Docs

Appearance

UAE PDPL ​

UAE PDPL illustration

The UAE PDPL is Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data of the United Arab Emirates. The law has Articles 1 to 31. The UAE Government website also uses the name "Personal Data Protection Law" for it.

UAE PDPL obligations ​

The UAE PDPL gives obligations to the Controller and to the Processor, and it gives rights to the Data Subject. Each group of Articles has a page that gives its rules:

  • The scope (Articles 1 to 3) — For scope, exclusions, and the Bureau's exemption power, see Articles 1 to 3.
  • Consent and processing (Articles 4 to 6) — For processing without Consent, processing controls, and Consent conditions, see Articles 4 to 6.
  • The rights of the Data Subject (Articles 13 to 19) — For Data Subject rights, the "human element in reviewing automated processing decisions" on request, and Controller contact obligations, see Articles 13 to 19.
  • Controllers, Processors, and the Data Protection Officer (DPO) (Articles 7, 8, and 10 to 12) — For Controller and Processor obligations and DPO rules, see Articles 7, 8, and 10 to 12.
  • Information security and breaches (Articles 9 and 20) — For Personal Data Security obligations and breach notification rules for Controllers and Processors, see Articles 9 and 20.
  • Impact assessment and transfer (Articles 21 to 23) — For Controller impact assessment obligations and cross-border transfer conditions, see Article 21 and Articles 22–23.
  • Enforcement (Articles 24 to 26) — For Data Subject complaints, stakeholder grievances, and administrative penalties, see Articles 24–25 and Article 26.

Dates ​

The UAE PDPL has these dates:

  • The date of issue on the UAE Legislation website is 20 September 2021.
  • The UAE PDPL is in the Official Gazette No. 712 of 26 September 2021.
  • Article 31 tells Controllers, Processors, and Data Subjects that the UAE PDPL "shall come into force as of 02 January 2022".

Article 30 repeals "Any provision that violates or contradicts the provisions of this Decree by Law".

For Executive Regulations and Controller and Processor regularization obligations, see Articles 28–29.

Check the UAE Legislation website for the Executive Regulations and for the decisions of the Council of Ministers. Do this before you use a date or a rule from them.

How to use Modulos ​

Modulos has two Frameworks with the name "UAE PDPL". OFF-24 is for the organization AI System, and MFF-24 is for each AI System that processes Personal Data in the scope of the UAE PDPL. For the decisions on scope and roles, the steps, and the Requirement table, see UAE PDPL in Modulos.

Where to go next ​

Controllers, Processors, and Data Subjects can use these pages for the UAE PDPL rules:

Scope, enforcement, and the Executive Regulation

Article 1, the scope and its exclusions, the complaints and grievances, the penalties, and the Executive Regulations.

Lawful processing and data subject rights

Processing without Consent, the controls for processing, the conditions for Consent, and the rights of the Data Subject.

Controllers, Processors, and the Data Protection Officer

The obligations of the Controller and the Processor, their records, and the rules for the DPO.

Security, breaches, impact assessment, and cross-border transfers

Information security, breach notification, the impact assessment, and the transfer of Personal Data out of the State.

UAE PDPL in Modulos

The two Frameworks, the decisions on scope and roles, the sequence of work, and the Requirement table.

UAE PDPL FAQ ​

Controllers, Processors, and Data Subjects can use the UAE PDPL FAQ to find the rules and the pages for each rule.

Sources ​

Controllers, Processors, and Data Subjects can find the UAE PDPL and the UAE Government page here:

  • The UAE PDPL, Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, on the UAE Legislation website. Official Gazette No. 712 of 26 September 2021. Articles used: 1 to 31. The website adds: "In case of conflict, the Arabic text will prevail".
  • The UAE Government website, page "Data protection laws" with the date 4 December 2025: the sections "Personal Data Protection Law" and "UAE Data Office".

Disclaimer

This page gives general information. It is not legal advice.