UAE PDPL
In force United Arab Emirates · In force Jan 2, 2022 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Federal GDPR-style data protection law for the onshore UAE covering consent and other bases, data subject rights, breach notification, DPOs and cross-border transfers. Key details (including fines and some thresholds) depend on Executive Regulations that have not been issued.
- Who it applies to
- Processing of personal data of UAE residents or by controllers/processors established in the UAE; excludes free zones with their own laws (DIFC, ADGM), government data, and health/banking data covered by sectoral laws.
- Penalties
- Administrative penalties to be set by Cabinet decision; not yet issued.
- Enforced by
- UAE Data Office
- Official name
- Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
- Citation
- Federal Decree-Law No. 45 of 2021
- Topics
- privacy, breach-notification, data-residency
Verified 2026-09-22 u.ae
Research notes
Executive Regulations still unpublished as of 2026; organisations get six months from their issuance to comply. No dated compliance deadline yet.
Related
Israel Privacy Protection Law Amendment 13
Kenya Data Protection Act
Nigeria NDPA
Saudi PDPL
South Africa POPIAQuestions about UAE PDPL
- What are the UAE PDPL compliance deadlines?
- Jan 2, 2022: PDPL enters into force.
- When does UAE PDPL take effect?
- UAE PDPL took effect on Jan 2, 2022.
- Who does UAE PDPL apply to?
- Processing of personal data of UAE residents or by controllers/processors established in the UAE; excludes free zones with their own laws (DIFC, ADGM), government data, and health/banking data covered by sectoral laws.
- What are the penalties under UAE PDPL?
- Administrative penalties to be set by Cabinet decision; not yet issued.