The UAE Personal Data Protection Law (PDPL — Federal Decree-Law No. 45 of 2021) establishes the UAE’s comprehensive data protection framework. Here is the complete compliance guide for 2025.
What is the UAE PDPL?
The UAE PDPL was issued in September 2021 and came fully into force in January 2022. It applies to: any entity processing personal data of UAE residents, regardless of where the entity is based. The PDPL is modelled partly on the EU GDPR (General Data Protection Regulation) but has UAE-specific requirements. Enforcement: the UAE Data Office (UDO) is the primary enforcement authority. DIFC and ADGM have their own data protection laws that apply within those jurisdictions (DIFC Data Protection Law 2020, ADGM Data Protection Regulations 2021).
Key PDPL Requirements
Under UAE PDPL, businesses must: have a lawful basis for processing personal data (consent, contract, legitimate interest, legal obligation), provide transparent privacy notices to data subjects, maintain records of processing activities, implement appropriate technical and organisational security measures, respond to data subject access requests within 30 days, report personal data breaches to the UDO within 72 hours, and obtain prior written consent for cross-border data transfers to countries without adequate protection. Data Protection Officer (DPO): required for large-scale processing businesses. All businesses processing significant personal data should appoint a DPO or equivalent.
PDPL Penalties 2025
UAE PDPL violations can result in: administrative fines up to AED 5,000,000, criminal penalties for serious violations (intentional breach, sensitive data breaches), and reputational damage and regulatory sanctions. Compliance timeline: the UAE PDPL has been in force since 2022. Any UAE business processing personal data should already be compliant. If not: engage a UAE data protection specialist to conduct a gap analysis and implement the required controls as quickly as possible.