.webp)
The United Arab Emirates (UAE) has taken a major step toward aligning with global privacy standards through the Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data — commonly known as the PDPL.
For the first time, data protection rules now apply across all seven emirates (on-shore), bringing the UAE closer to frameworks like the EU GDPR and Turkey’s KVKK.
Until recently, privacy in the UAE was fragmented across sector-specific laws (banking, telecoms, healthcare). The PDPL changes that by creating a federal baseline for personal data protection, enforced by a new regulator — the UAE Data Office, established under Federal Decree-Law No. 44 of 2021.
Even if your company is not based in the UAE, you may still fall under PDPL.
The law has extraterritorial scope: it applies to organisations outside the UAE that process personal data of individuals inside the UAE.
The PDPL applies to:
However, it does not apply to:
PDPL mirrors many of GDPR’s principles but keeps a uniquely UAE flavor:
Processing must be lawful and transparent, with clear purposes communicated to individuals.
Consent is the primary legal basis for processing under the PDPL.
It must be freely given, specific, informed, and unambiguous.
Exceptions include:
Individuals (data subjects) can:
Controllers must:
Personal data may be transferred outside the UAE only when:
A quick, skimmable view of where they align—and where they diverge.
| Feature | UAE PDPL | EU GDPR |
|---|---|---|
| Legal basis | Consent-centric; processing typically requires clear consent, with specific exceptions (e.g., contract, legal obligations, public interest). | Multiple lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests). |
| Territorial scope | Applies to UAE controllers/processors and to non-UAE entities processing data of individuals in the UAE. | Applies to EU controllers/processors and to non-EU entities offering goods/services to or monitoring individuals in the EU. |
| Free-zone treatment | DIFC & ADGM have their own data-protection regimes; PDPL generally does not apply within those zones. | Uniform EU-wide framework with limited national derogations; no “free-zone” exemptions. |
| Cross-border transfers | Permitted to “adequate” jurisdictions or with safeguards/derogations (e.g., contractual clauses, necessity, consent). | Established toolbox: adequacy decisions, SCCs, BCRs, and limited derogations. |
| Data subject rights | Access, rectification, erasure, objection, restriction, portability—implemented per PDPL framework. | Same core rights, with mature regulator guidance and extensive case law. |
| Governance & DPO | ROPA, TOMs, DPIAs for high-risk processing; DPO required in specified higher-risk scenarios. | Similar obligations; DPO required where core activities involve large-scale monitoring or special-category data. |
| Breach notification | Notify the UAE Data Office and, where appropriate, affected individuals; practical timelines set by Executive Regulations. | Notify authority within 72 hours where feasible; notify individuals when high risk. |
| Penalties | Administrative penalties determined by the UAE Data Office/Cabinet decisionsamounts defined by guidance | Up to €20M or 4% of global annual turnover (whichever is higher). |
| Operational status | Effective; full enforcement aligned to Executive Regulations and grace periods. | Fully operational since 2018 with established enforcement. |
Tip: If you’re already GDPR-compliant, you’ve covered much of the groundwork—still review consent design, transfer mechanics, and any DIFC/ADGM interactions for PDPL-specific alignment.
If you’re already GDPR-compliant, you’re about 70 % ready for PDPL — but you’ll still need to tailor for its consent focus and local transfer rules.
Whether you’re a UAE entity, a Turkish SaaS vendor, or an international data controller, a practical PDPL readiness plan should include:
The UAE is positioning itself as the data-driven hub of the Middle East.
Compliance isn’t just about avoiding penalties — it’s about earning trust in a market that values security and transparency.
For cross-border service providers — especially Turkish, EU, or US companies processing UAE data — PDPL compliance will soon be a client requirement.
The UAE’s PDPL is not just another piece of legislation — it’s a strategic milestone in the region’s digital transformation.
It brings the UAE in line with international privacy expectations while leaving space for local flexibility.
Now is the right time to review your compliance posture, update contracts, and train teams before full enforcement begins.
