UAE PDPL and the DIFC Data Protection Law
PDPL & Data Protection Compliance in Dubai
Intello helps Dubai companies with data protection compliance, whether the federal UAE PDPL applies to you or, in DIFC, the DIFC Data Protection Law. We map your personal data, close the gaps, and give you the records, policies, DPO guidance and breach process a regulator expects to see.
- Mainland, free zones and DIFC
- 500+ clients
- 99% client satisfaction
Which data protection law applies in Dubai?
Dubai has two data protection regimes. Most companies, on the mainland and in most free zones, follow the federal UAE PDPL (Federal Decree-Law No. 45 of 2021). Companies in DIFC follow the DIFC Data Protection Law (DIFC Law No. 5 of 2020) instead, overseen by DIFC’s Commissioner of Data Protection.
| Mainland and most free zones | UAE PDPL, in force since 2 January 2022. Its Executive Regulations were still unpublished in November 2026 |
|---|---|
| DIFC | DIFC Data Protection Law No. 5 of 2020, in force since 1 July 2020, with its own regulator and rules |
| PDPL regulator | UAE Data Office, consolidated in June 2026 into the new UAE AI and Data Authority |
| DIFC regulator | The DIFC Commissioner of Data Protection. DIFC entities must notify the Commissioner of their processing |
| Health data | Also covered by its own federal law, which generally requires health data to stay in the UAE |
| Where we work | From our Dubai office in Al Qusais, on site anywhere in Dubai and remotely |
Data protection compliance across Dubai
Where you are licensed decides which law applies, and many Dubai groups have entities under both. We map that first, so you only do the work that applies to you.
DIFC
Banks, funds, law firms and fintechs under the DIFC law: notifications to the Commissioner, DPO duties, breach reporting and the AI rules in Regulation 10.
Mainland Dubai
Retail, real estate, hospitality, education and professional services under the federal UAE PDPL.
DMCC and JAFZA
Trading and logistics companies sending customer and supplier data across borders every day.
Dubai Internet City and Dubai Silicon Oasis
SaaS and tech companies processing client data, often also working to GDPR for European customers.
Dubai Healthcare City and clinics
Healthcare providers holding patient data, where data protection meets health data rules.
Groups with entities in both
Companies with a DIFC entity and a mainland entity, needing one programme that meets both laws.
Also available: Data protection in Abu Dhabi · UAE PDPL compliance · Data protection in Sharjah
Do you need data protection compliance in Dubai?
You almost certainly do if any of these describe you:
- You collect customer, patient, student or employee data in Dubai
- You are licensed in DIFC and process any personal data at all
- You send personal data to cloud services, vendors or group companies outside the UAE
- You handle sensitive data such as health, biometric or financial data
- You use AI or automated decisions on personal data
- A client, partner or regulator has asked how you protect personal data
Not sure whether the PDPL or the DIFC law applies? It depends on where each entity is licensed. We will tell you in the first call.
What data protection compliance involves in Dubai
The UAE PDPL and the DIFC law differ in detail, but the core obligations are similar.
Lawful basis and consent
A valid basis for each use of personal data. The PDPL relies mainly on consent with listed exceptions; the DIFC law offers a wider set of lawful bases.
Data subject rights
Processes to handle requests for access, correction, erasure, objection and data portability within the deadlines.
Record of processing
A record of what personal data you hold, why, where it is stored, who receives it and how long you keep it.
Notification in DIFC
DIFC entities must notify the Commissioner of Data Protection of their processing and keep that notification up to date.
Security of processing
Technical and organisational measures matched to the risk, from access control to encryption and backups.
Breach notification
A process to assess breaches and notify the regulator and affected individuals when required.
Data Protection Officer
A DPO where the law requires one, for example for high-risk processing. The DPO can be internal or outsourced.
Cross-border transfers
Rules for sending personal data outside the UAE or DIFC, with safeguards where the destination is not adequate.
How we deliver data protection compliance in Dubai
A fixed sequence, so you always know what happens next and what you will have at the end of each stage.
- 1
Scoping call
We confirm which entities fall under the PDPL and which under the DIFC law, and which systems and data are in scope.
Week 0 · free
- 2
Data discovery and mapping
Interviews and a system review to build your record of processing, including every transfer outside the UAE or DIFC.
Weeks 1–3
- 3
Gap assessment
Every requirement of the applicable law scored against your current practice, with a prioritised remediation roadmap.
Weeks 3–4
- 4
Remediation
Privacy notices, consent, policies, rights-request process, vendor contracts, transfer safeguards and DIFC notifications.
Weeks 4–12
- 5
Breach readiness
A breach playbook with roles, decision points and templates, tested in a tabletop exercise.
Alongside remediation
- 6
Ongoing support
Yearly reviews, help with rights requests and breaches, and updates when the PDPL Executive Regulations are published.
Optional
Most mid-sized Dubai companies complete stages 1 to 4 in 8 to 12 weeks.
What you get
- A clear answer on which law applies to each entity
- Record of processing activities and data flow maps
- Gap assessment against the PDPL or the DIFC law
- Prioritised remediation roadmap
- Privacy notices and consent wording
- Data protection policy set and rights-request procedure
- Guidance on the DIFC notification, where it applies
- Breach playbook and tabletop exercise
- Board-level summary of your data protection position
Choose how we work with you
Data protection gap assessment
3–4 weeksBest for: Knowing exactly where you stand
- · Data mapping
- · Record of processing
- · Gap report and roadmap
Full compliance programme
8–12 weeksBest for: PDPL or DIFC compliance end to end
- · Everything in the assessment
- · Policies, notices and contracts
- · Breach playbook and training
Ongoing compliance support
YearlyBest for: Staying compliant as you grow
- · Yearly review
- · Rights-request and breach support
- · Regulatory updates
PDPL or DIFC: not sure which applies to you?
A 30-minute call is enough to tell you which law applies, what is missing and what it will take to fix.
UAE PDPL vs DIFC Data Protection Law
If your group has entities on the mainland and in DIFC, you need to meet both. These are the main differences.
| UAE PDPL | DIFC Data Protection Law | |
|---|---|---|
| Applies to | Mainland and free zones without their own law | Entities licensed in DIFC |
| In force | 2 January 2022 | 1 July 2020 |
| Regulator | UAE Data Office (now part of the UAE AI and Data Authority) | DIFC Commissioner of Data Protection |
| Lawful basis | Consent by default, with listed exceptions | A wider set of lawful bases, closer to GDPR |
| Registration | No general registration duty | Notification to the Commissioner, kept up to date |
| AI rules | None specific yet | Regulation 10 on autonomous and semi-autonomous systems |
What affects the cost of data protection compliance in Dubai
You get a written scope and quote after the scoping call. These are the factors that move it:
- Entities and laws
- Each entity, and whether the PDPL, the DIFC law or both apply.
- Systems and vendors
- The number of applications and third parties that hold personal data.
- Data sensitivity
- Health, biometric or children’s data needs deeper assessments and tighter controls.
- Existing work
- GDPR, ISO 27001 or SOC 2 programmes can be reused, which shortens the project.
- Cross-border transfers
- Group structures and overseas cloud services need transfer safeguards.
- Ongoing support
- Whether you want yearly reviews and support once the programme is in place.
Why companies choose Intello as their data protection consultants in Dubai
23+
years in UAE cybersecurity
500+
clients served
99%
client satisfaction
Both laws, one team. Our data privacy services in Dubai cover the UAE PDPL and the DIFC law, so groups with entities in both get one programme.
Privacy and security together. We fix the technical controls the law expects, not only the paperwork.
Reuse what you have. GDPR, ISO 27001 or SOC 2 work is mapped to the law that applies, so you do not do it twice.
Dubai-based. Workshops on site anywhere in Dubai, from DIFC to Jebel Ali.
Frequently asked questions
Does the UAE PDPL apply in DIFC?
No. DIFC has its own law, the DIFC Data Protection Law No. 5 of 2020, overseen by the DIFC Commissioner of Data Protection. The federal PDPL applies to mainland Dubai and free zones without their own data protection law. Groups with entities in both need to meet both.
Is PDPL compliance in Dubai mandatory now?
Yes. The UAE PDPL has been in force since 2 January 2022. Its Executive Regulations had not been published as of November 2026; once they are, organisations get six months to comply. A full programme takes 8 to 12 weeks, so starting early is the safer path.
Do DIFC companies need to register with the Commissioner?
DIFC entities must notify the Commissioner of Data Protection of their personal data processing and keep that notification up to date. Your compliance plan includes this step, so the notification stays accurate as your processing changes.
Do we need a Data Protection Officer in Dubai?
You need a DPO where the law requires one, for example for high-risk processing or large volumes of sensitive data. The DPO can be an employee or an external appointee, and many organisations compare outsourced DPO services in Dubai. We help you decide whether you need one, define the role, and give your DPO the records and processes to do the job.
Are you a PDPL compliance lawyer in Dubai?
No. We are data protection consultants, not a law firm. We map your data, fix the processes and technical controls, help you set up the DPO role, and work alongside your legal adviser where you need a formal legal opinion.
How long does data protection compliance take?
A gap assessment takes three to four weeks. Full implementation for a mid-sized Dubai company usually takes 8 to 12 weeks, depending on the number of systems, entities and vendors involved.
We already comply with GDPR. Are we covered?
Partly. Records, rights processes and security controls carry over, but the PDPL handles consent differently and both UAE laws have their own transfer and notification rules. Our gap assessment maps your GDPR programme to the law that applies and closes the differences.
How quickly must we report a data breach?
Under the PDPL, once you become aware of a breach that affects personal data, you must notify the regulator and affected individuals; the exact deadline is left to the Executive Regulations. In DIFC, notifiable breaches go to the Commissioner as soon as practicable. A tested breach playbook lets you meet either.
Related services
Get a clear view of your data protection position in Dubai
Tell us a little about your company and where it is licensed. We will set up a free 30-minute check.
What happens next
- 1We get in touch to arrange a call
- 2A 30-minute call to scope your exposure
- 3A written scope, timeline and quote
Prefer to talk now? Call +971 55 355 6787