Frequently asked questions about the UAE PDPL

Each section below gives a rule of the UAE PDPL in short, with its conditions. It also refers to the section that gives the full rule.

Disclaimer

This page gives general information. It is not legal advice.

What is the UAE PDPL?

The UAE PDPL is Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data. Article 2 gives its scope and exclusions.

In Article 31, the UAE PDPL "shall come into force as of 02 January 2022". See the dates and source information.

The Controller and Processor have a different regularization period: a maximum of six months from the issue of the Executive Regulations. The Council of Ministers "may extend such period for another similar period" (Article 29).

Who does the UAE PDPL apply to?

Article 2(1) applies the UAE PDPL to Personal Data processing through three groups, by "electronic systems which operate automatically, or by other means":

• Data Subjects "residing in the State or having a place of business in it".
• Controllers and Processors "residing in the State", for Data Subjects "inside and outside the State".
• Controllers and Processors "residing outside the State", for Data Subjects "inside the State".

Article 2(2) exclusions have different limits:

• (a) Government Data.
• (b) Governmental entities that control or process Personal Data.
• (c) Personal Data "held by the security and judicial authorities".
• (d) A Data Subject who processes the data of that Data Subject "for personal purposes".
• (e) Health data and (f) banking and credit data with legislation on their protection and processing.
• (g) Companies and establishments in free zones with special Personal Data protection legislation.

Article 3 gives the Bureau power to exempt some establishments "that do not process a large volume of Personal Data" from "part, or all of the requirements". Executive Regulation standards and controls apply. A small volume is not sufficient.

Does the UAE PDPL apply in free zones?

The UAE PDPL does not apply to "Companies and establishments located in free zones in the Country and have special legislations regarding Personal Data protection" (Article 2(2)(g)).

The exclusion applies to the "Companies and establishments" specified in Article 2(2)(g), not to the free zone as an area. It applies only if there are "special legislations regarding Personal Data protection". Article 2(2)(g) gives the name of no free zone, and no condition about which data the special legislation applies to.

Before you use this exclusion, find the special legislation for the "Companies and establishments" specified in Article 2(2)(g). If item (g) does not apply, examine the three groups of Article 2(1) and the other six exclusions.

See The Article 2(2) exclusions.

Has the UAE PDPL Executive Regulation been issued?

Check UAE Legislation for the Executive Regulations before you use a date or rule that they set. The UAE PDPL does not show if, or when, the Council of Ministers issued them.

Articles 28 and 29 give different periods:

• Article 28: issue in a maximum of six months from promulgation, by the Council of Ministers "based upon a suggestion from the General Director of the Bureau".
• Article 29: Controller and Processor regularization in a maximum of six months from issue. The Council of Ministers "may extend such period for another similar period".

The Article 31 date is different: the Decree-Law "shall come into force as of 02 January 2022" (Article 31).

Does the UAE PDPL always require consent?

No. Article 4 of the UAE PDPL gives these cases for processing without Consent, each with its conditions:

• (1) The public interest.
• (2) Data that the Data Subject made "available and known to all".
• (3) "legal claim or defense of rights", or "judicial or security procedures".
• (4) "occupational or preventive medicine".
• (5) "public health", or "safety and quality of healthcare, medicines, drugs and medical devices".
• (6) "archival purposes or for scientific, historical and statistical studies".
• (7) The "interests of the Data Subject".
• (8) Obligations and "legally established rights" of the Controller or the Data Subject in "employment, social security or laws concerned with social protection", "to the extent permitted by such Laws".
• (9) A contract with the Data Subject, or steps for a contract at the request of the Data Subject.
• (10) The "specific obligations" of the Controller in other State laws.
• (11) Other cases in the Executive Regulations.

Most cases apply only if the processing is "necessary", and cases (4) to (6) and (8) have more conditions.

If no case applies, the processing must have Consent, on the conditions of Articles 1 and 6. In Article 6(2), the Data Subject can withdraw Consent "at any time", and a withdrawal does not change the "legality" of previous processing with Consent. After a withdrawal, processing must agree with an Article 4 case.

What rights do I have under the UAE PDPL?

The UAE PDPL gives Data Subjects these rights, with request conditions and exceptions:

• Article 13: information from the Controller on request "without any consideration", with grounds to reject a request, and some information before the processing starts.
• Article 14: get the data "in an orderly and machine-readable manner" when the processing is "based on the consent of the Data Subject" or "necessary for the implementation of a contractual obligation", and is "carried out by automated means" (14(1)). Request transfer to a different Controller "whenever it is technically feasible" (14(2)).
• Article 15: correction or complete data "without undue delay", and erasure with grounds and exceptions.
• Article 16: restriction of processing, a request to "continue to keep" data for lawsuits, exceptions, and a notification when the Controller lifts the restriction.
• Article 17: stop direct marketing, Article 5 violations, or statistical surveys with the public interest exception.
• Article 18: objection to Automated Processing decisions, with exceptions, and "the human element in reviewing" them on request.
• Article 19 and Article 12(2): "ways" to contact the Controller and "communicate directly" with the DPO.

Articles 13 to 19 set no general time limit in days. Article 24 gives a procedure for Bureau complaints.

Can I ask for human review of an automated decision?

Yes. Article 18(4) of the UAE PDPL tells the Controller to "include the human element in reviewing automated processing decisions" at the Data Subject's request.

Article 18 also gives these rules:

• Objection to Automated Processing decisions, "particularly those decisions which have legal impact on or adversely affect the Data Subject" (Article 18(1)).
• Contract, legislation, and prior-Consent exceptions to objection (Article 18(2)).
• Privacy, confidentiality, and rights protection measures in those cases (Article 18(3)).

Article 18(4) does not refer to the objection exceptions in Article 18(2). Automated Processing includes processing "partially with limited human supervision and intervention" (Article 1).

When is a DPO required under the UAE PDPL?

Controllers and Processors must appoint a DPO with "sufficient skills and knowledge of the Personal Data Protection Law" when an Article 10(1) case applies:

• (a) High risk to Personal Data confidentiality and privacy from "new technologies" or data volume.
• (b) "systematic and comprehensive assessment of Sensitive Personal Data, including Profiling and Automated Processing".
• (c) Processing a large volume of Sensitive Personal Data.

Also check the Executive Regulation "types of technologies and criteria for determining the volume of data" (Article 10(4)). The Controller or Processor must "specify the contact details" of the DPO and notify the Bureau (Article 10(3)).

See Article 10.

What is the UAE PDPL breach notification deadline?

Article 9 of the UAE PDPL gives no number of days for Controller notifications. The Processor must notify the Controller of a Personal Data breach "as soon as it becomes aware" (Article 9(3)).

Article 9 refers to Controller notification periods, measures, and requirements "set by the Executive Regulations":

• Article 9(1): Bureau notification "at the time it becomes aware", with the condition on "prejudice", "data and documents", and other Bureau requirements.
• Article 9(2): a different Data Subject notification with its condition on "prejudice", and information on "the measures taken by it".
• Article 9(3): the Controller must notify the Bureau as in Article 9(1) after Processor notification.

Check the applicable Executive Regulations for the periods.

When is a data protection impact assessment required in the UAE?

Article 21 of the UAE PDPL tells the Controller to do an impact assessment before processing starts in the cases below:

• Article 21(1): "modern technologies" with high risk to Personal Data privacy and confidentiality, "Taking into account the nature, scope and purposes of data processing".
• Article 21(2)(a): "systematic and comprehensive assessment of the personal aspects" through Automated Processing, "including profiling", "having legal consequences or serious impact on the Data Subject".
• Article 21(2)(b): processing a large volume of Sensitive Personal Data.

The other Article 21 rules give the minimum contents (21(3)), and let the Controller "carry out one evaluation of a set of processing operations which have similar nature and risks" (21(4)). The Controller must "coordinate with the Data Protection Officer" (21(5)), and check the results at regular intervals "in case the processing risks level changes" (21(7)).

Article 21(6) tells the Bureau to prepare a list of the operation types for which an impact assessment is not necessary, and to "publish such list on its website". Before you use that list, make sure that it includes your type of processing operation.

Can personal data be transferred outside the UAE?

Yes, if the transfer agrees with a UAE PDPL Article 22 or Article 23 case and its conditions.

Article 22 has two cases, each "approved by the Bureau". In Article 22(1), the State or Province "to which the Personal Data is transferred" has "legislations addressing Personal Data Protection", with rules on privacy, confidentiality, and "his/her ability to exercise their legal rights". It also has a judicial authority or a regulator "imposing appropriate measures against the Controller or the Processor". In Article 22(2), the United Arab Emirates "joins a bilateral or multilateral agreement related to the protection of Personal Data" with the "countries to which the Personal Data is transferred".

Article 23(1) gives other cases:

• (a) A contract or agreement with the measures of Article 23(1)(a), in "countries where there are no laws for Data Protection".
• (b) Explicit Consent, if the transfer does "not contradict the public or security interest of the State".
• (c) to (f) A transfer that is "necessary" for a purpose in Article 23(1)(c) to (f).

Also check the Executive Regulation "controls and stipulations" in Article 23(2).

Who enforces the UAE PDPL, and what are the penalties?

The UAE PDPL gives enforcement functions to the Bureau. The UAE Government website uses the name "UAE Data Office" for the Bureau (the Bureau and the UAE Data Office). Article 26 gives the decision on violations and administrative penalties to the Council of Ministers, "based upon a suggestion from the General Director of the Bureau". The Decree-Law gives no value for a fine or other penalty. Check UAE Legislation for that decision.

The Bureau receives breach notifications (Article 9) and complaints (Article 24). It must impose penalties when a Controller or Processor violation "is proven" (Articles 9(4) and 24(3)). Article 27 gives the Council of Ministers power to "authorize any competent local government authority" to use some Bureau powers, on its conditions.

How do I complain or challenge a UAE Data Bureau decision?

The UAE PDPL gives different procedures for Data Subject complaints and stakeholder grievances.

Article 24 lets a Data Subject make a complaint to the Bureau if the Data Subject "believes" that there is a violation. This can be a violation of the Decree-Law. It can also be a violation of the Bureau rules and procedures in the processing of the Personal Data of that Data Subject.

Article 25 gives a stakeholder the right to send a written grievance to the Bureau General Director against a Bureau decision, penalty, or "other action" against that stakeholder:

• Send it in a maximum of 30 days after "notice of such administrative decision or penalty".
• A decision must follow in a maximum of 30 days after the grievance is "submitted".
• A grievance must come before a challenge to a Bureau decision "in implementation of the provisions of this Decree by Law".

Article 25 refers to the Executive Regulations for the procedures. It names no court or other authority for the challenge.

How do I use the UAE PDPL Frameworks in Modulos?

Add OFF-24 to your organization AI System. Add MFF-24 to each AI System with processing in the scope of the UAE PDPL.

First, check Article 2 scope and exclusions and Article 3. Identify your Controller or Processor role for each processing operation. If your organization does not have an organization AI System, contact Modulos.

Each Requirement has one or two UAE PDPL Role tags. See Roles and scope.

Complete the applicable work. The Requirement Owner then examines each applicable Requirement. If the Requirement Owner finds that the work agrees with that Requirement, the Requirement Owner marks that Requirement as Fulfilled. Complete the necessary notifications and agreements independently of that Review.

See Recommended AI System structure, Roles and scope, and Reviews in Modulos.

Does the UAE PDPL require a regulatory watch or readiness plan?

Articles 28 and 29 of the UAE PDPL do not make these tasks an obligation: monitor instruments, record them, or prepare for them. They also do not tell Controllers or Processors to give this work to a person or set a schedule.

Article 7(7) adds to the obligations of the Controller "Any other obligations set out in the Executive Regulations of this Decree by Law". Article 8(9) tells the Processor to "Carry out processing in accordance with rules, conditions and controls specified in this Decree by Law and its Executive Regulations, or pursuant to which instructions are issued by the Bureau".

Article 29 gives Controllers and Processors an obligation to regularize in a maximum of six months from the issue of Executive Regulations. The Council of Ministers "may extend such period for another similar period".

Modulos recommends checks of the instruments as optional work.