The UAE Federal Data Protection Law (PDPL) applies to most UAE businesses. Here is the complete 2025 compliance guide.
UAE PDPL Overview
Federal Decree-Law No. 45 of 2021 (Personal Data Protection Law, PDPL): the UAE’s first federal data protection law. In force: 2 January 2022 (and implementing regulations in force 2023). Regulator: UAE Office for Data Protection (affiliated with Ministry of Justice for federal entities). Scope: applies to any business processing personal data of UAE residents, regardless of where the business is incorporated. Key exclusions: DIFC and ADGM have their own separate data protection laws (DIFC Data Protection Law 2020, ADGM Data Protection Regulations 2021). What is “personal data” under PDPL: name, address, ID number, email, location data, biometric data, and any information that identifies a living individual.
UAE PDPL Key Requirements for Businesses
Lawful basis: collect personal data only with: consent (specific, informed, freely given), legitimate interest (must be balanced against individual rights), legal obligation, or contract performance. Privacy notice: inform individuals what data you collect, why, how long you keep it, and with whom you share it (Privacy Policy on your website, and at point of data collection). Data subject rights: right to access (individuals can request their data). Right to correction. Right to erasure (“right to be forgotten”). Right to object to processing. Data breach notification: report data breaches to the UAE Office for Data Protection within 72 hours (serious breaches affecting large numbers of individuals). Data transfers: transferring UAE personal data outside the UAE requires adequate protection (binding contractual commitments with the recipient, or the recipient country has adequacy recognition). Penalties for non-compliance: fines up to AED 5,000,000 for violations. Criminal penalties for intentional violations.