Last updated: June 2026
The UAE PDPL, short for Personal Data Protection Law, has been in force since January 2022, and it covers almost every business that handles people's personal data in the country. It is set out in Federal Decree-Law No. 45 of 2021. If you collect customer details, run a website that captures leads, or keep staff records, this law applies to you. This guide gives you a plain-English checklist, explains who is covered, clears up the confusion about fines and deadlines in 2026, and tells you when you really need a Data Protection Officer.
We help UAE businesses build the security and processes that data rules expect, so we deal with PDPL questions every week. Here is the honest picture, written so you do not need a law degree to follow it.
What is the UAE PDPL, in plain English?
The PDPL is the UAE's first federal law on how businesses handle personal data. It sets the rules for collecting, using, storing, sharing, and deleting any information that can identify a person, from a name and phone number to a photo or an online ID. It became law on 2 January 2022, and it applies across the whole country, except for a few areas covered by their own rules.
The law borrows many ideas from Europe's well-known GDPR, but it is not a copy. The most important difference is that the PDPL is built around consent. Under some other laws, a business can rely on a general "legitimate interest" to process data. The PDPL does not offer that broad option, so getting and proving consent matters more here. If your plan was to reuse a GDPR policy and call it done, that plan has gaps.
Does the PDPL apply to your business?
It applies to almost every business that handles personal data in the UAE, and even to some companies based abroad. You are covered if you are a controller, meaning you decide why and how data is used, or a processor, meaning you handle data for someone else, and you are based in the UAE. You are also covered if you sit outside the UAE but process the data of people inside it. So a foreign online store selling to UAE shoppers is caught by the law.
A few areas sit outside the PDPL because they have their own rules:
- Government data and the bodies that handle it.
- Health data covered by the UAE's health data law.
- Banking and credit data covered by financial rules.
- DIFC and ADGM companies, which follow their own data laws.
Real talk: there is no free pass for small businesses. A two-person startup with a customer list is covered the same way a large company is. Size does not remove the duty; it only changes how much data you hold.
PDPL, DIFC, or ADGM: which law applies to you?
The law you follow depends on where your company is licensed, and getting this wrong is the most common mistake we see. Here is the simple decision guide.
- Mainland UAE or a standard free zone (DMCC, JAFZA, IFZA, Dubai Internet City, and most others): you follow the federal PDPL.
- DIFC: you follow the DIFC Data Protection Law No. 5 of 2020, with its own regulator.
- ADGM: you follow the ADGM Data Protection Regulations 2021, with its own regulator.
- Selling to EU customers as well: you may also need to follow Europe's GDPR on top of your UAE law.
One thing that surprises people: moving personal data between these zones can count as a cross-border transfer. So a mainland company sharing data with a DIFC partner cannot assume one policy covers both sides. Check which law each part of your group sits under before you build a single privacy policy for everyone.
The big 2026 question: are the rules and fines final yet?
No, and this is the part most articles get wrong. The PDPL is binding law, but its detailed rulebook, called the Executive Regulations, has not been published as of mid-2026. That rulebook is meant to fix the exact details, such as the precise breach reporting deadline, the thresholds for needing a Data Protection Officer, and the fine amounts. Until it is out, those specific details are not final.
This leads to two honest points you should know.
First, be careful with fine figures you see online. The PDPL does not set fine amounts itself. A separate Cabinet decision will list the penalties, and that decision is still pending. So any exact dirham fine you see quoted for the federal PDPL is unofficial guesswork. The fines that are official and real are in the free zones: DIFC fines run from USD 25,000 to USD 100,000 per breach, plus an uncapped fine for serious cases, and ADGM fines can reach USD 28 million.
Second, enforcement is coming, not absent. In June 2026, the UAE created the Federal Authority for Artificial Intelligence and Data, which brought the data regulator into a single, stronger body. This is the authority expected to publish the Executive Regulations and start real enforcement. When the rulebook lands, businesses get six months to get in line, with a possible six-month extension. That window sounds comfortable, but proper compliance work takes longer than people expect.
Pro tip: treat the current quiet period as a gift, not an excuse. The businesses that prepare now will simply confirm they are ready. The ones that wait will be rushing against a six-month clock while also trying to win deals from buyers who already ask how you handle data.
Your PDPL compliance checklist
Here is the practical, step-by-step checklist to get your business in line with the PDPL. Work through it in order, because each step builds on the one before.
- Map your data first. List what personal data you collect, where it is stored, why you have it, who can access it, how long you keep it, and where it goes, including any transfers abroad. You cannot protect what you have not mapped.
- Fix consent and privacy notices. Make sure you collect data with clear, specific consent where required, and that your privacy notice tells people what you do with their data in plain language. Remove pre-ticked boxes and vague terms.
- Write your record of processing. Both controllers and processors must keep a detailed record of their data activities. The regulator can ask to see it. Your data map from step one feeds straight into this.
- Tighten your security. The law requires appropriate technical and organisational measures, which can include encryption, controlled access, and the ability to recover data after an incident. This is where an ISO 27001 approach pays off.
- Set up a rights process. Give people a simple way to access, correct, delete, or object to the use of their data, and build an internal process to answer those requests properly.
- Plan for breaches. Have a written plan to spot a breach, report it to the regulator quickly, and tell affected people when their data is at risk.
- Run a DPIA for risky projects. Before any high-risk processing, run a Data Protection Impact Assessment to find and reduce the privacy risks.
- Check cross-border transfers. If you send data abroad, make sure you have a legal basis, usually a compliant contract or clear consent.
- Decide if you need a DPO. Work through the triggers in the next section.
Most businesses find that steps one and two reveal problems they did not know they had, like old data nobody owns or consent that was never properly collected.
When does your business actually need a DPO?
You need a Data Protection Officer if your data work is high risk, but the exact thresholds are still being defined. The PDPL says you must appoint a DPO in three cases: when your processing creates a high risk because of new technology or large data volumes, when you systematically assess sensitive data including profiling, or when you handle a large amount of sensitive data. Sensitive data means things like health, religion, race, and biometric records.
The honest catch is that the words "large amount" and "high risk" are not yet defined in numbers. The Executive Regulations will set those thresholds, and they are not published. So for now, whether a specific medium-sized business must appoint a DPO is a judgement call.
The practical answer: if you process sensitive data at any real scale, profile people, or run new high-risk technology, plan to have a DPO. The good news for smaller companies is that the PDPL lets the DPO be an outside person or firm, and that person can even be based outside the UAE. So you can get a qualified, fractional DPO and a named contact for the regulator without paying for a full-time senior hire.
What to do about a data breach
Under the federal PDPL, you must report a serious breach to the Data Office immediately once you become aware of it. The law uses the word "immediately" rather than a fixed number of hours, because the exact deadline is left to the Executive Regulations that are not yet published. So there is no fixed 72-hour rule in the federal PDPL, even though you may read that elsewhere. ADGM does use a 72-hour rule, and DIFC uses "as soon as practicable", so your exact duty depends on your zone.
Two things are clear no matter what. If you are a processor handling data for someone else, you must tell that client immediately when you spot a breach, so they can report it. And you must tell affected people when a breach puts their data at risk. The smart move is to assume a tight deadline is coming and build a breach plan that can move within a day, not a week.
Sending personal data outside the UAE
You can send UAE personal data abroad, but you need a proper legal basis. The PDPL allows transfers to countries the Data Office considers to have strong enough data protection, or otherwise through PDPL-compliant contract clauses or the clear consent of the person. The Data Office has not yet published a list of approved countries, so in practice most businesses today rely on contracts or consent.
For most companies, this comes up with cloud services. If you use a major cloud provider, you can often choose a UAE data region and sign standard contract terms that support a compliant transfer. Either way, write down your legal basis for each transfer. "We use a US cloud service" is not a plan; a documented contract or consent record is.
Common PDPL mistakes to avoid
A few mistakes come up again and again, and all of them are easy to fix once you know them.
- Copying a GDPR policy word for word. The PDPL is consent-first and has no general legitimate interests basis, so a straight GDPR copy leaves gaps in how you justify processing.
- Assuming the federal PDPL applies when you are in DIFC or ADGM. Check your licence zone first, because the wrong law means the wrong policy, the wrong regulator, and a missed registration.
- Quoting scary fine figures as fact. The federal fine schedule is not published yet, so building your case for compliance on an invented dirham number can backfire when staff realise it is not official. Use the real reasons: legal duty, customer trust, and lost deals.
- Treating consent as a one-time checkbox. People can withdraw consent at any time, so you need a way to record it, prove it, and let them change their mind.
- Forgetting your own staff. Personal data is not just customer data. Employee records, CVs, and payroll all count, and they are often the least protected files in the business.
Real client stories
These are real situations from our compliance work. Names and a few details have been changed for privacy.
Aisha's e-commerce brand (mainland, Emirati founder). Aisha had been buying email lists to grow fast. We showed her that bought lists fail the PDPL consent test and that recipients can demand she stop. We helped her switch to a clean opt-in list. "I thought a bigger list was always better," she says. "Now I know an opt-in list of 2,000 is safer and sells more than 20,000 bought contacts."
Tom's SaaS startup (DIFC, British founder). Tom assumed the federal PDPL applied to him and built his policy around it. Because his company is in DIFC, he actually had to follow the DIFC law, register with the DIFC Commissioner, and pay the annual fee. "I was compliant with the wrong law," he says. "Check your zone before you write a single policy."
Priya's clinic group (mainland, Indian operations lead). Priya's team processed a large amount of health and patient data and had no DPO and no breach plan. We set them up with an outsourced DPO and a simple breach response process. "Hiring a full-time data officer felt impossible on our budget," she says. "A fractional DPO gave us the expertise without the salary."
How SKIMBOX helps with PDPL compliance
We help UAE businesses build the security and processes the PDPL expects, from data mapping and consent fixes to breach plans and an outsourced DPO. Because much of the law is about protecting data properly, an ISO 27001 approach gives you a strong, provable security foundation, and regular penetration testing shows your defences actually work. If you handle financial or health data, our CBUAE fintech compliance guide and healthcare and DHA compliance guide cover the extra sector rules.
If you want a straight assessment of where your business stands, see our cybersecurity services, or contact us.
References
[1] The UAE Government Portal - Data protection laws and Federal Decree-Law No. 45 of 2021 overview. u.ae [2] UAE Legislation Portal - Full text of Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. uaelegislation.gov.ae [3] UAE Data Office - Federal Decree-Law No. 44 of 2021 establishing the regulator, and PDPL guidance. The Office was consolidated into the Federal Authority for Artificial Intelligence and Data in June 2026. u.ae [4] U.S. Department of Commerce, International Trade Administration - UAE cross-border data flows and PDPL enforcement status. trade.gov [5] DIFC - Data Protection Law No. 5 of 2020, registration, fees, and breach rules. difc.com [6] ADGM Office of Data Protection - Data Protection Regulations 2021, fees, breach timeline, and penalties. adgm.com [7] SKIMBOX - Internal experience helping UAE businesses build PDPL-ready security, data mapping, breach response, and outsourced DPO support, 2026. skimbox.co
