UAE Free Zone Data Protection Law Reference 2026 — PDPL and Privacy Obligations
UAE has introduced comprehensive data protection legislation. Here is the 2026 reference guide for UAE free zone companies on data privacy obligations.
In this guide:
UAE Personal Data Protection Law (PDPL)
- Law: UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL)
- Applicability: Applies to UAE-based entities processing personal data; applies even if data subjects are not UAE nationals
- Exemption: DIFC (DIFC Data Protection Law 2020) and ADGM (ADGM Data Protection Regulations) have separate regimes
Key PDPL Obligations
- Lawful basis: Must have a lawful basis for processing personal data (consent, contract, legitimate interests, etc.)
- Transparency: Must inform data subjects about how their data is used
- Data minimization: Only collect data that is necessary for the stated purpose
- Retention: Do not retain data longer than necessary
- Security: Implement appropriate technical and organizational security measures
- Subject rights: Data subjects have rights of access, correction, deletion, and objection
Cross-Border Data Transfers
- Adequacy: Can transfer UAE personal data to countries with adequate protection
- Contractual safeguards: Standard contractual clauses for transfers to countries without adequacy decision
UAE Data Protection Authority
- Regulator: UAE Data Office (data.gov.ae)
- Penalty: Fines up to AED 5 million for violations