With the UAE Personal Data Protection Law in effect, organizations need a clear plan for how they collect, use, share and protect personal data. Many have waited for the Executive Regulations before acting, but the law already applies, and the grace period that follows the regulations will be short.
This article explains who the PDPL applies to, where the law stands in 2026, what it requires in practice and how to build a strategic approach to PDPL compliance that also supports your security, privacy and business objectives.
What is the UAE PDPL?
The PDPL is the UAE's first comprehensive federal data protection law. It was issued on 20 September 2021 and came into force on 2 January 2022. It sets out when personal data may be processed, the rights individuals have over their data, and the obligations of controllers (organizations that decide why and how data is processed) and processors (organizations that process data on their behalf). A companion law, Federal Decree-Law No. 44 of 2021, established the UAE Data Office as the regulator.
The PDPL is closely modeled on the EU General Data Protection Regulation, but there are important differences. Our article on the GDPR in 2026 includes a side-by-side comparison.
Who does the PDPL apply to?
The PDPL applies to the processing of personal data of individuals in the UAE, and to controllers and processors established in the UAE, whether the data is processed inside or outside the country. It also covers controllers and processors outside the UAE that process the personal data of people in the UAE.
Some categories are excluded because they are governed by their own legislation:
Government data, and government entities that control or process personal data.
Personal data held by security and judicial authorities.
Health data that is covered by its own legislation, such as Federal Law No. 2 of 2019 on the use of ICT in health fields.
Banking and credit data that is covered by its own legislation.
Organizations in free zones with their own data protection laws, namely the DIFC and ADGM.
Personal data processed by individuals for personal or family purposes.
Where the PDPL stands in 2026
The PDPL required the Executive Regulations to be issued within six months of the law, but as of the Chambers Data Protection & Privacy 2026 guide, they had not been published. The same guide notes that the UAE Data Office is not yet fully operational, with the Telecommunications and Digital Government Regulatory Authority (TDRA) providing support in the meantime.
That is now changing. On 14 June 2026, the UAE announced the creation of the Federal Authority for Artificial Intelligence and Data, which brings together the UAE Data Office, the UAE Artificial Intelligence Office and the digital government sector of TDRA under one body reporting to the Cabinet. Legal commentators expect the new authority to finalize the Executive Regulations and put enforcement on a firmer footing, which makes early preparation even more important.
Article 29 of the PDPL gives organizations six months from the date the Executive Regulations are issued to bring their processing into line. In practice, data mapping, consent changes, vendor contract updates and new procedures take longer than that. Organizations that start now will only need to fine-tune their program when the regulations appear.
Key PDPL obligations at a glance
| Obligation | What it means in practice | PDPL reference |
|---|---|---|
| Lawful processing and consent | Consent is the default basis for processing. It must be specific, clear and as easy to withdraw as to give. The law lists specific cases where consent is not required, such as performing a contract or meeting a legal obligation. | Articles 4 and 6 |
| Data subject rights | Individuals can request information about and a copy of their data, correction or erasure, restriction of processing, data portability, and can object to decisions based solely on automated processing. | Articles 13 to 19 |
| Security of processing | Apply technical and organizational measures appropriate to the risk, such as encryption, pseudonymization and access control. | Article 20 |
| Data protection impact assessment | Assess the impact on privacy before high-risk processing, such as large-scale sensitive data or new technologies. | Article 21 |
| Data protection officer | Appoint a DPO where processing is high risk, involves large-scale sensitive data or systematic profiling. The role can be outsourced. | Article 10 |
| Breach notification | Notify the regulator immediately on becoming aware of a breach that affects personal data, and inform affected individuals where their rights are at risk. | Article 9 |
| Cross-border transfers | Transfer data outside the UAE only to countries with adequate data protection laws, or under the safeguards and exceptions the law permits. | Articles 22 and 23 |
PDPL, DIFC and ADGM: which law applies?
The UAE has three data protection regimes. Which one applies depends on where your organization is established:
| Federal PDPL | DIFC | ADGM | |
|---|---|---|---|
| Law | Federal Decree-Law No. 45 of 2021 | DIFC Data Protection Law No. 5 of 2020, as amended | ADGM Data Protection Regulations 2021 |
| Regulator | UAE Data Office, now part of the Federal Authority for AI and Data | DIFC Commissioner of Data Protection | ADGM Office of Data Protection |
| Recent changes | New federal authority announced June 2026; Executive Regulations still pending | Amendment Law No. 1 of 2025 (in effect July 2025) introduced a private right of action before the DIFC Courts | New rules on substantial public interest conditions for sensitive data (2025) |
Groups with entities onshore and in a free zone often need to meet more than one regime. A single control framework mapped to all applicable laws avoids duplicated effort.
A strategic approach to PDPL implementation
Treating the PDPL as a one-off legal exercise rarely works. The most effective programs follow a structured sequence:
1. Set up governance and ownership
Agree who is accountable for data protection, whether you need a DPO, and how privacy decisions are escalated. Smaller organizations often combine this role with security leadership through a virtual CISO.
2. Map your personal data
Build an inventory of the personal data you hold, where it comes from, which systems store it, who can access it, who it is shared with and how long it is kept. This record is the foundation for every other step.
3. Review legal bases, consent and notices
Check that each processing purpose has a valid basis under the PDPL. Where consent is required, review how it is captured and recorded on websites, apps, forms and contracts, and update your privacy notices.
4. Build processes for data subject requests
Define how requests are received, verified, tracked and answered, and who is responsible for each step. Test the process with a few internal requests before customers start using it.
5. Strengthen security and assess high-risk processing
Align your security controls with recognized frameworks such as ISO 27001, and run DPIAs for high-risk processing. Technical controls such as data loss prevention and identity and access management reduce the likelihood of a reportable breach.
6. Review vendors and cross-border transfers
Identify every supplier that processes personal data for you and every transfer outside the UAE, then update contracts and safeguards. Our article on cross-border data transfers in MENA covers this in more depth.
7. Prepare for breaches
Update your incident response plan so it covers PDPL notification to the regulator, and run an exercise to confirm the team can act immediately.
8. Train staff and monitor compliance
Give employees practical awareness training on handling personal data, and review compliance regularly through internal audits.
Sector-specific rules to consider
Some sectors must meet additional requirements alongside, or instead of, the PDPL:
Healthcare: health data is subject to Federal Law No. 2 of 2019, which includes data localization requirements, and to emirate-level standards such as ADHICS in Abu Dhabi. See our article on healthcare cybersecurity.
Banking and financial services: the Central Bank of the UAE sets its own requirements for customer data. See CBUAE compliance and our article on digital banking security.
Government and critical infrastructure: government entities follow federal and emirate-level frameworks such as the UAE Information Assurance Standard. See our article on government cybersecurity frameworks.
Common PDPL compliance mistakes
Waiting for the Executive Regulations. The six-month grace period will not be enough to start from zero.
Assuming consent covers everything. Bundled or pre-ticked consent is unlikely to meet the PDPL standard.
Ignoring free-zone entities. A group may have obligations under the PDPL and the DIFC or ADGM regime at the same time.
Overlooking suppliers. Cloud, marketing and HR platforms often process the most personal data.
Treating privacy and security separately. Most PDPL failures will start as security incidents.
How Intello helps with UAE PDPL compliance
Intello helps organizations across the UAE prepare for and maintain UAE PDPL compliance, from gap assessments and data mapping to DPIAs, policy development, breach response and ongoing monitoring. Because many of our clients also handle EU data or operate in free zones, we build one data privacy program that covers the PDPL, the GDPR and the DIFC and ADGM regimes where they apply.
Speak to our PDPL team or book a free security assessment.
Frequently asked questions
Is the UAE PDPL in force?
Yes. Federal Decree-Law No. 45 of 2021 came into force on 2 January 2022. Its Executive Regulations had not been issued as of 2026, and organizations will have six months from their issue to comply fully.
Who does the UAE PDPL apply to?
It applies to the processing of personal data of people in the UAE and to controllers and processors established in the UAE. Government data, certain health and banking data covered by other laws, and organizations in the DIFC and ADGM free zones are excluded.
Does the PDPL apply to companies in the DIFC or ADGM?
No. Companies in the DIFC follow the DIFC Data Protection Law No. 5 of 2020, and companies in ADGM follow the ADGM Data Protection Regulations 2021. Groups with onshore entities may need to comply with both.
Who enforces the UAE PDPL?
The PDPL named the UAE Data Office, established by Federal Decree-Law No. 44 of 2021, as the regulator. In June 2026, the UAE announced that the Data Office will become part of a new Federal Authority for Artificial Intelligence and Data. Detailed administrative penalties are expected to be set out in the Executive Regulations.
Do I need a data protection officer under the PDPL?
You need a DPO if your processing is high risk, for example large-scale processing of sensitive personal data or systematic profiling. The DPO role can be outsourced to a qualified provider.
How quickly must a data breach be reported under the PDPL?
The controller must notify the regulator immediately on becoming aware of a breach that affects personal data, and inform affected individuals where the breach puts their rights at risk.