Federal Decree-Law No. 45 of 2021
UAE PDPL Compliance Services
We help organisations meet the UAE Personal Data Protection Law (PDPL). We map the personal data you hold, close the gaps against the law, and give you the records, policies and breach process the regulator will ask to see.
- 23+ years in UAE cybersecurity
- 500+ clients
- 99% client satisfaction
What is the UAE PDPL?
The UAE PDPL (Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data) is the UAE’s federal data protection law. It sets the rules for collecting, using, storing and sharing personal data about people in the UAE, gives individuals rights over their data, and has been in force since 2 January 2022.
| Law | Federal Decree-Law No. 45 of 2021 |
|---|---|
| In force since | 2 January 2022 |
| Regulator | UAE Data Office, consolidated in June 2026 into the new UAE Artificial Intelligence and Data Authority |
| Applies to | Organisations in the UAE that process personal data, and organisations abroad that process data of people in the UAE |
| Main exclusions | Government data, health and banking data governed by their own laws, and free zones with their own data protection law (DIFC, ADGM) |
| Executive Regulations | Not yet published (October 2026). Once issued, organisations have six months to comply (Article 29) |
| Penalties | Set by Cabinet decision under Article 26, not in the law itself |
Does the PDPL apply to your organisation?
It almost certainly does if any of these describe you:
- You collect customer, patient, student or employee data in mainland UAE or a free zone without its own data protection law
- You are based outside the UAE but sell to, or track the behaviour of, people in the UAE
- You handle sensitive data such as health, biometric, genetic, religious or criminal-record data
- You send personal data to cloud services, vendors or group companies outside the UAE
- You use profiling, automated decision-making or new technology on personal data
Operating in DIFC or ADGM? Their own data protection laws apply instead. We will tell you which rules cover you in the first call.
What UAE PDPL compliance involves
The law places eight core obligations on organisations that control or process personal data.
Lawful basis and consent
Consent must be specific, clear and unambiguous, and as easy to withdraw as to give (Article 6). The law lists limited cases where you can process without consent (Article 4). There is no general “legitimate interests” basis as there is under GDPR.
Data subject rights
People can ask for access to their data, a portable copy, correction or erasure, restriction, an end to processing, and objection to automated decisions (Articles 13–18). You need a process to receive, verify and answer these requests.
Record of processing
Controllers must keep a record of the personal data they process: categories, purposes, recipients, retention and the security measures in place (Article 7).
Security of processing
Appropriate technical and organisational measures to protect personal data, matched to the risk (Article 20).
Breach notification
When you become aware of a breach that would affect the privacy, confidentiality or security of personal data, notify the regulator and the affected individuals (Article 9). The deadline and format are left to the Executive Regulations.
Data Protection Officer
A DPO is required where processing is high-risk, involves systematic evaluation of sensitive data, or covers large volumes of sensitive data (Article 10).
Impact assessments
Assess the impact of high-risk processing, such as new technology or large-scale sensitive data, before you start it (Article 21).
Cross-border transfers
Send personal data abroad only to countries with adequate protection, or under the specific conditions the law allows (Articles 22–23).
How we get you PDPL-compliant
A fixed sequence, so you always know what happens next and what you will have at the end of each stage.
- 1
Scoping call
We confirm whether the PDPL applies, which entities, systems and data are in scope, and whether DIFC, ADGM or sector rules also apply.
Week 0 · free
- 2
Data discovery and mapping
Interviews and a system review to build your record of processing: what personal data you hold, why, where it is stored, who it is shared with and where it leaves the UAE.
Weeks 1–3
- 3
Gap assessment
Every PDPL requirement scored against current practice. Findings are ranked by risk and turned into a prioritised remediation roadmap.
Weeks 3–4
- 4
Remediation
Privacy notices, consent flows, policies, the data subject request process, vendor contracts, transfer safeguards, security controls and impact assessments.
Weeks 4–12
- 5
Breach readiness
A breach-notification playbook with roles, decision points and templates, tested in a tabletop exercise with your team.
Alongside remediation
- 6
Ongoing compliance
Outsourced DPO support, an annual review, and updates to your programme when the Executive Regulations are published.
Optional
Most mid-sized organisations complete stages 1 to 4 in 8 to 12 weeks.
What you get
- Record of processing activities (your personal data inventory)
- Data flow maps, including every cross-border transfer
- Gap assessment report with risk-rated findings
- Prioritised remediation roadmap with owners and dates
- Privacy notice and consent wording
- Data protection policy set: retention, rights requests, breach, transfers
- Data subject request procedure and response templates
- Impact assessment template and completed assessments for high-risk processing
- Breach-notification playbook
- Board-level summary of your PDPL position
Choose how we work with you
PDPL gap assessment
3–4 weeksBest for: Knowing exactly where you stand
- · Data discovery and mapping
- · Record of processing
- · Gap report and roadmap
Full PDPL implementation
8–12 weeksBest for: Getting compliant end to end
- · Everything in the gap assessment
- · Policies, notices and contracts
- · Breach playbook and staff training
Ongoing DPO support
MonthlyBest for: Staying compliant as you grow
- · Outsourced DPO
- · Rights-request and breach support
- · Annual review and regulatory updates
Not sure where you stand?
A 30-minute call is enough to tell you whether the PDPL applies, what is missing and what it will take to fix.
UAE PDPL vs GDPR: key differences
If you already comply with GDPR, much of the work carries over, but not all of it.
| Topic | UAE PDPL | EU GDPR |
|---|---|---|
| Legal basis | Consent by default, with listed exceptions. No general legitimate-interests basis | Six lawful bases, including legitimate interests |
| Breach notification | On becoming aware; the deadline is left to the Executive Regulations | Within 72 hours to the supervisory authority |
| Fines | Set by Cabinet decision | Up to €20 million or 4% of global annual turnover |
| Health and banking data | Excluded where their own laws apply | Covered |
| Regulator | UAE AI and Data Authority (formerly UAE Data Office) | National data protection authorities |
What affects cost and timeline
You get a written scope and quote after the scoping call. These are the factors that move it:
- Entities and locations
- Each legal entity and site adds systems, owners and records to map.
- Systems and vendors
- The number of applications and third parties that hold personal data.
- Data sensitivity
- Health, biometric or children’s data needs impact assessments and tighter controls.
- Existing documentation
- ISO 27001, SOC 2 or GDPR work can be reused, which shortens the project.
- Cross-border transfers
- Group structures and overseas cloud services need transfer safeguards.
- Ongoing support
- Whether you need an outsourced DPO once the programme is in place.
Why organisations choose Intello for PDPL
23+
years in UAE cybersecurity
500+
clients served
99%
client satisfaction
Privacy and security under one roof. We fix the technical controls the law expects, not only the paperwork.
Reuse what you already have. Existing ISO 27001, SOC 2 or GDPR work is mapped to the PDPL so you do not do it twice.
Dubai-based team. We work on site with your teams across the UAE.
Ready for the Executive Regulations. Your programme is built so it can absorb the detailed rules when they are published.
Frequently asked questions
Is the UAE PDPL in force?
Yes. Federal Decree-Law No. 45 of 2021 has been in force since 2 January 2022. Its Executive Regulations had not been published as of October 2026. Once they are, organisations have six months to comply (Article 29), which the Cabinet can extend. A full programme usually takes 8 to 12 weeks, so starting before the regulations arrive is the safer path.
Who enforces the UAE PDPL?
The law names the UAE Data Office as the regulator. In June 2026 the Cabinet consolidated the Data Office into the new UAE Artificial Intelligence and Data Authority, which is expected to oversee the PDPL and finalise its Executive Regulations.
Does the PDPL apply in DIFC and ADGM?
No. DIFC and ADGM have their own data protection laws and regulators. The PDPL covers mainland UAE and free zones that do not have their own data protection law. Many groups operate in both, so we map which rules apply to each entity.
What are the penalties for breaching the PDPL?
The law does not set fine amounts itself. Article 26 leaves the violations and administrative penalties to a Cabinet decision. Be careful with figures quoted online, and remember that the larger costs are often contractual and reputational: enterprise customers and regulators increasingly ask for evidence of PDPL compliance.
Do we need a Data Protection Officer?
You need a DPO if your processing is high-risk, involves systematic evaluation of sensitive data, or covers large volumes of sensitive data (Article 10). The DPO can be an employee or an external appointee, inside or outside the UAE. We provide DPO support as a monthly service.
How long does PDPL compliance take?
A gap assessment takes 3 to 4 weeks. Full implementation for a mid-sized organisation usually takes 8 to 12 weeks, depending on the number of systems, entities and vendors involved.
We already comply with GDPR. Are we covered?
Partly. Records, rights processes and security controls carry over, but the PDPL handles consent differently, has no general legitimate-interests basis, and has its own transfer rules. Our gap assessment maps your GDPR programme to the PDPL and closes the differences.
How quickly must we report a data breach?
The law requires you to notify the regulator and affected individuals once you become aware of a breach that would affect the privacy, confidentiality or security of personal data (Article 9), but leaves the exact deadline to the Executive Regulations. Processors must tell the controller as soon as they become aware. A tested breach playbook lets you meet whatever deadline is set.
Related services
Get a clear view of your PDPL position
Tell us a little about your organisation and we will set up a free 30-minute readiness check.
What happens next
- 1We reply within one business day
- 2A 30-minute call to scope your PDPL exposure
- 3A written scope, timeline and quote
Prefer to talk now? Call +971 55 355 6787
Last reviewed: October 2026. This page is general guidance, not legal advice.
Sources: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE Legislation portal) · Data protection laws in the UAE (u.ae, the UAE Government portal)