UAE PDPL: requirements, deadlines and compliance actions
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 9 sections
In brief
The UAE PDPL is a binding act of the United Arab Emirates, issued by UAE Federal Government. It has been in force since 2 January 2022. Controllers and processors in the UAE (outside the financial free zones) and those outside the UAE processing personal data of individuals in the UAE.
- Jurisdiction
- United Arab Emirates
- Instrument type
- Act / statute
- Status
- In force
- Legal force
- Binding
- Issuing body
- UAE Federal Government
- Adopted
- 20 September 2021
- Published
- 27 September 2021
- In force
- 2 January 2022
- Obligations recorded
- 2
- Source reference
- Article numbers to be added by reviewer
- Verification
- Verified against the official source 26 Sep 2026
What is the UAE PDPL?
The UAE Personal Data Protection Law is the federal data-protection law applying outside the DIFC and ADGM free zones. It sets principles for lawful processing, consent and its exceptions, data-subject rights (including the right to object to automated decision-making without human intervention), controller and processor duties, security and breach notification to the UAE Data Office, cross-border transfer rules, and data protection impact assessments for high-risk processing including new technologies.
Status note: In force since 2 January 2022. Executive regulations that trigger the compliance period for organisations had not been confirmed as issued at the last check; a reviewer must confirm their status.
Who does it apply to?
Controllers and processors in the UAE (outside the financial free zones) and those outside the UAE processing personal data of individuals in the UAE. Government data, security bodies and health and banking data covered by other laws are excluded or partly excluded.
Organisations processing personal data of individuals in the UAE, including AI developers and deployers using such data.
When do the requirements apply?
Issued 20 September 2021; in force 2 January 2022; compliance period runs from issuance of executive regulations (status to be confirmed).
| Date | Milestone | Source reference | Status |
|---|---|---|---|
| Law in force Entry into force. |
— | Passed | |
| Depends on issuance of executive regulations (to be confirmed) | Compliance period after executive regulations Reviewer to confirm whether executive regulations have been issued. |
— | Tbd confidence: low |
What must organisations do?
Establish a lawful basis for AI data processing, provide rights including objection to automated decisions, conduct impact assessments for high-risk AI processing, secure data and notify breaches to the Data Office.
Each duty is one line: open it for the summary, practical action and evidence, or go to its own page.
Legal requirement Respect the right to object to automated decision-making without human intervention Deployer / user organisation
Data subjects may object to decisions based solely on automated processing, including profiling, that produce legal or similarly serious effects, subject to exceptions such as contractual necessity or consent.
Practical action: Provide a human-review route for significant automated decisions affecting UAE residents.
Evidence examples: Automated decision objection procedure
Framework mapping (original, editorial): NIST AI RMF 1.0 GOVERN 5.x, MANAGE 4.x
Open the obligation page →Article on data-subject rights relating to automated processing (reviewer to cite article number) Pending review (a factual check against the official source, not a legal review)
Legal requirement Conduct a data protection impact assessment for high-risk processing using new technologies Provider / developer, Deployer / user organisation
Before processing that uses modern technologies and is likely to pose a high risk to privacy, controllers must assess the impact on personal data protection, covering the processing, its purposes, risks and safeguards.
Practical action: Run a DPIA for AI systems processing personal data of UAE residents and keep it on file.
Evidence examples: Data protection impact assessment
Framework mapping (original, editorial): ISO/IEC 42001:2023 Clause 6.1.4 AI system impact assessment
Open the obligation page →Article on data protection impact assessment (reviewer to cite article number) Pending review (a factual check against the official source, not a legal review)
What are the penalties?
Administrative penalties to be set by Cabinet decision (reviewer to confirm current position).
Official sources
-
Data protection — UAE Government portal (Federal Decree-Law No. 45 of 2021)
UAE Government · 20 Sep 2021 · Tier 1 source
Cite this record
AIPolicyTracker (2026). “UAE PDPL” [AIPT-POL-0192, record version 1, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-POL-0192 (accessed 27 October 2026). Data licensed CC BY 4.0.
Permanent id AIPT-POL-0192: it never changes or gets reused, and its address keeps working if this page moves.
Cite the official text alongside it: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, UAE Government portal (u.ae), https://u.ae/en/about-the-uae/digital-uae/data/data-protection.
BibTeX
@misc{aipolicytracker2026_uaepdpl,
author = {{AIPolicyTracker}},
title = {{UAE PDPL}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/policies/uae-personal-data-protection-law}},
url = {https://aipolicytracker.org/policies/uae-personal-data-protection-law},
urldate = {2026-10-27},
note = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
Add a status badge to your site or README
It shows the status and review state as recorded here and updates when the record does.
Markdown
[](https://aipolicytracker.org/id/AIPT-POL-0192)HTML
<a href="https://aipolicytracker.org/id/AIPT-POL-0192"><img src="https://aipolicytracker.org/badges/uae-personal-data-protection-law.svg" alt="AIPolicyTracker: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL), In force · verified 26 Sep 2026" height="20"></a>Change history
Record history
No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.
Record version 1: Initial structured record; executive-regulation status unverified. Every earlier wording is in the GitHub repository.
Frequently asked questions
Is the UAE PDPL in force?
Yes. The UAE PDPL is in force since 2 January 2022.
Is the UAE PDPL legally binding?
Yes. The UAE PDPL is a binding act / statute; the obligations it creates are legal requirements for the actors it covers.
Who does the UAE PDPL apply to?
Controllers and processors in the UAE (outside the financial free zones) and those outside the UAE processing personal data of individuals in the UAE. Government data, security bodies and health and banking data covered by other laws are excluded or partly excluded.
When does the UAE PDPL apply?
Issued 20 September 2021; in force 2 January 2022; compliance period runs from issuance of executive regulations (status to be confirmed).
What must organisations do under the UAE PDPL?
Establish a lawful basis for AI data processing, provide rights including objection to automated decisions, conduct impact assessments for high-risk AI processing, secure data and notify breaches to the Data Office.
What are the penalties under the UAE PDPL?
Administrative penalties to be set by Cabinet decision (reviewer to confirm current position).
Where is the official text of the UAE PDPL?
The official text is published by UAE Government portal (u.ae) at https://u.ae/en/about-the-uae/digital-uae/data/data-protection (Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data). This record links to it and is checked against it.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.