Skip to content
Emergency helpGet started
Compliance & Governance

What is the UAE Personal Data Protection Law (PDPL)?

The UAE PDPL, Federal Decree-Law No. 45 of 2021, has applied since 2 January 2022. Scope, exclusions, obligations, breach reporting and penalties.
By VigilbasePublished
Read the guideMore Topics

The UAE Personal Data Protection Law (PDPL) is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. It was issued on 20 September 2021 and came into force on 2 January 2022. It applies to the processing of personal data of data subjects in the UAE, by controllers and processors in the UAE and by those outside the UAE who process personal data of data subjects inside it. It sets rules for consent and processing, data subject rights, security, breach notification, and cross-border transfers, and it excludes government data, health and banking data covered by their own legislation, and free zones with their own data-protection laws.

Who issued the UAE PDPL and who supervises it?

The law is a federal decree-law issued on 20 September 2021, and Article 31 brought it into force on 2 January 2022. It assigns supervision to the UAE Data Office established under Federal Decree-Law No. 44 of 2021. The UAE Government portal describes the UAE Data Office as the federal data regulator, affiliated with the UAE Cabinet.

Who does the PDPL apply to, and what is excluded?

The law applies to data subjects residing in the UAE, to controllers and processors in the UAE, and to controllers and processors outside the UAE that process personal data of data subjects inside it. Article 2 excludes the following.
1.Government data, and government entities that control or process personal data.
2.Personal data held by the security and judicial authorities.
3.A data subject processing their own data for personal purposes.
4.Personal health data that has its own legislation regulating its protection and processing.
5.Personal banking and credit data that has its own legislation regulating its protection and processing.
6.Companies and establishments in free zones that have their own personal data protection legislation.

What are the main PDPL obligations?

In outline, controllers and processors must:
1.Process personal data only with the data subject's consent, unless one of the law's exceptions applies, and follow the law's processing controls and consent conditions.
2.Keep a record of personal data processing and provide it to the Data Office on request.
3.Apply technical and organizational measures that give a level of security appropriate to the risk, in line with international best practice, which can include encryption, pseudonymization, resilience, timely restoration after an incident, and regular testing of those measures.
4.Appoint a data protection officer where processing carries a high risk to privacy because of new technologies or data volume, involves systematic and comprehensive evaluation of sensitive personal data, or covers a large volume of sensitive personal data.
5.Assess the impact before processing that uses new technologies likely to pose a high risk to privacy, including automated profiling with legal effects and large-scale processing of sensitive data.
6.Transfer personal data outside the UAE only to countries with an adequate level of protection, or under the conditions the law sets where there is none.

What rights do data subjects have?

Data subjects have the right to information about the processing of their data, to data portability, to correction and erasure, to restriction of processing, to stop processing, and to object to decisions based on automated processing.

How must personal data breaches be reported?

Under Article 9, a controller that becomes aware of a breach that would prejudice the privacy, confidentiality, and security of a data subject's personal data must notify the Data Office of the breach and the results of its investigation, within the period and under the procedures set by the executive regulations. The notification covers the nature and causes of the breach, its likely effects, the measures taken, and its documentation. The controller must also notify the data subjects whose privacy, confidentiality, or security the breach would prejudice, and a processor that becomes aware of a breach must notify the controller immediately.

What are the penalties under the UAE PDPL?

The law does not set fine amounts. Article 26 delegates them: the Council of Ministers, on a proposal from the Data Office, issues a decision defining the violations and the administrative penalties. Article 28 called for executive regulations within six months, and Article 29 gives controllers and processors up to six months from their issue to comply. Check the UAE Data Office and the UAE legislation portal for the current status of the executive regulations and the penalties decision.

Where does Vigilbase help with PDPL evidence?

Breach reporting under Article 9 needs the nature, causes, effects, and handling of an incident, documented. Vigilbase OS connects the security tools you already pay for and keeps their logs and events auditable and queryable in one place, and each investigation records the evidence, action, and verification result, which helps you assemble that record. Managed Cloudflare operates WAF and DDoS controls in scope as part of your security measures. Security logs can contain personal data, so include any security provider that receives them in your PDPL assessment, including where data is stored, and bring those requirements to scoping.

About this guide

This guide summarizes Federal Decree-Law No. 45 of 2021 as published on the UAE Government and legislation portals, as available in October 2026. It is not legal advice. The free zones, health data, and banking data excluded from the PDPL have their own rules; confirm with your legal counsel which regime applies.

Key Takeaways

✓The UAE PDPL is Federal Decree-Law No. 45 of 2021, in force since 2 January 2022.
✓It reaches controllers outside the UAE that process personal data of data subjects in the UAE.
✓Government data, health and banking data with their own legislation, and free zones with their own data-protection laws are excluded.
✓Breach notification timing and penalties are set by executive regulations and a Cabinet decision, not in the law itself.

Sources

Related Solutions

Vigilbase services related to this guide

Managed SOC

Learn more

Managed Cloudflare

Learn more

Get started with Vigilbase OS

Learn more

Managed cybersecurity in the UAE

Learn more

Frequently Asked Questions

When did the UAE PDPL come into force?

On 2 January 2022. Federal Decree-Law No. 45 of 2021 was issued on 20 September 2021.

Does the UAE PDPL apply to DIFC and ADGM companies?

The PDPL excludes companies and establishments in free zones that have their own personal data protection legislation. DIFC and ADGM have their own data-protection laws, so check which regime applies to your entity.Regional service and onboarding guidance

What are the fines under the UAE PDPL?

The law does not set them. Article 26 leaves the violations and administrative penalties to a Council of Ministers decision, proposed by the UAE Data Office.

Do we have to report data breaches under the UAE PDPL?

Yes. A controller must notify the UAE Data Office of a breach that would prejudice the privacy, confidentiality, and security of personal data, with the results of its investigation, within the period set by the executive regulations, and notify the affected data subjects.Security operations responsibilitiesWhat a SIEM does

Does the UAE PDPL apply to health and banking data?

Not where that data has its own legislation regulating its protection and processing. Abu Dhabi health information, for example, is also covered by the Department of Health's ADHICS standard.

Related Topics

Compliance & Governance

Saudi PDPL

Compliance & Governance

ADHICS

Compliance & Governance

UAE IA Standard

Compliance & Governance

CBUAE cyber security and outsourcing

Get Started

Ready to Improve Your Security?

Our team can help you implement the security measures discussed in this guide. Get expert guidance tailored to your organization.
Get started Continue Learning