Data Privacy Laws in the UAE

The United Arab Emirates enacted a broad set of legislative reforms to align its economic and commercial development with international best practice, using its 50th anniversary as a catalyst to strengthen the country’s legal foundation for long-term growth. Among nearly 50 federal legislative additions is Federal Decree-Law No. 45 of 2021, the Personal Data Protection Law (PDPL), announced in December 2021 and effective January 2, 2022. Executive Regulations are expected to add technical and operational compliance details; once issued, organizations receive a six-month grace period to achieve compliance. Law No. 44 establishes the UAE Data Office as the regulator responsible for operationalizing PDPL requirements.

The PDPL elevates and standardizes data protection for organizations operating in the UAE or processing personal data of UAE residents, addressing common enterprise blind spots in data inventory and transfer that increase exposure to breaches, ransomware, and unnecessary retention of redundant or “shadow” data. The PDPL is the first federally applicable UAE data protection law, distinct from free-zone regimes (e.g., DIFC and ADGM), which remain governed by their own laws and are exempt from the PDPL.

The law is consent-centric: processing personal data is prohibited without clear, simple consent, with defined lawful exceptions (e.g., public interest, legal procedures, contracts, preventive health, archival/scientific purposes). It defines obligations around fairness, transparency, purpose limitation, correction/deletion, retention, and minimization. It distinguishes personal data from sensitive personal data, including categories such as biometric, health, beliefs, and criminal records, and notably treats pseudonymized and aggregated data as sensitive due to potential reidentification. Compared to the GDPR, the PDPL diverges by not recognizing “legitimate interest” as a lawful basis, impacting marketing and similar practices. The framework is positioned to improve cross-border data relationships, support potential EU data adequacy recognition, and complement the UAE’s Smart Data Framework by pairing interoperability with clearer privacy protections.

• Federal Decree-Law No. 45 (PDPL) was announced in December 2021 and took effect on January 2, 2022.
• Executive Regulations are expected to trigger a six-month grace period for organizations to reach compliance.
• Law No. 44 establishes the UAE Data Office as the data protection regulatory authority.
• Approximately 31% of data stored by participating UAE companies was identified as critical to business operations, leaving 69% as redundant, obsolete, trivial, or shadow data.
• The PDPL is the first federally applicable data protection law in the UAE.
• The PDPL does not apply to financial free zones such as DIFC and ADGM, which maintain their own data protection laws.
• The PDPL applies to organizations in the UAE and to organizations outside the UAE that process personal data of UAE residents.
• Article 4 states that processing personal data without the data subject’s consent is prohibited, subject to exceptions.
• Sensitive personal data under the PDPL includes biometric data, health data, religious beliefs, and criminal records.
• Expatriates make up over 85% of the UAE population.

• “It is prohibited to process Personal Data without the consent of the Data Subject.”
• “Consent is a major concept that that the PDPL is centered on.”
• “This is the first federally applicable data protection law in the UAE.”
• “The PDPL serves to align the data management practices of the UAE with international best practice.”
• “Notably, ‘legitimate interest’ is not a lawful basis for processing personal data.”
• “The Smart Data Framework aims to enable data to be used by government and private entities easily, quickly, and effectively.”
• “Risk of data mismanagement increases when there is little or no standardization between organizations in the same value chain.”
• “This shift expands the focus from consent to a wider range of privacy-protecting actions.”
• “Now supported by the PDPL, the requirements around protection of personal data are clearer and more actionable.”
• “Companies should discover and identify what data is being processed to understand what personal data is subject to the PDPL’s additional protections.”