The UAE enacted its first comprehensive Personal Data Protection Law in 2021. Here is a complete guide to PDPL compliance for UAE businesses in 2025.
UAE PDPL Overview
Federal Decree-Law No. 45 of 2021 (UAE Personal Data Protection Law, PDPL) governs the collection, processing, and storage of personal data in the UAE. It came into full effect in January 2023 following a one-year transition period. Scope: any entity that collects or processes the personal data of individuals in the UAE must comply with PDPL. Applies to: UAE-based companies AND international companies that process the personal data of UAE residents. Key regulator: the UAE Data Office (established under the Ministry of Economy).
Key PDPL Requirements for Businesses
Legal basis for processing: businesses must have one of the following legal bases to process personal data: explicit consent of the data subject, performance of a contract, legitimate interests (that do not override the individual’s rights), or legal obligation. Privacy notices: companies must provide a clear privacy notice to individuals when collecting their data, explaining: what data is collected, why it is collected, how long it will be retained, and whether it will be shared with third parties. Data subject rights: UAE individuals have the right to: access their personal data, correct inaccurate data, request deletion of data (right to be forgotten), and object to processing. Data breach notification: if a data breach occurs, you must notify the UAE Data Office and affected individuals within 72 hours (for serious breaches).
PDPL and UAE Business Operations
For most UAE SMEs: appoint a Data Protection Officer (DPO) if processing large volumes of personal data or sensitive data. Document your data processing activities (internal record of what data you collect, where it is stored, and who has access). Update employee agreements to include data processing clauses. Ensure your website privacy policy is up-to-date and PDPL-compliant. Penalties for non-compliance: AED 50,000-20,000,000 depending on the nature of the violation.