UAE PDPL and the ADGM Data Protection Regulations 2021
PDPL & Data Protection Compliance in Abu Dhabi
Intello helps Abu Dhabi organisations with data protection compliance, under the federal UAE PDPL or, in ADGM, the ADGM Data Protection Regulations 2021. We map your personal data, close the gaps, and give you the records, policies, DPO guidance and breach process your regulator expects.
- Mainland, ADGM and healthcare
- On site in Abu Dhabi
- 500+ clients
Which data protection law applies in Abu Dhabi?
Abu Dhabi has two data protection regimes. Most organisations follow the federal UAE PDPL (Federal Decree-Law No. 45 of 2021). Companies registered in ADGM follow the ADGM Data Protection Regulations 2021 instead, overseen by ADGM’s independent Office of Data Protection.
| Mainland and most free zones | UAE PDPL, in force since 2 January 2022. Its Executive Regulations were still unpublished in November 2026 |
|---|---|
| ADGM | ADGM Data Protection Regulations 2021, enacted in February 2021, closely modelled on the EU GDPR |
| PDPL regulator | UAE Data Office, consolidated in June 2026 into the new UAE AI and Data Authority |
| ADGM regulator | The ADGM Office of Data Protection, which keeps a register of data controllers in ADGM |
| Healthcare | DoH-licensed entities also meet ADHICS, and health data generally has to stay in the UAE |
| Where we work | On site anywhere in Abu Dhabi, and remotely from our Dubai office |
Data protection compliance across Abu Dhabi
Where you are registered decides which law applies, and many Abu Dhabi groups have entities under both. We map that first, so you only do the work that applies.
ADGM, Al Maryah Island
Banks, asset managers, fintechs and family offices under the ADGM regulations: registration with the Office of Data Protection, DPO duties and breach reporting.
Mainland Abu Dhabi
Retail, real estate, education, energy and professional services under the federal UAE PDPL.
Healthcare
Hospitals, clinics and insurers holding patient data, where the PDPL or ADGM rules meet ADHICS and the federal health data law.
Government suppliers
Companies processing citizens’ and residents’ data for federal and Abu Dhabi government entities.
KEZAD and Masdar City
Industrial, logistics and technology companies sending employee, customer and supplier data abroad.
Groups with entities in both
Companies with an ADGM entity and a mainland entity, needing one programme that meets both laws.
Also available: Data protection in Dubai · UAE PDPL compliance · Data protection in Sharjah
Do you need data protection compliance in Abu Dhabi?
You almost certainly do if any of these describe you:
- You collect customer, patient, student or employee data in Abu Dhabi
- You are registered in ADGM and process any personal data at all
- You are a DoH-licensed healthcare entity holding patient data
- You send personal data to cloud services, vendors or group companies outside the UAE
- You process citizens’ or residents’ data for a government client
- A client, partner or regulator has asked how you protect personal data
Not sure whether the PDPL or the ADGM regulations apply? It depends on where each entity is registered. We will tell you in the first call.
What data protection compliance involves in Abu Dhabi
The UAE PDPL and the ADGM regulations differ in detail, but the core obligations are similar.
Lawful basis and consent
A valid basis for each use of personal data. The PDPL relies mainly on consent with listed exceptions; the ADGM regulations follow a GDPR-style set of lawful bases.
Data subject rights
Processes to handle requests for access, correction, erasure, objection and data portability within the deadlines.
Record of processing
A record of what personal data you hold, why, where it is stored, who receives it and how long you keep it.
Registration in ADGM
ADGM controllers register with the Office of Data Protection and keep their entry up to date.
Security of processing
Technical and organisational measures matched to the risk, from access control to encryption and backups.
Breach notification
A process to assess breaches and notify the regulator and affected individuals when required.
Data Protection Officer
A DPO where the rules require one. The DPO can be internal or outsourced.
Cross-border transfers
Rules for sending personal data outside the UAE or ADGM, with safeguards where the destination is not adequate.
How we deliver data protection compliance in Abu Dhabi
A fixed sequence, so you always know what happens next and what you will have at the end of each stage.
- 1
Scoping call
We confirm which entities fall under the PDPL and which under the ADGM regulations, and whether health data rules also apply.
Week 0 · free
- 2
Data discovery and mapping
On-site interviews and a system review to build your record of processing, including every transfer outside the UAE or ADGM.
Weeks 1–3
- 3
Gap assessment
Every requirement of the applicable law scored against your current practice, with a prioritised remediation roadmap.
Weeks 3–4
- 4
Remediation
Privacy notices, consent, policies, rights-request process, vendor contracts, transfer safeguards and ADGM registration updates.
Weeks 4–12
- 5
Breach readiness
A breach playbook with roles, decision points and templates, tested in a tabletop exercise.
Alongside remediation
- 6
Ongoing support
Yearly reviews, help with rights requests and breaches, and updates when the PDPL Executive Regulations are published.
Optional
Most mid-sized Abu Dhabi organisations complete stages 1 to 4 in 8 to 12 weeks.
What you get
- A clear answer on which law applies to each entity
- Record of processing activities and data flow maps
- Gap assessment against the PDPL or the ADGM regulations
- Prioritised remediation roadmap
- Privacy notices and consent wording
- Data protection policy set and rights-request procedure
- Guidance on ADGM registration, where it applies
- Breach playbook and tabletop exercise
- Board-level summary of your data protection position
Choose how we work with you
Data protection gap assessment
3–4 weeksBest for: Knowing exactly where you stand
- · Data mapping
- · Record of processing
- · Gap report and roadmap
Full compliance programme
8–12 weeksBest for: PDPL or ADGM compliance end to end
- · Everything in the assessment
- · Policies, notices and contracts
- · Breach playbook and training
Ongoing compliance support
YearlyBest for: Staying compliant as you grow
- · Yearly review
- · Rights-request and breach support
- · Regulatory updates
PDPL or ADGM: not sure which applies to you?
A 30-minute call is enough to tell you which law applies, what is missing and what it will take to fix.
UAE PDPL vs ADGM Data Protection Regulations
If your group has entities on the mainland and in ADGM, you need to meet both. These are the main differences.
| UAE PDPL | ADGM Data Protection Regulations 2021 | |
|---|---|---|
| Applies to | Mainland and free zones without their own law | Entities registered in ADGM |
| In force | 2 January 2022 | Enacted February 2021 |
| Regulator | UAE Data Office (now part of the UAE AI and Data Authority) | ADGM Office of Data Protection |
| Model | UAE-specific; consent by default, with listed exceptions | Closely modelled on the EU GDPR |
| Registration | No general registration duty | Controllers register with the Office of Data Protection |
What affects the cost of data protection compliance in Abu Dhabi
You get a written scope and quote after the scoping call. These are the factors that move it:
- Entities and laws
- Each entity, and whether the PDPL, the ADGM regulations or both apply.
- Systems and vendors
- The number of applications and third parties that hold personal data.
- Data sensitivity
- Health, biometric or children’s data needs deeper assessments and tighter controls.
- Existing work
- GDPR, ISO 27001 or ADHICS programmes can be reused, which shortens the project.
- Cross-border transfers
- Group structures and overseas cloud services need transfer safeguards.
- Ongoing support
- Whether you want yearly reviews and support once the programme is in place.
Why organisations choose Intello as their data protection consultants in Abu Dhabi
23+
years in UAE cybersecurity
500+
clients served
99%
client satisfaction
Both laws, one team. Our data privacy services in Abu Dhabi cover the UAE PDPL and the ADGM regulations, so groups with entities in both get one programme.
Privacy and security together. We fix the technical controls the law expects, not only the paperwork.
Healthcare experience. We connect data protection with ADHICS, so DoH-licensed entities do the work once.
On site in Abu Dhabi. Workshops at your premises, from Al Maryah Island to Mussafah.
Frequently asked questions
Does the UAE PDPL apply in ADGM?
No. ADGM has its own law, the ADGM Data Protection Regulations 2021, overseen by the ADGM Office of Data Protection. The federal PDPL applies to mainland Abu Dhabi and free zones without their own data protection law. Groups with entities in both need to meet both.
Is PDPL compliance in Abu Dhabi mandatory now?
Yes. The UAE PDPL has been in force since 2 January 2022. Its Executive Regulations had not been published as of November 2026; once they are, organisations get six months to comply. A full programme takes 8 to 12 weeks, so starting early is the safer path.
Do ADGM companies need to register with the Office of Data Protection?
Data controllers in ADGM must register with the Office of Data Protection and keep their registration up to date. Your compliance plan includes this step, so the registration stays accurate as your processing changes.
Do we need a Data Protection Officer in Abu Dhabi?
You need a DPO where the rules require one, for example for high-risk processing or large volumes of sensitive data. The DPO can be an employee or an external appointee, and many organisations compare outsourced DPO services in Abu Dhabi. We help you decide whether you need one, define the role, and give your DPO the records and processes to do the job.
How does data protection fit with ADHICS?
They overlap. ADHICS covers the security of health information for DoH-licensed entities, while the PDPL or ADGM rules cover how personal data is collected, used and shared. We build one programme that meets both, so the same controls are not designed twice.
How long does data protection compliance take?
A gap assessment takes three to four weeks. Full implementation for a mid-sized Abu Dhabi organisation usually takes 8 to 12 weeks, depending on the number of systems, entities and vendors involved.
We already comply with GDPR. Are we covered?
In ADGM, largely, because the regulations are closely modelled on the GDPR, though there are local differences. Under the PDPL, partly: consent and transfer rules differ. Our gap assessment maps your GDPR programme to the law that applies and closes the differences.
Related services
Get a clear view of your data protection position in Abu Dhabi
Tell us a little about your organisation and where it is registered. We will set up a free 30-minute check.
What happens next
- 1We get in touch to arrange a call
- 2A 30-minute call to scope your exposure
- 3A written scope, timeline and quote
Prefer to talk now? Call +971 55 355 6787