| name | uae-pdp-law |
| title | UAE Personal Data Protection Law Compliance |
| description | Implements compliance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDP Law) and its Executive Regulations. Covers data controller and processor obligations, data subject rights, cross-border transfer requirements, sensitive data processing, and UAE Data Office enforcement. Keywords: UAE PDP, Federal Decree-Law 45, UAE Data Office, DIFC, ADGM, cross-border transfer. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/plugins/privacy-skills-complete/skills/uae-pdp-law |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | ae |
| practice | data-protection |
| language | en |
UAE Personal Data Protection Law Compliance
Overview
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDP Law) was issued on 20 September 2021 and entered into force on 2 January 2022, with a compliance grace period. The Executive Regulations were issued by Cabinet Decision No. 111 of 2023, published in the Official Gazette on 23 October 2023, and companies were given until 1 January 2025 to achieve compliance. The UAE Data Office (established under the law) is the supervisory authority responsible for enforcement.
The UAE PDP Law is the first comprehensive federal data protection law in the UAE. It is important to note that the UAE also has separate data protection regimes in the financial free zones: the Dubai International Financial Centre (DIFC) Data Protection Law No. 5 of 2020 and the Abu Dhabi Global Market (ADGM) Data Protection Regulations 2021. These free zone laws operate independently of the federal law.
Key Definitions
| UAE PDP Law Term | GDPR Equivalent | Definition |
|---|
| Personal Data | Personal data | Any data related to an identified or identifiable natural person (Article 1) |
| Sensitive Personal Data | Special category data | Data revealing racial or ethnic origin, political opinion, religious beliefs, criminal records, biometric data, health data, genetic data (Article 1) |
| Controller | Controller | Any person who determines the purposes and means of personal data processing (Article 1) |
| Processor | Processor | Any person who processes personal data on behalf of the controller (Article 1) |
| Data Subject | Data subject | The natural person to whom personal data relates (Article 1) |
Lawful Bases for Processing (Article 5)
The controller may process personal data only where:
- Consent of the data subject — must be clear, specific, informed, unambiguous, easy to withdraw
- Necessary for performance or initiation of a contract with the data subject
- Necessary for compliance with legal obligations of the controller
- Necessary to protect the vital interests of the data subject or another person
- Processing concerns data made public by the data subject
- Necessary for legal proceedings — establishment, exercise, or defence of legal claims
