The UAE Personal Data Protection Law,
what it asks and what is still pending.

The UAE Personal Data Protection Law (PDPL) is Federal Decree by Law No. 45 of 2021 Concerning the Protection of Personal Data. It is the UAE's first general federal data protection law, and it borrows much of its structure from the GDPR: controllers and processors, processing principles, data subject rights, impact assessments, a data protection officer and transfer rules. The regulator it refers to as "the Bureau" is the UAE Data Office, set up by Federal Decree-Law No. 44 of 2021.

Personal data means any data relating to an identified or identifiable natural person. Sensitive personal data covers data revealing family, ethnic origin, political or philosophical opinions, religious beliefs, criminal record, biometric data, and health, genetic or sexual information.

The PDPL starts from a prohibition: personal data may not be processed without the data subject's consent (Article 4), unless an exception applies. The exceptions include performing a contract with the data subject, complying with other UAE laws, employment and social security obligations, legal claims, public interest, public health, preventive and occupational medicine, archiving and research, protecting the data subject's interests, and data the data subject has made public. Unlike the GDPR there is no general "legitimate interests" basis.

Where you rely on consent, Article 6 requires that you can prove it, that it is clear, simple, unambiguous and easily accessible, and that the data subject can withdraw it easily at any time. Article 5 adds the familiar principles: fairness and transparency, purpose limitation, data minimisation, accuracy, security and storage limitation.

Article 10 requires controllers and processors to appoint a DPO with sufficient skills and knowledge where processing would cause a high level of risk because of new technologies or the volume of data, involves a systematic and comprehensive assessment of sensitive personal data including profiling and automated processing, or involves a large volume of sensitive personal data. The DPO may be an employee or an appointed provider, and may be inside or outside the UAE. You must notify the Data Office of the DPO's contact details. The Executive Regulations are meant to define the technologies and volume criteria. Our DPO guide covers the role in more depth.

Under Article 9, once a controller becomes aware of a breach that would prejudice the privacy, confidentiality and security of personal data, it must notify the Data Office, and must notify affected data subjects where the breach would prejudice their privacy, in both cases within the period and following the procedure set by the Executive Regulations. A processor must tell the controller as soon as it becomes aware. The notice to the Data Office must describe the breach, its causes and approximate number of records, give the DPO's details, set out the likely effects and the corrective measures, and attach supporting documents. Until a deadline is published, build a process that can report within days, not weeks.

Article 22 allows transfers to a country with data protection legislation covering the key protections and a regulator able to act, or to a country the UAE has a data protection agreement with, in cases approved by the Data Office. Where that level of protection is not available, Article 23 allows transfers under a contract that binds the recipient to the PDPL's requirements, with the data subject's explicit consent (if it does not conflict with UAE public or security interests), to perform a contract with or in the interest of the data subject, for legal claims, for international judicial cooperation, or to protect the public interest. The Executive Regulations are to set the detailed conditions. In practice, map every vendor that receives UAE personal data, record its country, and put a transfer clause in the contract; see standard contractual clauses and vendor risk management.

• Records of processing (Articles 7 and 8): controllers and processors each keep a record covering the parties, categories of data, who has access, retention, cross-border movement and security measures, and give it to the Data Office on request.
• Data protection impact assessment (Article 21): before processing that uses new technologies posing a high risk, including systematic profiling with legal or serious effects and large volumes of sensitive data. Our DPIA guide walks through the method.
• Security (Article 20): measures suited to the risk, in line with international best practice, including encryption and pseudonymisation, resilience, timely restoration and regular testing.
• Processors (Article 8): act only on the controller's documented instructions, delete data at the end of the processing period, and be able to prove compliance.