United Arab Emirates. Comprehensive data protection. Federal Decree-Law
UAE PDPLFederal Decree-Law No. 45 of 2021 on the Protection of Personal Data
Partly verified
Medium confidence.Executive Regulations and penalties decision not verified as issued; market-quoted fine figures (AED 50k–5m) could not be traced to a primary source. Text URL on uaelegislation.gov.ae assumed from portal pattern; Arabic PDF also on u.ae assets.
§1Summary
- Synopsis
The onshore federal data protection law for the UAE, setting consent as the default lawful basis with listed exceptions, data subject rights, security duties and restrictions on transfers abroad. Much of the operational detail is left to Executive Regulations which have not yet been issued, so enforcement has been minimal.
- Key themes
- Unique features
Excludes government data, health data and banking/credit data already covered by their own laws, and does not apply in the DIFC and ADGM free zones. Penalties are to be fixed by a Cabinet decision rather than in the law itself.
- SaaS relevance
Applies to controllers and processors outside the UAE that process data of people in the UAE, so a SaaS serving UAE users is in scope even without local presence.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Data Office promptly on awareness (procedure to be set by Executive Regulations); data subjects in some cases
- DPO
- Conditional
- Cross-border transfers
- Adequacy (Data Office-approved countries) or listed exceptions/contracts; details await Executive Regulations
- Maximum penalty
- To be set by Cabinet decision (not yet published)
§3Dates
- Key dates
- Adopted
- In force
- Issued Sept 2021; in force 2 Jan 2022; Executive Regulations (due within 6 months) still unpublished as of 2026; Cabinet penalty decision not published
§4Text and authority
- Text
- Authoritative text uaelegislation.gov.ae
- Authority
- UAE Data Office
§5Where it applies
- Domestic law of
- United Arab Emirates
- Also applies in
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Executive Regulations and penalties decision not verified as issued; market-quoted fine figures (AED 50k–5m) could not be traced to a primary source. Text URL on uaelegislation.gov.ae assumed from portal pattern; Arabic PDF also on u.ae assets.