UAE Data Protection Law (PDPL): A Compliance Checklist for Businesses

Who the PDPL applies to

The PDPL applies to the processing of personal data, wholly or partly through electronic means, where the data subject is located in the UAE or where the controller or processor is established in the UAE. It also reaches controllers and processors based outside the UAE if they process personal data of people inside the country. Most mainland companies and free zones without their own data protection law fall within its scope.

Core obligations for businesses

• Have a lawful basis for processing. Processing generally requires the data owner's clear consent, which must be provable, presented in an accessible way and easy to withdraw, unless an exception such as a legal claim, contract performance or public interest applies.
• Collect and secure data proportionately. Personal data should be processed fairly, limited to a specific purpose, kept accurate, protected with appropriate security measures and not retained longer than necessary.
• Keep processing records and vet processors. Controllers must maintain records of processing activities and only appoint processors that provide sufficient guarantees of compliance.
• Appoint a Data Protection Officer where required. A DPO is required for certain higher-risk processing, such as large-scale processing of sensitive data or systematic monitoring and profiling.
• Carry out data protection impact assessments. These are required before high-risk processing activities, including large-scale sensitive data processing and automated decisions with serious effects on individuals.
• Respect data subject rights. Individuals can request access, correction, erasure, restriction of processing and data portability, and can object to processing, including for direct marketing.

What falls outside the PDPL

1. Government data. Government entities and the personal data they control or process are excluded from the PDPL.
2. Security and judicial data. Personal data held by UAE security and judicial authorities falls outside the law.
3. Purely personal processing. Individuals processing personal data for purely personal purposes are not covered.
4. Health and banking data. Personal health data and personal banking or credit data are excluded where they already have their own governing legislation.
5. Regulated free zones. Companies in free zones with their own data protection regime, such as the DIFC and ADGM, follow that regime instead of the federal PDPL.

Enforcement and penalties

The UAE Data Office (established under Federal Decree-Law No. 44 of 2021, and referred to in the PDPL as the 'Bureau') receives complaints, examines them with the businesses involved and can impose administrative penalties for proven violations. A Cabinet decision sets out the specific violations and penalty amounts. A business that disagrees with a decision can file a written grievance with the Data Office within 30 days.

Common questions

Does the PDPL apply to my free zone company?

Not if your free zone has its own data protection law, such as the DIFC or ADGM. Those companies generally follow their free zone's own regime rather than the federal PDPL. Mainland companies and free zones without their own data law are generally within scope.

Do we need to appoint a Data Protection Officer?

Only in certain higher-risk situations defined by the law, such as large-scale processing of sensitive personal data or systematic monitoring and profiling of individuals. Most smaller or lower-risk businesses are not required to appoint one, but should still confirm their own position.

What should we do if we have a data breach?

Notify the UAE Data Office of any breach that threatens the privacy or security of personal data, and notify the affected individuals where the breach is likely to prejudice their privacy. Processors must alert the controller without delay. Acting quickly and keeping a clear record of the breach and the response matters.

Disclaimer: This article provides general legal information for awareness and is not legal advice on a particular matter. Laws, procedures and outcomes depend on the facts, jurisdiction and applicable legal framework. It does not create a lawyer client relationship. Please verify the current official source and seek appropriately scoped advice before acting.