UAE PDPL Personal Data Protection Law — Complete Business Compliance Guide 2026
UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL) is the UAE’s comprehensive data protection legislation, applicable to all UAE businesses processing personal data. This guide covers UAE PDPL compliance requirements for free zone and mainland companies in 2026.
In this guide:
UAE PDPL Overview
- Full name: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)
- Effective date: Data processing regulations took effect January 2, 2022; enforcement from early 2023
- Scope: applies to any natural or legal person processing personal data of UAE residents
- Exemptions: government entities; personal/family data processing; public security/national defence
- DIFC and ADGM: have their own data protection laws (DIFC DP Law, ADGM DPR) that pre-date UAE PDPL
Key PDPL Definitions
- Personal data: any information relating to an identified or identifiable natural person (name, email, phone, IP address, location, biometric data)
- Sensitive personal data: health data, biometric data, genetic data, racial/ethnic origin, political opinions, religious beliefs, criminal records — requires explicit consent and heightened protection
- Data controller: entity that determines purposes and means of personal data processing
- Data processor: entity processing data on behalf of controller
PDPL Core Requirements for Businesses
- Lawful basis: must have a legal basis for processing (consent, contract, legal obligation, legitimate interest)
- Privacy notice: inform individuals of data collected, purpose, retention period, rights, and contact details
- Consent: where consent is the basis, it must be explicit, informed, and revocable
- Data subject rights: right to access, rectification, erasure, objection, portability
- Cross-border transfers: data transfers outside UAE only to adequate countries or with appropriate safeguards
- Data breach notification: notify UAE Data Office of significant breaches within 72 hours
PDPL Penalties
- Processing in violation of PDPL: up to AED 5M
- Sensitive data violations: up to AED 5M (higher risk threshold)
- Failure to notify breach: up to AED 1M
- Criminal sanctions: possible imprisonment for intentional violations
Practical PDPL Steps for UAE Free Zone Companies
- Data mapping: identify what personal data you collect, process, store, and share
- Privacy policy: update website and app privacy policy to PDPL compliance
- Consent mechanisms: implement proper consent collection (cookie consent banners; email opt-in)
- Data subject request process: create a process for handling access/erasure requests
- Vendor agreements: ensure data processing agreements with vendors who handle your data
- Employee training: brief staff on PDPL obligations