Legislation / ActMiddle East · United Arab Emirates

UAE Personal Data Protection Law (UAE PDPL)

The UAE's federal personal data protection law.

Request an Assessment

Verify current status

As of 2026 the federal Executive Regulations had not been published; enforcement detail and deadlines remain uncertain — confirm with UAE counsel. Free zones (DIFC, ADGM) have their own regimes.

Classification

Legislation / Act

Issuing authority

UAE (Federal Decree-Law No. 45 of 2021); UAE Data Office

Jurisdiction

Middle East · United Arab Emirates · Sector: All

Status / edition

In force; federal Executive Regulations still pending

Key dates

Federal Decree-Law No. 45 of 2021; in force since 2 January 2022

Mandatory or voluntary

Conditional

Who it applies to

Processing of personal data of UAE data subjects (with exemptions; sector and free-zone regimes such as DIFC/ADGM may also apply).

Purpose

The UAE's federal personal data protection law.

Major requirements / obligations

  • Lawful processing and consent
  • Data subject rights
  • Controller/processor duties
  • Cross-border transfer rules

Control domains

PrivacyGovernance

Official reference

https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws ↗

Last reviewed

2026-10-18 (source verification date)

This library provides general information for orientation only. It is not legal advice, a determination of applicability, or a substitute for formal certification or professional counsel. Verify current legal status, editions and dates against the official source before relying on any entry. Inclusion of a jurisdiction or instrument here is informational and does not imply that Srida IT provides regulated services, holds local authorisation, or has a presence in that jurisdiction.