UAE Personal Data Protection Law (PDPL)

Why does it matter?

The PDPL matters because it ties the UAE market to a single federal standard, and its reach does not stop at the border. Article 2 applies to a controller or processor outside the UAE that processes the data of people in the UAE, so a foreign business serving UAE customers is in scope. The law fixes duties now and delegates timing and penalties: breach reporting periods, the data-volume criteria for the DPO duty and the penalty schedule sit in Executive Regulations and a Cabinet decision under Articles 9, 10, 26 and 28, so a program built on the Act's articles stays ready for them.

Key benefits include:

• Defined processing grounds

Article 4 forbids processing without the owner's consent except for listed cases, including public interest, legal claims, contract performance and the data subject's interests.

• Provable consent

Article 6 requires the controller to prove consent, in clear, simple and accessible form, with an easy way to withdraw at any time.

• A record and a processor contract

Article 7 requires a record of personal data and a processor with sufficient guarantees; Article 8 requires processors to keep their own record.

• Breach reporting to the Data Office

Article 9 requires the controller to report a breach that affects privacy, confidentiality or security, with nature, causes, impact and measures, and to inform the data subject.

• Data subject rights

Articles 13 to 18 give information, portability, correction and erasure, restriction, stopping processing and objection to automated decisions.

How does it work?

Article 5 sets the processing controls: fair, transparent and lawful processing for a specific and clear purpose, data limited to what is necessary, accuracy with correction or erasure measures, secure storage, and no retention after the purpose ends unless the data subject is anonymized. Article 7 adds technical and organizational measures from the design stage and by default, so that only the specified purpose is processed. Article 20 lists security measures that may include encryption, pseudonymization, ongoing confidentiality, integrity and resilience, restoration after an incident and regular testing, scaled to the risk.

The data protection officer duty in Article 10 applies when processing creates a high risk through new technologies or data volume, involves systematic and comprehensive evaluation of sensitive data including profiling and automated processing, or covers a large volume of sensitive data. Article 11 gives the officer the tasks of verifying procedures, handling requests and complaints, advising on assessments and acting as the link to the Data Office, and Article 12 protects the officer's independence. Article 21 requires a data protection assessment before processing that uses new technologies with high risk, evaluates people systematically or covers large volumes of sensitive data.

Article 22 allows transfers abroad to a State or territory approved by the Data Office as having adequate protection legislation or party to relevant agreements. Where there is no adequate protection, Article 23 allows transfers under a contract that binds the recipient to the law's measures, with the data subject's explicit consent, or where necessary for legal claims, a contract, international judicial cooperation or the public interest. Complaints go to the Data Office (Article 24), and a decision may be contested by a written grievance to its Director General within 30 days (Article 25).

Key Elements

• Sensitive personal data (Article 1)

Data revealing family, racial or ethnic origin, political or philosophical views, religious beliefs, criminal record, biometric data or health information, including health care services that reveal a health condition.

• Processing without consent (Article 4)

Listed cases such as public interest, legal claims, public health, a contract with the data subject and obligations under other UAE laws.

• Record of personal data (Articles 7 and 8)

Controller and processor each keep a record covering categories, authorized persons, processing periods, purpose, cross-border movement and security measures, available to the Data Office on request.

• Data subject rights (Articles 13 to 18)

Free information on request, portability for consent- or contract-based automated processing, correction and erasure, restriction, stopping direct marketing, and human review of automated decisions.

• Data protection assessment (Article 21)

Description of processing, necessity and proportionality, risks and mitigation, coordinated with the data protection officer and reviewed periodically.

• Cross-border transfer (Articles 22 and 23)

Adequacy approved by the Data Office, or a contract, explicit consent or a listed necessity.

What does it cover?

The PDPL applies to processing of personal data, in whole or part by automated electronic means or otherwise, by any data subject resident or working in the UAE, by any controller or processor in the UAE processing the data of people in or outside the UAE, and by any controller or processor outside the UAE processing the data of people in the UAE (Article 2). It does not apply to government data and government controllers or processors, security and judicial data, a person processing their own data for personal purposes, health data and banking and credit data that have their own legislation, or free-zone companies with their own data protection legislation. Article 3 lets the Data Office exempt establishments that do not process a large volume of data.

What are its objectives?

The official portal describes the law as an integrated framework that protects the confidentiality of information and the privacy of individuals and defines the rights and duties of all parties.

Prohibit processing without consent unless a listed case in Article 4 applies.

Fix principles of fairness, purpose limitation, accuracy, security and retention limits in Article 5.

Give data subjects rights of information, portability, correction, erasure, restriction and objection.

Require records, assessments, a data protection officer in defined cases and breach reporting to the Data Office.

Control transfers abroad through adequacy or specified safeguards.

Framework in Context

The PDPL sits among other UAE data rules that the official portal lists: the Consumer Protection Law (Federal Law No. 15 of 2020), the health ICT law (Federal Law No. 2 of 2019), the cybercrimes law (Federal Decree-Law No. 34 of 2021), the credit information law (Federal Law No. 6 of 2010) and the DIFC Data Protection Law (DIFC Law No. 5 of 2020). The UAE Data Office, created by Federal Decree-Law No. 44 of 2021 and affiliated with the Cabinet, is to propose policies, approve monitoring standards, handle complaints and issue guidelines. Organizations treat the PDPL as the base layer and add the free-zone and sector regimes that apply to them.

Common Framework Mappings

Organizations map the UAE PDPL to international privacy and security frameworks so that one set of records, rights procedures and security controls serves every market they operate in.

Mapped frameworks include:

APEC PF

CCPA/CPRA

GDPR

ISO 27001:2022

ISO 27701

NIST Privacy Framework v1.0

OECD Privacy Guidelines

Saudi Personal Data Protection Law (PDPL)