Privacy Map

Middle East. National jurisdiction.

United Arab Emirates AE

Primary authority: UAE Data Office
Part I

Domestic law

2 of 5 sub-national jurisdictions have their own comprehensive law in this dataset. Federal law below applies in all of them.

Show the sub-national jurisdictions

Comprehensive data protection2

  • Data Office LawFederal Decree-Law No. 44 of 2021 on the Establishment of the UAE Data OfficeIn force
    In force from     Creates the UAE Data Office as the federal regulator for personal data protection, giving it powers to issue policies, approve adequate jurisdictions, receive complaints and oversee PDPL compliance.
    Synopsis

    Creates the UAE Data Office as the federal regulator for personal data protection, giving it powers to issue policies, approve adequate jurisdictions, receive complaints and oversee PDPL compliance.

    Key themes
    • supervisory authority
    • complaints
    • adequacy decisions
    • guidance
    Unique features

    The office still appears to be in set-up; the government portal describes its role prospectively.

    SaaS relevance

    Determines who will supervise and enforce PDPL obligations against SaaS providers once operational.

    Key dates
    • Adopted
    • In force
    Text
    Authority
    UAE Data Office
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. In-force date assumed to align with PDPL; exact issue date not verified. [Link: Official UAE federal legislation portal]

    Full record for Data Office Law
    Partly verifiedMedium confidence. In-force date assumed to align with PDPL; exact issue date not verified. [Link: Official UAE federal legislation portal]
  • UAE PDPLFederal Decree-Law No. 45 of 2021 on the Protection of Personal DataIn force
    In force from     The onshore federal data protection law for the UAE, setting consent as the default lawful basis with listed exceptions, data subject rights, security duties and restrictions on transfers abroad. Much of the operational detail is left to Executive Regulations which have not yet been issued, so enforcement has been minimal.
    Synopsis

    The onshore federal data protection law for the UAE, setting consent as the default lawful basis with listed exceptions, data subject rights, security duties and restrictions on transfers abroad. Much of the operational detail is left to Executive Regulations which have not yet been issued, so enforcement has been minimal.

    Key themes
    • consent
    • lawful bases
    • data subject rights
    • DPO
    • breach notification
    • records of processing
    • cross-border transfers
    • automated processing
    Unique features

    Excludes government data, health data and banking/credit data already covered by their own laws, and does not apply in the DIFC and ADGM free zones. Penalties are to be fixed by a Cabinet decision rather than in the law itself.

    SaaS relevance

    Applies to controllers and processors outside the UAE that process data of people in the UAE, so a SaaS serving UAE users is in scope even without local presence.

    Extraterritorial
    Yes
    Breach notification
    Data Office promptly on awareness (procedure to be set by Executive Regulations); data subjects in some cases
    DPO
    Conditional
    Cross-border transfers
    Adequacy (Data Office-approved countries) or listed exceptions/contracts; details await Executive Regulations
    Maximum penalty
    To be set by Cabinet decision (not yet published)
    Key dates
    • Adopted
    • In force
    • Issued Sept 2021; in force 2 Jan 2022; Executive Regulations (due within 6 months) still unpublished as of 2026; Cabinet penalty decision not published
    Text
    Authority
    UAE Data Office
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Executive Regulations and penalties decision not verified as issued; market-quoted fine figures (AED 50k–5m) could not be traced to a primary source. Text URL on uaelegislation.gov.ae assumed from portal pattern; Arabic PDF also on u.ae assets.

    Full record for UAE PDPL
    Partly verifiedMedium confidence. Executive Regulations and penalties decision not verified as issued; market-quoted fine figures (AED 50k–5m) could not be traced to a primary source. Text URL on uaelegislation.gov.ae assumed from portal pattern; Arabic PDF also on u.ae assets.

ePrivacy / marketing1

  • Consumer Protection LawFederal Law No. 15 of 2020 on Consumer ProtectionIn force
    General consumer protection statute which includes a duty on suppliers to protect consumer data and a prohibition on using it for marketing purposes without consent.
    Synopsis

    General consumer protection statute which includes a duty on suppliers to protect consumer data and a prohibition on using it for marketing purposes without consent.

    Key themes
    • consumer data
    • marketing
    • confidentiality
    Unique features

    Listed by the UAE government as part of the national data protection framework.

    SaaS relevance

    Relevant to B2C SaaS using customer data for promotional purposes in the UAE.

    DPO
    No
    Key dates
    • Adopted
    Text
    Authority
    Ministry of Economy
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Detail limited to UAE portal description.

    Full record for Consumer Protection Law
    Partly verifiedMedium confidence. Detail limited to UAE portal description.

Health data1

  • ICT Health LawFederal Law No. 2 of 2019 on the Use of Information and Communication Technology in Health FieldsIn force
    In force from     Regulates the electronic handling of health information by healthcare providers, insurers, claims managers and health-tech service providers, including a central medical records system, confidentiality and retention duties. Article 13 imposes a general health-data localisation rule.
    Synopsis

    Regulates the electronic handling of health information by healthcare providers, insurers, claims managers and health-tech service providers, including a central medical records system, confidentiality and retention duties. Article 13 imposes a general health-data localisation rule.

    Key themes
    • health data
    • localisation
    • retention
    • confidentiality
    • central health records
    Unique features

    Health data may not be stored, processed, generated or transferred outside the UAE except in cases set by health authorities (Resolution 51/2021: overseas treatment, labs, research, insurance, pharmacovigilance, personal devices etc.). Applies across the UAE including free zones; records kept for at least 25 years.

    SaaS relevance

    Any SaaS providing electronic services in the medical field to UAE health entities must host health data in the UAE unless an exception applies.

    Extraterritorial
    Limited
    DPO
    No
    Cross-border transfers
    Localisation: health data stays in UAE save Resolution 51/2021 exceptions (often with consent, encryption and an in-country copy)
    Key dates
    • Adopted
    • In force
    • Cabinet Resolution 32/2020 implementing regulations (22 Apr 2020); Ministerial Resolution 51/2021 transfer exceptions (issued 28 Apr 2021, in force 16 May 2021)
    Text
    Authority
    Ministry of Health and Prevention (MOHAP) and emirate health authorities (DOH Abu Dhabi, DHA)
    Sources consulted
    Verification

    High confidence.

    25-year retention from Lex Mundi (2022) summary.

    Full record for ICT Health Law

Cybersecurity1

  • Cybercrime LawFederal Decree-Law No. 34 of 2021 on Combatting Rumours and CybercrimesIn force
    In force from     Criminal law covering unauthorised access, misuse of electronic data and online invasion of privacy, including unlawful collection or processing of personal data and capturing or publishing images of people without consent. In the absence of PDPL penalties, it is the main source of sanctions for privacy breaches onshore.
    Synopsis

    Criminal law covering unauthorised access, misuse of electronic data and online invasion of privacy, including unlawful collection or processing of personal data and capturing or publishing images of people without consent. In the absence of PDPL penalties, it is the main source of sanctions for privacy breaches onshore.

    Key themes
    • unauthorised access
    • unlawful processing of personal data
    • invasion of privacy
    • financial data
    • spam/e-marketing
    Unique features

    Article 13 criminalises unlawful collection, storage or processing of personal data (detention and/or AED 50,000–500,000); Articles 44–45 cover online privacy invasion.

    SaaS relevance

    Exposes SaaS operators and staff to criminal liability for unlawful data handling or security failings affecting UAE data.

    Extraterritorial
    Limited
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    Imprisonment and fines up to AED 5m depending on offence
    Key dates
    • Adopted
    • In force
    • Gazette No. 712 (Supp.) 26 Sept 2021; amended once (page updated 2024-04-04)
    Text
    Authority
    Public Prosecution / Police (criminal enforcement)
    Sources consulted
    Verification

    High confidence.

    Article-level figures from DLA Piper summary.

    Full record for Cybercrime Law
Part II

Regional & international frameworks

Membership-based — check ratification status in the instrument record. 5 instruments from 1 bodies.

United Nations

  • UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified
    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
    Synopsis

    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.

    Key themes
    • cybercrime offences
    • e-evidence
    • production orders
    • data preservation
    • mutual legal assistance
    • human rights safeguards
    Unique features

    It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.

    SaaS relevance

    Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.

    Extraterritorial
    Limited
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Cooperation channels for electronic evidence
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
    Text
    Authority
    UNODC (secretariat); Conference of the States Parties once in force
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.

    Full record for UN Cybercrime Convention
    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
  • Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force
    In force from     This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
    Synopsis

    This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.

    Key themes
    • surveillance
    • interception
    • AI and privacy
    • encryption
    • business responsibility
    • remedies
    Unique features

    The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.

    SaaS relevance

    These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
    Text
    Authority
    Office of the UN High Commissioner for Human Rights (OHCHR) reports; UN Special Rapporteur on the right to privacy
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.

    Full record for Right to privacy in the digital age
    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
  • ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force
    In force from     This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
    Synopsis

    This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.

    Key themes
    • right to privacy
    • state obligations
    • legality
    • arbitrariness
    • individual communications
    Unique features

    It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.

    SaaS relevance

    It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None (treaty-body views; no fines)
    Key dates
    • Adopted
    • In force
    • Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
    Text
    Authority
    UN Human Rights Committee (treaty body)
    Sources consulted
    Verification

    High confidence.

    The party count is approximate and was not re-checked against the UN Treaty Collection.

    Full record for ICCPR Art 17
  • UDHR Art 12Universal Declaration of Human Rights, Article 12In force
    In force from     Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
    Synopsis

    Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.

    Key themes
    • right to privacy
    • correspondence
    • reputation
    • protection of the law
    Unique features

    Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.

    SaaS relevance

    Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Proclaimed by the UN General Assembly in Paris on 10 December 1948
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    The CIPP/E project holds a copy (1948UDHR.pdf).

    Full record for UDHR Art 12
  • UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force
    In force from     Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
    Synopsis

    Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.

    Key themes
    • fair information principles
    • sensitive data
    • access
    • security
    • supervisory authority
    • transborder flows
    Unique features

    Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.

    SaaS relevance

    Gives no direct obligations; it is historical background to UN-system data protection policies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Free flow to states with comparable safeguards
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.

    Full record for UN Guidelines 1990
    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.