# Conduct a data protection impact assessment for high-risk processing using new technologies

- **Record type**: Obligation
- **Instrument**: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
- **Jurisdiction**: United Arab Emirates
- **Category**: impact_assessment
- **Binding**: Yes
- **Provision**: Article on data protection impact assessment (reviewer to cite article number)

## In brief

Conduct a data protection impact assessment for high-risk processing using new technologies is a legal requirement under the UAE PDPL in the United Arab Emirates (Article on data protection impact assessment (reviewer to cite article number)). The record carries 1 evidence example and mappings to 1 framework.

## What the duty requires

Before processing that uses modern technologies and is likely to pose a high risk to privacy, controllers must assess the impact on personal data protection, covering the processing, its purposes, risks and safeguards.

## What an organisation does about it

Run a DPIA for AI systems processing personal data of UAE residents and keep it on file.

## Controls that meet this duty

- Privacy and data-protection controls for AI (satisfies): https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai
- AI impact and fundamental-rights impact assessment (supports): https://aipolicytracker.org/controls/ai-impact-assessment

## Parent instrument

- Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
  - Record: https://aipolicytracker.org/policies/uae-personal-data-protection-law
  - Context file: https://aipolicytracker.org/policies/uae-personal-data-protection-law.md

## Provenance

- **Permanent id**: AIPT-OBL-0071 (https://aipolicytracker.org/id/AIPT-OBL-0071; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/obligations/uae-pdpl-impact-assessment-new-technologies
- **Official source**: https://u.ae/en/about-the-uae/digital-uae/data/data-protection
- **Provision**: Article on data protection impact assessment (reviewer to cite article number)
- **Review status**: pending review
- **Confidence**: medium
- **Facts last confirmed**: never confirmed against the official source
- **Retrieved**: 2026-10-27
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "Conduct a data protection impact assessment for high-risk processing using new technologies (UAE PDPL)" [AIPT-OBL-0071, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0071 (accessed 27 October 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.