.webp)
The United Arab Emirates (UAE) has taken a major step toward aligning with global privacy standards through the Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data — commonly known as the PDPL.
For the first time, data protection rules now apply across all seven emirates (on-shore), bringing the UAE closer to frameworks like the EU GDPR and Turkey’s KVKK.
Until recently, privacy in the UAE was fragmented across sector-specific laws (banking, telecoms, healthcare). The PDPL changes that by creating a federal baseline for personal data protection, enforced by a new regulator — the UAE Data Office, established under Federal Decree-Law No. 44 of 2021.
Even if your company is not based in the UAE, you may still fall under PDPL.
The law has extraterritorial scope: it applies to organisations outside the UAE that process personal data of individuals inside the UAE.
The PDPL applies to:
However, it does not apply to:
PDPL mirrors many of GDPR’s principles but keeps a uniquely UAE flavor:
Processing must be lawful and transparent, with clear purposes communicated to individuals.
Consent is the primary legal basis for processing under the PDPL.
It must be freely given, specific, informed, and unambiguous.
Exceptions include:
Individuals (data subjects) can:
Controllers must:
Personal data may be transferred outside the UAE only when:
A quick, skimmable view of where they align—and where they diverge.
| Feature | UAE PDPL | EU GDPR |
|---|---|---|
| Legal basis | Consent-centric; processing typically requires clear consent, with specific exceptions (e.g., contract, legal obligations, public interest). | Multiple lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests). |
| Territorial scope | Applies to UAE controllers/processors and to non-UAE entities processing data of individuals in the UAE. | Applies to EU controllers/processors and to non-EU entities offering goods/services to or monitoring individuals in the EU. |
| Free-zone treatment | DIFC & ADGM have their own data-protection regimes; PDPL generally does not apply within those zones. | Uniform EU-wide framework with limited national derogations; no “free-zone” exemptions. |
| Cross-border transfers | Permitted to “adequate” jurisdictions or with safeguards/derogations (e.g., contractual clauses, necessity, consent). | Established toolbox: adequacy decisions, SCCs, BCRs, and limited derogations. |
| Data subject rights | Access, rectification, erasure, objection, restriction, portability—implemented per PDPL framework. | Same core rights, with mature regulator guidance and extensive case law. |
| Governance & DPO | ROPA, TOMs, DPIAs for high-risk processing; DPO required in specified higher-risk scenarios. | Similar obligations; DPO required where core activities involve large-scale monitoring or special-category data. |
| Breach notification | Notify the UAE Data Office and, where appropriate, affected individuals; practical timelines set by Executive Regulations. | Notify authority within 72 hours where feasible; notify individuals when high risk. |
| Penalties | Administrative penalties determined by the UAE Data Office/Cabinet decisionsamounts defined by guidance | Up to €20M or 4% of global annual turnover (whichever is higher). |
| Operational status | Effective; full enforcement aligned to Executive Regulations and grace periods. | Fully operational since 2018 with established enforcement. |
Tip: If you’re already GDPR-compliant, you’ve covered much of the groundwork—still review consent design, transfer mechanics, and any DIFC/ADGM interactions for PDPL-specific alignment.
Existing GDPR controls may support PDPL work, but there is no basis for a single readiness percentage . Review the UAE requirements separately.
Whether you’re a UAE entity, a Turkish SaaS vendor, or an international data controller, a practical PDPL readiness plan should include:
Organizations serving the UAE market should identify the applicable data protection regime and document their compliance responsibilities.
Clients may ask cross-border providers for evidence of PDPL compliance. Confirm the applicable duties and contract terms.
Review the applicable requirements, identify gaps in contracts and procedures, and assign responsibility for staff training. Check implementing rules before relying on a particular deadline.
