PDPL

What it is

Federal Decree-Law No. 45 of 2021 is the United Arab Emirates' first federal, comprehensive data protection law, commonly called the UAE PDPL. It came into force on 2 January 2022. It sets general rules for how personal data must be collected, used, shared, and protected, and it created the legal basis for the UAE Data Office as the supervisory body. Much operational detail was left to Executive Regulations.

Who it applies to

The law applies to controllers and processors established in the UAE, and to those outside the UAE who process the personal data of data subjects located in the UAE. Important exclusions include government data and government authorities, personal data held by security and judicial authorities, health and banking or credit data covered by their own legislation, and processing for purely personal use. Companies in free zones with their own data protection regimes, such as DIFC and ADGM, are also carved out.

Core principles

Personal data must be processed lawfully, fairly, and transparently, collected for a specific and clear purpose, and limited to what is necessary. Data must be kept accurate and up to date, stored only as long as needed, and protected with appropriate technical and organizational measures. Controllers are expected to be able to show how they comply.

Legal bases

Consent is the principal basis, and it must be clear, specific, unambiguous, and capable of being withdrawn. The law also allows processing without consent in listed cases, including to protect the public interest, to perform a contract, to meet a legal obligation, to protect the data subject's vital interests, or to pursue the controller's lawful interests where other conditions are met. Sensitive personal data attracts stricter protection.

Individual rights

Data subjects can request information about the processing of their data and obtain access to it. They also have the right to data portability, to correction and erasure, to restrict processing, to stop processing in certain situations, and to object to decisions based solely on automated processing, including profiling.

Key obligations

Controllers must keep records, apply privacy by design, and use processors under appropriate terms. A data protection officer must be appointed in defined higher-risk cases, such as large-scale processing of sensitive data or systematic monitoring. A data protection impact assessment is needed where new technologies or high-risk processing could threaten data subjects' privacy.

Data breaches

When a breach could prejudice the privacy, confidentiality, or security of personal data, the controller must notify the Data Office, and must notify affected individuals in cases the law specifies. The breach notice must describe the nature and cause of the incident, the data affected, and the steps taken. The Executive Regulations and Data Office guidance carry the specific timing rules.

Cross-border transfers

Personal data may be moved outside the UAE to countries that the Data Office recognizes as providing an adequate level of protection. Where there is no adequacy finding, transfers are possible under safeguards such as contracts or binding arrangements, or on specific grounds such as the data subject's explicit consent.

Enforcement and penalties

The UAE Data Office, established by separate federal decree-law, is the supervisory authority. The PDPL provides for complaints, investigations, and administrative sanctions, with the details of penalties to be set by Cabinet decision and the Executive Regulations. Check the current status of those instruments before relying on any specific penalty.

The official text

The authoritative version is the Arabic text of Federal Decree-Law No. 45 of 2021, published in the UAE Official Gazette and on the UAE Government Portal. An English translation is available on the UAE Legislation portal, but the Arabic text prevails. Use that text, not this summary, for anything that matters.