UAE Personal Data Protection Law — Business Compliance Guide 2026
UAE’s Personal Data Protection Law (PDPL), Federal Decree-Law No. 45 of 2021, came into force and applies to most businesses operating in UAE. Similar in spirit to the EU’s GDPR, it creates rights for UAE residents and obligations for businesses that process their personal data. This guide covers UAE PDPL compliance for 2026.
In this guide:
UAE PDPL Overview
- Full name: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
- Regulator: UAE Data Office (established under the law); headquartered in Abu Dhabi
- Scope: applies to any person or entity that processes personal data of UAE residents, regardless of where that entity is located — UAE-based businesses AND international businesses with UAE customers
- Exclusions: DIFC and ADGM have their own data protection regimes (DIFC Data Protection Law; ADGM Data Protection Regulations); businesses operating solely within those jurisdictions follow those separate frameworks
Key UAE PDPL Definitions
- Personal Data: any information relating to an identified or identifiable natural person; includes name, address, phone number, email, location data, IP address, biometric data
- Sensitive Personal Data: health data; biometric data; genetic data; financial data; religious beliefs; criminal record; race and ethnicity; data relating to children; requires extra protection
- Data Controller: the entity that determines the purpose and means of processing personal data (e.g., your business)
- Data Processor: entity that processes data on behalf of the Data Controller (e.g., your cloud provider, payroll software)
UAE PDPL Key Obligations for Businesses
- Lawful basis: you must have a lawful basis for processing personal data; bases include: consent; legitimate interests; contractual necessity; legal obligation; vital interests; public task
- Privacy Notice: provide a clear privacy notice to individuals before collecting their data; must include: what data you collect, why, how long you keep it, who you share it with, their rights
- Consent: must be informed, specific, and freely given; pre-ticked boxes do not constitute consent; individuals can withdraw consent at any time
- Data Subject Rights: UAE residents have rights to: access their data; correct inaccurate data; delete data; object to processing; data portability; restrict processing
- Data Transfers: personal data can only be transferred outside UAE to countries with adequate data protection; or with appropriate safeguards (standard contractual clauses); or with consent
- Data Breach Notification: report personal data breaches to UAE Data Office within 72 hours if the breach risks harm to individuals
- Privacy Impact Assessment (PIA): required for high-risk processing activities (e.g., large-scale sensitive data processing, CCTV, profiling)
UAE PDPL Penalties
- Minor violations: AED 5,000-50,000
- Major violations: AED 50,000-500,000
- Serious violations involving sensitive data: up to AED 1 million; criminal prosecution possible