UAE · Regulation guide
UAE Personal Data Protection Law (PDPL)
Issued by UAE federal government
Applies to: Organisations processing personal data in the UAE, outside free zones such as DIFC and ADGM that have their own data protection laws, and subject to sector-specific rules for areas like health and banking.
The UAE’s federal Personal Data Protection Law sets principles for lawful, fair and transparent processing, data subject rights, security, breach notification and cross-border transfers. Its implementing detail continues to develop.
Organisations operating in more than one regime, for example onshore and in DIFC or ADGM, need a single privacy programme that maps to each set of rules.
General guidance, not legal advice. Always confirm scope and current requirements with the issuing authority.
Discuss UAE PDPL with us
Gap assessment, control mapping or evidence tracking.
How we help
- ✓Applicability review across onshore and free-zone regimes
- ✓Data inventory and records of processing
- ✓Privacy notices, consent and processor contracts
- ✓Breach and data subject request workflows
Related ISO standards
UAE PDPL questions
Is this legal advice?+
No. This is a general overview. Confirm scope, the current edition and your obligations with the issuing authority and your legal or compliance advisers.
Next step
Where does your programme stand?
The GRC maturity check takes three minutes and shows which areas to fix first.