Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE)

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, often called the UAE PDPL, is the first federal data protection statute in the United Arab Emirates. It was issued on September 20, 2021, took effect on January 2, 2022, and is administered by the UAE Data Office established under Federal Decree-Law No. 44 of 2021. The Data Office sits inside the Ministry of Cabinet Affairs and is the central regulator for cross-emirate personal data processing. The statute applies to data controllers and processors located inside the UAE that process personal data of any natural person, controllers and processors located outside the UAE that process personal data of data subjects inside the UAE, and data subjects who are residents of the UAE. It does not apply to government data, data processed for personal or family use, security and judicial authority data, health data already regulated by Federal Law No. 2 of 2019, or banking and credit data already regulated under separate financial sector rules. UAE PDPL coexists with two important free-zone regimes. The Dubai International Financial Centre operates under DIFC Data Protection Law No. 5 of 2020, which is closely aligned with the EU General Data Protection Regulation and is enforced by the DIFC Commissioner of Data Protection. Abu Dhabi Global Market operates under ADGM Data Protection Regulations 2021, also GDPR-aligned, enforced by the ADGM Office of Data Protection. A company with offices in Dubai mainland, DIFC, and ADGM may simultaneously owe duties under all three regimes, and the federal law does not preempt the free-zone laws. The rights framework tracks GDPR closely. Data subjects have rights to information, access, correction, erasure, restriction, portability, objection, and rights regarding automated decision-making, including profiling. Lawful bases for processing under Article 4 include consent, contract performance, legal obligation, vital interests, public interest, and the controller's legitimate interest. Consent must be clear, simple, accessible, unambiguous, and revocable, and the controller must keep evidence of consent. Cross-border transfers under Articles 22 and 23 require either an adequacy designation by the UAE Data Office or an appropriate safeguard such as binding corporate rules, contractual clauses, or explicit consent. Breach notification under Article 9 requires the controller to notify the Data Office as soon as it becomes aware of a breach that may prejudice the privacy of the data subject and to notify the affected data subject when there is a serious risk. Executive Regulations were expected to specify fine amounts, breach timelines, registration requirements, and Data Protection Officer thresholds. As of mid-2026 the federal Executive Regulations are still pending public issuance, so day-to-day enforcement of the federal PDPL has been limited and most enforcement activity in the UAE happens inside DIFC and ADGM under those zones' GDPR-aligned regimes. Companies operating across the country still build their compliance programs against the PDPL text to be ready when regulations are published.