UAE PDPL compliance is no longer a future project. The UAE’s federal data protection law, the PDPL (Federal Decree-Law No. 45 of 2021), has been in force since 2 January 2022 and applies to most businesses that handle personal data in the UAE, plus many abroad that handle data about people here. What is still missing is the detail: at the time of writing, the Executive Regulations and the Cabinet decision on penalties have not been published.
This guide turns the law into practical IT work for SMEs and mid-size businesses: what to change, what evidence to keep and a 90-day plan.
This article is general information, not legal advice. Speak to a qualified UAE lawyer about your own obligations.
Key takeaways
- The PDPL has applied since 2 January 2022. Once the Executive Regulations are issued, businesses get six months to comply, and the Cabinet can extend that (Article 29).
- It reaches businesses outside the UAE that process personal data of people in the UAE.
- DIFC and ADGM have their own data protection laws. Most other free zones, including DMCC, DSO and JAFZA, fall under the PDPL.
- There is no fixed PDPL breach deadline yet. The “72 hours” often quoted online is not in the law.
- The law already asks for appropriate security measures, processor contracts, records of processing and a way to report breaches. All of that is IT work you can start now.
What is the UAE PDPL, and is it in force?
The Personal Data Protection Law is Federal Decree-Law No. 45 of 2021. It was issued on 20 September 2021 and took effect on 2 January 2022, according to the official UAE Legislation portal, which lists it as active.
The law sets out principles and obligations, but it leaves a lot of operational detail to Executive Regulations: breach notification timing, the approved cross-border transfer mechanisms and the thresholds for appointing a Data Protection Officer. Fines are left to a separate Cabinet decision. Neither had been published at the time of writing.
Who regulates it?
The UAE Data Office was set up under Federal Decree-Law No. 44 of 2021 as the PDPL regulator. On 14 June 2026, the UAE announced the Artificial Intelligence and Data Authority, which reports directly to the Cabinet. According to the Emirates News Agency (WAM), it brings together the functions of the UAE Data Office, the Office of Artificial Intelligence, Digital Economy and Remote Work Applications, and the digital government sector of the Telecommunications and Digital Government Regulatory Authority (TDRA). How the new authority will supervise and enforce the PDPL has not yet been set out.
Does the PDPL apply to my business?
In most cases, yes. Article 2 covers controllers and processors based in the UAE, whether the people whose data they handle are inside or outside the country. It also reaches controllers and processors outside the UAE that process personal data of people in the UAE. A company with a head office in London or Glasgow and staff or customers in Dubai should assume it is in scope.
What about free zones?
Free zone companies are not automatically exempt. The exclusion only covers free zones with their own data protection legislation. In practice that means the DIFC (DIFC Data Protection Law No. 5 of 2020) and ADGM (Data Protection Regulations 2021), plus health data in Dubai Healthcare City. Most other free zones, such as DMCC, DSO and JAFZA, follow the PDPL.
What is excluded?
Government data and entities, security and judicial authorities, and purely personal use are excluded. Health and banking data are excluded only where their own legislation regulates them, so a clinic or finance firm is usually still under the PDPL for data such as employee records.
What does the PDPL ask of your IT and security setup?
The law describes outcomes, not products. Nobody can sell you “a PDPL firewall”. The table below turns each obligation into the IT work behind it and the evidence that shows it is working.
| PDPL obligation | What it means in IT terms | Evidence to keep |
|---|---|---|
| Security of processing (Art. 20): appropriate technical and organisational measures, with examples such as encryption and pseudonymisation | MFA, device and data encryption, network segmentation, a managed firewall, patching, tested backups, regular security testing | Configuration records, restore test results, test reports |
| Breach notification (Art. 9): tell the regulator, and affected people, about a breach that could harm their privacy or security; processors tell the controller | Logging and monitoring that can detect a breach; a written incident response plan | Log retention settings, incident plan, incident register |
| Processors: use processors that give sufficient guarantees, under a contract | Data processing agreements (DPAs) with cloud, managed service and SaaS providers | Signed DPAs and a supplier register |
| Records of processing | An inventory of systems, data types and where each is held | Data and system inventory |
| DPO and impact assessments for high-risk processing (Art. 10) | Spot high-risk processing: new technology, large volumes, sensitive data | Assessment notes; DPO decision |
| Cross-border transfers (Arts. 22–23) | Know which countries your data is stored in or accessed from | Data location map, supplier hosting regions |
Expect some detail to change once the Executive Regulations set security standards, DPO thresholds and transfer mechanisms. The evidence column is what you will show a client, auditor or regulator who asks.
A worked example: a 60-person trading company in JAFZA
Picture Microsoft 365, a cloud CRM hosted in Europe, an on-site file server, Teams for calls and an outsourced IT provider with remote access. That business would:
- list each system, the personal data in it and where it is hosted;
- get a signed data processing agreement from each provider, including the IT provider;
- record that CRM and email data leave the UAE, and the transfer basis relied on;
- enforce MFA on Microsoft 365, the CRM and the IT provider’s remote access;
- back up the file server with a copy ransomware can’t reach, and test a restore;
- write down who decides and who notifies if a laptop is lost or a mailbox is compromised.
None of this depends on the Executive Regulations.
Is there a 72-hour breach deadline?
Not under the PDPL, at least not yet. Article 9 requires notification but sets no fixed deadline; the timing is left to the Executive Regulations. The free zone regimes are different:
- ADGM expects notification to its Commissioner of Data Protection without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
- DIFC expects notification as soon as practicable in the circumstances.
Either way, be able to detect, assess and report a breach quickly: searchable logs, alerts that reach a person and a named decision-maker.
Do we have to keep data in the UAE?
Not as a general PDPL rule. The law controls cross-border transfers rather than banning them. Transfers are allowed to countries with adequate protection, or through safeguards such as contracts and consent; the approved mechanisms and any adequacy list are still pending.
There are important exceptions outside the PDPL. Under Federal Law No. 2 of 2019 on the use of ICT in health fields, health data generally must be stored and processed inside the UAE, with limited exceptions set by ministerial resolution. Some sector regulators, government contracts and licence terms may also require local hosting. Check your contracts and sector rules before you pick a cloud region.
Don’t forget phones, Teams and call recordings
Personal data isn’t only in your CRM and file shares. Call recordings, voicemail, meeting recordings and transcripts are personal data too. If your phone system or contact centre records calls, the PDPL applies to where those recordings are stored, who can access them, how long you keep them and which processors handle them.
Recording a call without consent can also be a criminal offence under UAE law, separate from the PDPL. Our guide to choosing a business phone system in the UAE covers recording consent and what to ask suppliers, and our comparison of cloud and on-premise contact centres covers where contact centre data can live.
What should an SME do first? A 90-day plan
You don’t need to wait for the Executive Regulations. Most of the work below is good security practice that the law already points to, and it lines up with the first 10 cyber security controls for Dubai businesses.
Days 1 to 30: know what you have – List systems, devices, cloud services and the personal data each holds. – Record where each service is hosted and who your processors are. – Enforce multi-factor authentication on email and every admin account.
Days 31 to 60: lock down and back up – Remove everyday admin rights and review who can access what. – Review firewall rules and separate guest, staff and device networks. – Test a restore from backup and write down how long it took. – Request data processing agreements from cloud, managed service and SaaS suppliers.
Days 61 to 90: prepare for the bad day – Write a one-page incident response plan: who decides, who notifies, who fixes. – Check logging captures enough to investigate an incident, and that logs are kept long enough. – Schedule regular security testing and keep the reports. – Decide whether any processing is high-risk and needs an impact assessment.
If a client or tender is also asking for a recognised certification, the same inventory, risk work and controls feed straight into ISO 27001.
Common mistakes
- Waiting for the regulations. The six-month window starts when they are issued. Building an inventory, signing DPAs and fixing access control takes longer than that in most firms.
- Forgetting the IT provider. Your managed service provider almost certainly processes personal data on your behalf and needs a contract that says so.
- Quoting fines, deadlines or decision numbers from blogs. If it can’t be traced to the UAE Legislation portal or the Official Gazette, don’t rely on it.
How Softworx Services helps
Softworx Services is a systems integrator and network services provider with a technology-led, vendor-agnostic approach, working with vendors including Palo Alto, Fortinet, Cisco and HP Aruba. From our Dubai office at Saaha Offices, Downtown Dubai, our Cyber & Compliance and Networks teams can review your network, firewall, access and backup setup against the security measures the PDPL points to, and help put the technical controls in place.
We don’t give legal advice, and no technology on its own makes a business “PDPL compliant”. That also takes your own policies, contracts and legal advice.
Frequently asked questions
Is the UAE PDPL in force?
Yes. Federal Decree-Law No. 45 of 2021 has been in force since 2 January 2022. Its Executive Regulations and the Cabinet decision on penalties had not been published at the time of writing.
Does the PDPL apply to companies outside the UAE?
Yes, if they process personal data of people in the UAE (Article 2). A foreign head office that handles UAE staff or customer data should assume it is in scope.
Are free zone companies exempt from the PDPL?
Only those in free zones with their own data protection law: DIFC and ADGM, plus DHCC for health data. Most free zones, including DMCC, DSO and JAFZA, fall under the PDPL.
What is the PDPL breach notification deadline?
There is no fixed deadline yet; it is left to the Executive Regulations. Notify the regulator and affected people when a breach could harm their privacy or security, and have a plan that lets you do that quickly.
Do we need to host our data in the UAE?
Not as a general PDPL rule. Health data generally must stay in the UAE under the health ICT law, and some sector rules and contracts require local hosting.
Do we need a Data Protection Officer?
The PDPL requires one for certain high-risk processing, such as large volumes of sensitive data or new technologies (Article 10). The exact thresholds are still to be set.
Talk to Softworx Services in Dubai
Not sure where your network, cloud or phone setup stands against the PDPL? Talk to the Softworx Services team in Dubai for a vendor-agnostic review of your technical controls.
Sources
- Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, UAE Legislation portal: https://uaelegislation.gov.ae/en/legislations/1972
- PDPL full text (download), UAE Legislation portal: https://uaelegislation.gov.ae/en/legislations/1972/download
- “Mohammed bin Rashid approves establishing Artificial Intelligence and Data Authority”, WAM, 14 June 2026: https://www.wam.ae/en/article/c0pz7ku-mohammed-bin-rashid-approves-establishing
- Dubai Media Office announcement, 14 June 2026: https://mediaoffice.ae/en/news/2026/june/14-06/mohammed-bin-rashid-approves-establishing-artificial-intelligence-and-data-authority
- ADGM Office of Data Protection, personal data breach notifications: https://www.adgm.com/operating-in-adgm/office-of-data-protection/data-breach-notifications
- DIFC Data Protection Law No. 5 of 2020: https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws–regulations/data-protection-law.pdf
- Federal Law No. 2 of 2019 on the use of ICT in health fields, UAE Legislation portal: https://uaelegislation.gov.ae/en/legislations/1209/download
- Chambers Data Protection & Privacy 2026, UAE trends and developments: https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/uae/trends-and-developments/