Key takeaways
- Most of the UAE PDPL compliance checklist already applies, because Federal Decree-Law No. 45 of 2021 has been in force since 2 January 2022; its executive regulations are still awaited.
- It applies to any entity processing UAE residents' personal data, but DIFC and ADGM companies follow their own regimes.
- The law already requires breach notification and answers to data subject requests; the regulations will fix the exact timeframes.
Why waiting is a risk
The executive regulations will add deadlines and penalties, but the obligations below are already in the law. Personal data means any information that identifies a living individual: names, emails, phone numbers, identification, location data.
If you hold any of it, the law already applies, and what matters is whether you can show that you comply.
Which businesses the PDPL applies to
It applies to any entity that processes the personal data of UAE residents, wherever it is incorporated, including overseas companies marketing into the UAE. That covers almost every operating business here, with one exception.
Mainland and most free zone companies
If you process resident data and you are not licensed in DIFC or ADGM, the federal PDPL governs you.
DIFC and ADGM companies
The two financial free zones run their own frameworks, the DIFC Data Protection Law and the ADGM Data Protection Regulations, and companies there comply with their own centre's regime.
You hold data the law reaches if you have any of these:
- Lead capture. A website form that takes a name and email.
- Customer database. A CRM holding client and prospect records.
- HR and employees. Payroll, passports, and visa files on staff.
- Cross-border. An overseas firm marketing to UAE residents.
UAE PDPL compliance checklist
Businesses rarely refuse to meet these. More often nobody has mapped which ones apply, so the gaps stay hidden until a request, a partner or the regulator raises them.
A lawful basis for every record
Each use of personal data must rest on a basis the law recognises.
Where firms get caught: collecting data first and finding a basis later.A privacy notice that says enough
Individuals must be told how their data is used at the point you collect it.
Where firms get caught: a generic policy copied from another jurisdiction, which counterparties often check first.Handling data subject rights
Residents can ask to access, correct, or delete their data, and you must respond within a timeframe the regulations will set.
Where firms get caught: a policy on paper, but no process that can find and act on the record.Discipline on cross-border transfers
Data may leave the UAE only where the law allows it.
Where firms get caught: cloud tools exporting data in ways the contracts do not yet cover.Breach reporting on time
Significant breaches must be reported to the UAE Data Office, and in defined cases to the people affected.
Where firms get caught: the clock starts when the breach happens, before you have decided how to respond.Penalties are provided for, but a lost deal is often the sooner cost.
The law provides for administrative penalties, to be set by Cabinet decision, for unlawful processing, weak security, or ignoring a rights request.
Banks, enterprise clients and overseas partners increasingly ask to see a privacy notice and a data process before they transact, and a weak answer can cost the deal. This work sits alongside your AML obligations.
