🇦🇪Federal Decree-Law No. 45 of 2021 on Personal Data Protection

← Back to laws in United Arab Emirates

A federal data protection law with strong controller and processor duties

Federal Decree by Law No. 45 of 2021 Concerning the Protection of Personal Data is the UAE's federal personal data protection law. It applies to the processing of personal data through electronic systems that operate automatically, and by other means, subject to the law's scope and exclusions.

The PDPL combines consent, statutory exceptions, controller and processor accountability, records, breach notification, DPO appointment, data subject rights, security controls, impact assessments, cross-border transfer rules, complaints and administrative penalties. It is practical and operational: an organisation must be able to show why it processes data, how it protects it, who accesses it, how long it keeps it, when it transfers it, and how data subjects can exercise their rights.

Scope and exclusions

Article 2 applies the Decree by Law to processing of all or part of personal data by electronic systems that operate automatically or by other means. It applies to each data subject residing in the UAE or having a place of business in it, each controller or processor residing in the UAE and processing personal data of data subjects inside or outside the UAE, and each controller or processor outside the UAE that processes personal data of data subjects inside the UAE.

The law also contains important exclusions. It does not apply to government data, governmental entities that control or process personal data, personal data held by security and judicial authorities, data subjects processing their own data for personal purposes, personal health data where separate legislation regulates protection and processing, personal banking and credit data where separate legislation regulates protection and processing, or companies and establishments in UAE free zones that have special data protection legislation.

Article 3 allows the UAE Data Office to exempt some establishments that do not process a large volume of personal data from some or all requirements, according to standards and controls in the Executive Regulations.

Key definitions — personal data, sensitive data, controller and processor

Article 1 defines Personal Data as any data related to a specific natural person or a natural person who can be identified directly or indirectly by linking data through identifiers such as name, voice, image, identification number, electronic identifier, geographical location, or physical, physiological, economic, cultural or social characteristics. It includes sensitive personal data and biometric data.

Sensitive Personal Data includes data directly or indirectly revealing a natural person's family, ethnic origin, political or philosophical opinions, religious beliefs, criminal record, biometric data, or data relating to health and physical, psychological, mental, genetic or sexual condition, including healthcare information that reveals health status.

A Controller is an establishment or natural person that has personal data and determines, individually or jointly, the method, criteria and purpose of processing. A Processor processes personal data on behalf of the controller, under its supervision and instructions.

Consent and processing without consent

Article 4 states that personal data may not be processed without the consent of its owner, but it then lists recognised exceptions. Processing without consent is permitted where necessary to protect public interest, where the data has become publicly known by an act of the data subject, where necessary for legal claims or judicial or security procedures, and for certain medical, healthcare, public health, archival, scientific, historical and statistical purposes.

Other exceptions include processing necessary to protect the interests of the data subject, to carry out obligations and rights in employment, social security or social protection, to perform a contract or take steps requested by the data subject to conclude, amend or terminate a contract, or to fulfil legal obligations imposed on the controller under UAE laws. The Executive Regulations may add further cases.

Article 6 sets conditions for valid consent. The controller must be able to prove consent where processing is based on it. Consent must be clear, simple, unambiguous and easily accessible, whether written or electronic, and must include the data subject's right to withdraw consent easily. Withdrawal does not affect the legality of processing based on consent before withdrawal.

Processing principles and controls

Article 5 sets the core processing controls. Processing must be fair, transparent and lawful. Personal data must be collected for a specific and clear purpose and may not later be processed in a manner incompatible with that purpose, though similar or close purposes may be permitted. Data must be sufficient and limited to what is necessary for the processing purpose.

Personal data must be accurate and correct and updated whenever necessary. Incorrect personal data must be deleted or corrected. It must be kept securely, protected from violation, penetration and illegal or unauthorised processing through appropriate technical and organisational measures.

Personal data must not be retained after the processing purpose is exhausted. It may be kept if the identity of the data subject has been concealed using anonymisation. Additional controls may be set by the Executive Regulations.

Controller obligations

Article 7 imposes broad controller obligations. Controllers must take appropriate technical and organisational measures to protect and secure personal data, preserve confidentiality and privacy, and prevent breach, destruction, alteration or tampering, taking into account the nature, scope and purposes of processing and risks to confidentiality and privacy.

Controllers must apply measures while determining means of processing and during processing, including pseudonymisation mechanisms. They must also apply suitable automatic settings so that processing is limited to the intended purpose, including the volume and type of personal data collected, type of processing, storage period and accessibility.

Controllers must maintain a special record for personal data. This record must include data of the controller and DPO, description of personal data categories, authorised access details, processing times, limits and scope, erasure, modification or processing mechanisms, processing purpose, cross-border movement and processing information, and technical and organisational security measures. It must be submitted to the Data Office on request.

Controllers must appoint processors with sufficient guarantees to implement technical and organisational measures, and must provide the Data Office, pursuant to a competent judicial authority decision, with requested information needed for the Office's powers.

Processor obligations

Article 8 requires processors to act according to the controller's instructions and contracts or agreements between them. Those contracts should specify the scope, subject, purpose, nature and type of personal data and the category of data subject.

Processors must apply technical and organisational procedures and measures to protect data at the design stage and during processing, taking into account cost, nature, scope and purposes of processing. They must process according to the specified purpose and period, notify the controller if processing exceeds the specified period, erase data after expiry of the processing period or hand it over to the controller, and avoid unauthorised disclosure of personal data or processing results.

Processors must protect processing, electronic media and devices, maintain processing records, provide proof of compliance to the controller or Data Office when requested, and follow the rules, conditions and controls in the law, Executive Regulations and Bureau instructions. Where multiple processors participate, they must process under a written contract or agreement clearly defining obligations, responsibilities and roles; otherwise they are deemed jointly responsible.

Data breach notification

Article 9 requires the controller, when aware of a breach or violation of personal data that would prejudice privacy, confidentiality or security, to notify the Data Office within the period and in accordance with the measures and requirements set by the Executive Regulations. The report must include a description of the nature, form, causes, approximate number and records of the breach, details of the DPO, potential and expected effects, corrective measures taken or proposed, documents on the violation and corrective actions, and any other Bureau requirements.

The controller must also notify the data subject where the violation or breach would prejudice privacy and confidentiality of the security of the data subject's personal data, within the period and according to the measures and requirements in the Executive Regulations, and must inform the data subject of measures taken.

If a processor becomes aware of a breach, it must notify the controller as soon as it becomes aware. The controller then informs the Data Office. The Data Office verifies the reasons for the violation and the integrity of security measures and may impose administrative penalties where a violation is proven.

DPO appointment and role

Article 10 requires controllers and processors to appoint a Data Protection Officer with sufficient skills and knowledge of personal data protection law in specified cases. These include processing that may cause high-level risk to confidentiality and privacy because of new technologies or data volume, processing involving systematic and comprehensive assessment of sensitive personal data including profiling and automated processing, or processing a large volume of sensitive personal data.

The DPO may be employed by, or authorised by, the controller or processor and may be inside or outside the UAE. The controller or processor must specify the DPO's contact details and notify the Data Office.

Article 11 makes the DPO responsible for ensuring compliance with the Decree by Law, its Executive Regulations and Data Office instructions. Duties include verifying the quality and correctness of procedures, receiving requests and complaints, providing technical advice on evaluation and periodic examination of data protection systems and intrusion prevention systems, documenting results and recommendations, acting as the link with the Data Office, and maintaining confidentiality.

Article 12 requires controllers and processors to support the DPO. They must involve the DPO appropriately and in a timely way in personal data matters, provide necessary resources and support, avoid terminating the DPO or imposing disciplinary penalties for performing DPO duties, and ensure the DPO is not assigned conflicting duties. Data subjects may communicate directly with the DPO about processing and rights.

Data subject rights

Article 13 gives data subjects the right to receive information from the controller without charge. This includes the types of personal data processed, purposes, automated processing decisions including profiling, sectors or establishments with whom data will be shared inside or outside the UAE, storage and retention controls, procedures for correction, erasure, restriction and objection, cross-border processing protection measures, breach or misuse actions, and complaint submission to the Data Office.

Article 14 gives the data subject the right to receive personal data provided to the controller in an orderly and machine-readable manner where processing is based on consent or contract and carried out by automated means. The data subject may also request transfer to another controller where technically feasible.

Article 15 creates rights to correction and erasure. Data subjects may request correction of inaccurate personal data or completion of data held by the controller. They may request erasure where data is no longer necessary, consent is withdrawn, objection succeeds or there is no legitimate reason to continue processing, or processing violates the PDPL and erasure is necessary for compliance. Exceptions apply for public health, investigations and legal claims, other legislation, and cases in the Executive Regulations.

Article 16 gives the right to restrict processing in cases such as disputed accuracy, objection to processing contrary to agreed purposes, and unlawful processing. Article 17 gives the right to object and stop processing for direct marketing, statistical surveys unless necessary for public interest, and processing that violates Article 5. Article 18 gives the right to object to automated decisions, including profiling, especially where they have legal impact or adversely affect the data subject, with exceptions for contracts, UAE legislation and prior consent.

Security and impact assessment

Article 20 requires controllers and processors to develop and take technical and regulatory measures to ensure the highest appropriate standard of information security based on processing risks and international best practices. Measures include encryption and pseudonymisation, continuous confidentiality, safety, accuracy and flexibility of systems and services, timely retrieval and access after failure, and ongoing testing and evaluation of security measures.

Article 21 requires an impact assessment before processing where the controller uses modern technologies that pose high risk to privacy and confidentiality. It is required where processing includes systematic and comprehensive assessment of personal aspects using automated processing, including profiling, with legal consequences or serious impact, or where processing involves a large volume of sensitive personal data.

The assessment must include a clear and systematic explanation of proposed processing operations and purpose, an evaluation of necessity and suitability, an evaluation of potential risks to privacy and confidentiality, and proposed procedures and measures to reduce those risks. The controller must coordinate with the DPO and review assessment results regularly if risk changes.

Cross-border transfer and sharing

Article 22 allows cross-border transfer where a proper protection level is available. This includes transfer to a state or province with personal data protection legislation containing significant provisions, measures, controls and rules protecting privacy and confidentiality and enabling data subjects to exercise legal rights, with a judicial or regulatory authority imposing appropriate measures. Transfer is also permitted where the state has joined a bilateral or multilateral personal data protection agreement with the UAE.

Article 23 allows transfer even where proper protection is not available in specified cases. These include transfer under a contract or agreement requiring the foreign recipient to adopt PDPL-level measures and controls, explicit consent where transfer does not contradict UAE public or security interest, legal claims, contracts with the data subject or in the data subject's interest, international judicial cooperation, and public interest. The Executive Regulations set the controls and stipulations for such transfers.

Complaints, grievances and penalties

Article 24 gives data subjects the right to submit complaints to the Data Office if they believe the law has been violated or that the controller or processor is processing personal data in violation of rules and procedures set by the Office. The Office examines complaints in coordination with the controller and processor and may impose administrative penalties if violations are proven.

Article 25 allows stakeholders to submit written grievances to the General Director of the Data Office against administrative decisions, penalties or other actions within 30 days of notice. The grievance must be decided within 30 days of submission, and court challenge is not permitted before submitting a grievance.

Article 26 states that the Council of Ministers, based on a suggestion from the General Director of the Data Office, will issue a decision identifying actions constituting violations and the administrative penalties to be imposed.

Regularisation and commencement

Article 28 requires the Executive Regulations to be issued within six months from promulgation. Article 29 requires controllers and processors to regularise their status within no more than six months from the date the Executive Regulations are issued, with the possibility of extension for a similar period by the Council of Ministers.

Article 31 states that the Decree by Law was to be published in the Official Gazette and come into force on 2 January 2022.