# Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)

- **Record type**: Policy instrument
- **Jurisdiction**: United Arab Emirates
- **Instrument type**: Act / statute
- **Status**: In force
- **Binding**: Yes
- **Issuing body**: UAE Federal Government
- **Adopted**: 2021-09-20
- **Published**: 2021-09-27
- **In force**: 2022-01-02

## In brief

The UAE PDPL is a binding act of the United Arab Emirates, issued by UAE Federal Government. It has been in force since 2 January 2022. Controllers and processors in the UAE (outside the financial free zones) and those outside the UAE processing personal data of individuals in the UAE.

## Summary

The UAE Personal Data Protection Law is the federal data-protection law applying outside the DIFC and ADGM free zones. It sets principles for lawful processing, consent and its exceptions, data-subject rights (including the right to object to automated decision-making without human intervention), controller and processor duties, security and breach notification to the UAE Data Office, cross-border transfer rules, and data protection impact assessments for high-risk processing including new technologies.

## Scope

Controllers and processors in the UAE (outside the financial free zones) and those outside the UAE processing personal data of individuals in the UAE. Government data, security bodies and health and banking data covered by other laws are excluded or partly excluded.

## Who it applies to

Organisations processing personal data of individuals in the UAE, including AI developers and deployers using such data.

## What organisations must do

Establish a lawful basis for AI data processing, provide rights including objection to automated decisions, conduct impact assessments for high-risk AI processing, secure data and notify breaches to the Data Office.

## Key dates

Issued 20 September 2021; in force 2 January 2022; compliance period runs from issuance of executive regulations (status to be confirmed).

## Penalties

Administrative penalties to be set by Cabinet decision (reviewer to confirm current position).

## Obligations recorded against this instrument (2)

- **Respect the right to object to automated decision-making without human intervention** (Article on data-subject rights relating to automated processing (reviewer to cite article number)) — Data subjects may object to decisions based solely on automated processing, including profiling, that produce legal or similarly serious effects, subject to exceptions such as contractual necessity or consent.
  - Binding: yes
  - Record: https://aipolicytracker.org/obligations/uae-pdpl-automated-decision-objection
- **Conduct a data protection impact assessment for high-risk processing using new technologies** (Article on data protection impact assessment (reviewer to cite article number)) — Before processing that uses modern technologies and is likely to pose a high risk to privacy, controllers must assess the impact on personal data protection, covering the processing, its purposes, risks and safeguards.
  - Binding: yes
  - Record: https://aipolicytracker.org/obligations/uae-pdpl-impact-assessment-new-technologies

## Dated deadlines

- 2022-01-02 — Law in force (precision: exact, status: scheduled)
- date not set — Compliance period after executive regulations (precision: tbd, status: scheduled)

## Provenance

- **Permanent id**: AIPT-POL-0192 (https://aipolicytracker.org/id/AIPT-POL-0192; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/policies/uae-personal-data-protection-law
- **Official source**: https://u.ae/en/about-the-uae/digital-uae/data/data-protection
- **Source document**: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
- **Published by**: UAE Government portal (u.ae)
- **Provision**: Article numbers to be added by reviewer
- **Review status**: verified
- **Confidence**: medium
- **Facts last confirmed**: 2026-09-26
- **Confirmed by**: Bhaskar Bhatt (see https://aipolicytracker.org/reviewers)
- **Retrieved**: 2026-10-27
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)" [AIPT-POL-0192, record version 1, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-POL-0192 (accessed 27 October 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.