed

UAE Data Office established as the federal supervisory authority.

Data Subject Rights

Fully Addressed

Rights to access, rectification, erasure, restriction, portability, and objection.

Cross-Border Transfer

Fully Addressed

Transfers permitted to adequate countries or with appropriate safeguards.

Breach Notification

Fully Addressed

Mandatory notification to UAE Data Office and affected individuals.

DPO Requirements

Partially Addressed

DPO required for specific categories of controllers as defined in regulations.

Children's Data

Partially Addressed

Enhanced protections for children's data with parental consent requirements.

Penalties & Enforcement

Fully Addressed

Administrative fines up to AED 20 million.

Sector-Specific Rules

Fully Addressed

DIFC Data Protection Law 2020, ADGM Data Protection Regulations, health and financial sector rules.

AI & Automated Decisions

Partially Addressed

UAE AI Strategy 2031 and sector guidance. No specific AI data protection rules.

Data Localisation

Partially Addressed

Some categories of data must be stored locally per sector regulations.

Significant Data Fiduciary

Not Addressed

No direct equivalent concept in the PDPL.

Government Data

Partially Addressed

Government processing has specific exemptions under the PDPL.