🇦🇪United Arab Emirates

The UAE federal privacy framework is built around consent, controller accountability and cross-border governance

The United Arab Emirates' federal data protection framework is anchored by Federal Decree by Law No. 45 of 2021 Concerning the Protection of Personal Data, commonly referred to as the UAE PDPL. It regulates the processing of personal data and creates obligations for controllers, processors and data protection officers, while giving data subjects rights over information, portability, correction, erasure, restriction, objection and automated decision-making.

The federal PDPL is not the only privacy framework in the UAE. The law itself excludes certain categories, including government data, government entities, personal data held by security and judicial authorities, personal health data and banking or credit data where separate legislation regulates protection and processing, and free zone companies where special data protection legislation applies. This means UAE privacy compliance often requires checking both the federal PDPL and any sector or free-zone framework that applies.

The three ideas to understand first

The UAE Data Office is the central authority under the PDPL. The law refers to the UAE Data Bureau established under Federal Decree by Law No. 44 of 2021. The Office receives breach notifications and complaints, may require information through judicial authority channels, verifies breaches, and is linked to the administrative penalties framework.

Consent matters, but the PDPL recognises many non-consent grounds. Article 4 prohibits processing without the data subject's consent, but then sets out several exceptions. These include public interest, data made public by the data subject, legal claims, healthcare and public health purposes, archives and research, protection of the data subject's interests, employment and social protection obligations, contracts, legal obligations, and other cases in the Executive Regulations.

Controllers and processors must document and secure processing. Both controllers and processors must maintain records of personal data processing, implement technical and organisational measures, protect confidentiality and privacy, apply pseudonymisation where appropriate, control processors, support the DPO, manage breach notification and handle data subject rights.

How the UAE PDPL works in practice

The law defines personal data broadly as data relating to an identified or identifiable natural person, directly or indirectly, including identifiers such as name, voice, image, identification number, electronic identifier, geographical location and physical, physiological, economic, cultural or social characteristics. It expressly includes sensitive personal data and biometric data.

Sensitive personal data includes data that directly or indirectly reveals family or ethnic origin, political or philosophical opinions, religious beliefs, criminal record, biometric data, and data relating to health, physical, psychological, mental, genetic or sexual condition, including healthcare-service information revealing health status.

Processing is also broadly defined. It includes collecting, storing, recording, organising, adapting, modifying, circulating, retrieving, exchanging, sharing, using, characterising, disclosing, transmitting, distributing, making available, coordinating, merging, restricting, blocking, erasing, destroying or creating forms of personal data.

What organisations should prioritise

Start with scope. Confirm whether the federal PDPL applies or whether the activity is excluded because a sector law, government rule, security or judicial context, health legislation, banking or credit legislation, or free-zone privacy law governs it. This first step is essential in the UAE because multiple privacy regimes may coexist.

Then map controller and processor obligations. Controllers should document purposes, categories of personal data, authorised access, retention, erasure and modification mechanisms, cross-border movement, security measures and processor selection. Processors should document processing on behalf of controllers, follow controller instructions, protect data, delete or return data after processing and avoid unauthorised disclosure.

Finally, test rights and breach processes. Data subjects can request information, transfer, correction, erasure, restriction, objection and human review of automated decisions. Controllers must notify the UAE Data Office and affected data subjects where a breach prejudices privacy, confidentiality or security, in accordance with the Executive Regulations.