UAE Data Office and the PDPL: Where Things Stand and What Companies Should Do

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) has been in force since 2 January 2022. The regulator it relies on, the UAE Data Office, was created by a separate law, Federal Decree-Law No. 44 of 2021. Nearly five years on, the position is unusual: a published law, a regulator established on paper, and implementing rules that do not appear to have been issued.

This article summarises the framework, the Data Office’s current status, and the compliance steps companies can take now.

Two instruments, one framework

Who the PDPL covers:

The PDPL applies to controllers and processors in the UAE, and to those outside it that process the personal data of people in the UAE. It does not apply to government data or entities, data held by security and judicial authorities, processing for personal purposes, health data and banking or credit data that have their own legislation, or free zone companies with their own data protection legislation. In practice that means entities in the DIFC (DIFC Law No. 5 of 2020) and ADGM (Data Protection Regulations 2021), which have their own regulators. The Data Office may also exempt establishments that do not process large volumes of personal data, under standards the Executive Regulations are to set.

Operational status as of now:

What the PDPL already requires

• Lawful processing. Processing needs the data subject’s consent unless an exception applies, such as contract performance, legal obligations, legal claims or public interest. Consent must be provable, clear and easy to withdraw.
• Principles. Processing must be fair, transparent and lawful, limited to a specific purpose, minimised, accurate and secure, and data must not be kept beyond that purpose.
• Records. Controllers and processors must maintain a record of processing and make it available to the Data Office on request.
• Security and design. Appropriate technical and organisational measures are required, including pseudonymisation, encryption, resilience and regular testing.
• Processors. Controllers must appoint processors with sufficient guarantees. Processors act on instructions, erase data when processing ends and keep their own records.
• Breach reporting. A controller must notify the Data Office, and in some cases affected individuals, when it becomes aware of a breach. Timing and procedure are left to the Executive Regulations.
• Data Protection Officer. One must be appointed where processing is high-risk because of new technologies or volume, involves systematic assessment of sensitive data including profiling or automated processing, or involves large volumes of sensitive data.
• Impact assessments. These are required before certain high-risk processing, such as profiling with serious effects or large volumes of sensitive data.
• Rights. Data subjects have rights to information, portability, correction and erasure, restriction, objection to direct marketing and objection to automated decisions, and controllers must provide a clear contact channel.
• Cross-border transfers. Transfers are permitted to jurisdictions approved by the Data Office, or on listed grounds, including contractual safeguards, explicit consent, legal claims, contract performance, judicial cooperation and public interest.

What is still pending:

The Executive Regulations are expected to settle breach timing, DPO and impact-assessment thresholds, transfer controls and the grievance procedure. Companies then have up to six months to regularise, extendable by the Cabinet.

Obligations that apply regardless:

Other regimes already bind companies. The Cybercrime Law (Federal Decree-Law No. 34 of 2021), the health ICT law (Federal Law No. 2 of 2019, which restricts storing or transferring health data outside the UAE without approval), Central Bank rules for financial institutions, telecoms rules and the DIFC and ADGM regimes. Moving data between the mainland and the DIFC or ADGM is treated as a cross-border transfer.

Practical Takeaways

• Identify which regime applies to each entity and data flow: mainland, DIFC, ADGM or a sector rule.
• Build a data inventory and a record of processing.
• Review lawful bases, consent flows and privacy notices.
• Assess and document whether a DPO is needed.
• Update processor and vendor contracts, and do due diligence on providers.
• Strengthen security measures and prepare a breach response plan that can notify the regulator and individuals quickly.
• Set up a process for impact assessments on high-risk processing, including AI and profiling.
• Build a workflow for data subject requests, with a clear contact channel.
• Map cross-border flows, including intra-UAE transfers, and put contractual safeguards in place.
• Monitor the Executive Regulations, the penalties decision and the new Artificial Intelligence and Data Authority.

FAQ’s