Appearance
Scope, enforcement, and the Executive Regulation
The UAE PDPL (Federal Decree-Law No. 45 of 2021) is a law of the United Arab Emirates on the protection of Personal Data. This page gives the definitions in Article 1 of the UAE PDPL and its scope in Articles 2 and 3. It also gives the provisions on complaints, grievances, and penalties in Articles 24 to 26, and on the Executive Regulations in Articles 27 to 29. The UAE PDPL page gives the dates of the law.
Article 1 — Definitions
Article 1 of the UAE PDPL gives the definitions for the Decree-Law, "unless the context otherwise requires". This section gives these definitions:
State: The United Arab Emirates
Data: An organized or unorganized set of data, facts, concepts, instructions, observations or measurements in the form of numbers, letters, words, symbols, images, videos, signs, sounds, maps or any other form. It is interpreted, exchanged or processed by individuals or computers. It includes information wherever it appears herein.
Personal Data: Any data related to a specific natural person or related to a natural person that can be identified directly or indirectly by linking the data, through the use of identification elements such as his/her name, voice, image, identification number, his/her electronic identifier, his/her geographical location, or by one or more physical, physiological, economic, cultural or social characteristics. It includes Sensitive Personal Data and Biometric Data
Sensitive Personal Data: Any data which directly or indirectly reveals a natural person's family, ethnic origin, political or philosophical opinions, religious beliefs, criminal record, biometric data, or any data relating to such person's health and physical, psychological, mental, genetic or sexual condition, including information related to the provision of healthcare services to him/her which reveals his/her health status
Biometric Data: Personal Data resulting from processing using a specific technology related to the physical, physiological or behavioral characteristics of the Data Subject, which allows the identification or confirmation of the unique identification of the Data Subject, such as facial images or fingerprints
Data Subject: A Natural Person who is the subject of Personal Data
Establishment: Any individual company or establishment located inside or outside the State, including companies wholly owned by the federal or the local government, or in which they are shareholders
Processing: Any operation or set of operations performed on Personal Data using any electronic means, including processing and other means. This processing includes collecting, storing, recording, organizing, adapting, modifying, circulating, altering, retrieving, exchanging, sharing, using, characterizing, disclosing Personal Data by broadcasting, transmitting, distributing, making available, coordinating, merging, restricting, blocking, erasing or destroying it or creating forms thereof
The Processing definition includes "other means". Article 2(1) also applies the UAE PDPL to processing "by other means". Thus the UAE PDPL also applies to processing that does not use "electronic systems which operate automatically".
Datasets for an AI System can contain Sensitive Personal Data, for example biometric data or "any data relating to such person's health". Sensitive Personal Data is a condition in two of the cases in Article 10(1) where Controllers and Processors must have a Data Protection Officer. It is also a condition in one of the cases in Article 21(2) where an impact assessment is necessary.
Other pages give the other definitions of Article 1:
- Controller, Processor, and Data Protection Officer are on the page Controllers, Processors, and the Data Protection Officer.
- Consent, Automated Processing, Profiling, and Anonymization are on the page Lawful Processing and Data Subject Rights.
- Personal Data Security, "Pseudonymisation", Data Breach, and Cross-Border Processing are on the page Security, Breaches, Impact Assessment, and Cross-Border Transfers.
The Bureau and the UAE Data Office
In Article 1 of the UAE PDPL, the "Office" is "The UAE Data Bureau established under the aforementioned Federal Decree by Law No. (44) of 2021". Before Article 1, the UAE PDPL gives the name of that instrument: "Federal Decree by Law No. (44) of 2021 on the Establishment of the UAE Data Office". The UAE Government website also uses the name "UAE Data Office". The articles of the UAE PDPL use the name "Bureau", and this page also uses that name.
The UAE PDPL gives functions to the Bureau. These functions include:
| Function | Provision |
|---|---|
| It is permitted to exempt some establishments from part or all of the requirements, on the conditions of Article 3. | Article 3 |
| It receives the Controller and Processor special records on request. | Articles 7(4) and 8(7) |
| It receives information from the Controller on request, with the "competent judicial authority" decision condition in Article 7(6). | Article 7(6) |
| It receives breach notifications from the Controller. It must "verify the reasons for the violation". It must impose penalties when a violation "is proven". | Article 9(1), (3), and (4) |
| It receives DPO "contact details" from the Controller or the Processor. | Article 10(3) |
| It receives and examines complaints from Data Subjects. It must impose penalties when a violation "is proven". | Article 24 |
| The General Director of the Bureau receives written grievances against the Bureau. | Article 25 |
| The General Director of the Bureau makes "a suggestion" to the Council of Ministers for the penalties decision, an authorization, and the Executive Regulations. | Articles 26, 27, and 28 |
Article 2 — Scope of application
Article 2(1) of the UAE PDPL applies the Decree-Law "to the processing of all or part of the Personal Data by means of electronic systems which operate automatically, or by other means". Article 2(1) gives three items:
- The first item: "Each Data Subject residing in the State or having a place of business in it."
- Article 2(1)(b): "Each Controller or Processor residing in the State and carrying out the activities of processing Personal Data of Data Subjects inside and outside the State."
- Article 2(1)(c): "Each Controller or Processor residing outside the State and carrying out the activities of processing Personal Data of Data Subjects inside the State."
Article 2(1)(c) has only two conditions. The Controller or Processor is "residing outside the State", and it processes "Personal Data of Data Subjects inside the State". Article 2 gives no other condition for this item. The Article 1 definition of Personal Data also gives no condition about the location of the data.
The Article 2(2) exclusions
Article 2(2) of the UAE PDPL gives the items that the Decree-Law does not apply to. Each item has its limits:
| Item | Article 2(2) | Limit |
|---|---|---|
| (a) | "Government Data" | The data. Item (b) is about governmental entities. |
| (b) | "Governmental entities which control or process Personal Data." | Governmental entities. Item (a) is about the data. |
| (c) | "Personal Data held by the security and judicial authorities" | Only the Personal Data that these authorities hold. |
| (d) | "A Data Subject who processes his/her data for personal purposes." | Only a Data Subject who processes the data of that Data Subject "for personal purposes". |
| (e) | "Personal Health Data that has legislation regulating its protection and processing." | Only if there is "legislation regulating its protection and processing". |
| (f) | "Personal banking and credit data and information that have legislation regulating their protection and processing." | Only if there is "legislation regulating their protection and processing". |
| (g) | "Companies and establishments located in free zones in the Country and have special legislations regarding Personal Data protection." | Only the "Companies and establishments" that item (g) names. Article 2(2) names no free zone. |
Article 2(2) names no law for items (e) and (f).
Before you use item (e) or (f), find if there is "legislation regulating its protection and processing" for that data.
Item (g) applies to "Companies and establishments". It does not apply to a free zone as an area. Item (g) also gives no condition about which data the special legislation applies to.
Article 3 — the Bureau's exemption power
Article 3 of the UAE PDPL gives the Bureau the power to exempt some establishments:
Without prejudice to any other competencies prescribes for the Bureau under any other legislation, the Bureau may exempt some establishments that do not process a large volume of Personal Data from part, or all of the requirements of the personal data protection provisions stipulated in this Decree by Law, in accordance with the standards and controls set by the Executive Regulations of this Decree by Law.
An Article 3 exemption is a decision of the Bureau. A small volume of Personal Data is not sufficient for an exemption. Article 3 has these conditions:
- The establishment does "not process a large volume of Personal Data".
- The Bureau is permitted to give the exemption, from part or all of the requirements.
- The exemption follows "the standards and controls set by the Executive Regulations of this Decree by Law".
Before you use an Article 3 exemption, find the standards on the UAE Legislation website. Also make sure that the Bureau gave an exemption to your establishment.
Articles 24–25 — Complaints and grievances
Articles 24 and 25 of the UAE PDPL are about two different procedures. In Article 24, a Data Subject can make a complaint to the Bureau. In Article 25, a stakeholder can make a grievance against a decision, penalty, or other "action taken by the Bureau".
Complaints by a Data Subject, Article 24
Article 24(1) of the UAE PDPL gives the Data Subject the right to make a complaint to the Bureau in one of these conditions:
- The Data Subject "believes that there is a violation of this Decree by Law".
- The Data Subject "believes" that the Controller or the Processor "is processing his/ her Personal Data in violation of the rules and procedures set by the Bureau in this regard".
In Article 24(2), the Bureau must receive these complaints. The Bureau must examine them "in coordination with the Controller and the Processor". Article 24(3) also tells the Bureau to impose administrative penalties. The section Article 26 gives the condition.
The Controller must give the Data Subject "clear and appropriate ways" to contact the Controller about the rights of the Data Subject (Article 19). The Data Subject can also contact the Data Protection Officer directly (Article 12(2)).
Grievances against the Bureau, Article 25
Article 25 of the UAE PDPL gives these rules for grievances against the Bureau:
- Who — "Any stakeholder" is permitted to make a written grievance to the General Director of the Bureau.
- Grievance against — "any decision or administrative penalty or any other action taken by the Bureau against such stakeholder".
- Time limit for the grievance — maximum 30 days after "the date on which a notice of such administrative decision or penalty is given".
- Time limit for the decision — maximum 30 days after "the date on which the complaint is submitted".
- Before a challenge — a challenge to a decision that the Bureau issued "in implementation of the provisions of this Decree by Law" is not permitted before a grievance against that decision. Article 25 does not name a court or other authority for the challenge.
- Procedures — the Executive Regulations give the procedures to make a grievance and to make a decision on it.
Article 26 — administrative penalties
Article 26 of the UAE PDPL gives the Council of Ministers the obligation to issue the decision on violations and penalties:
The Council of Ministers, based upon a suggestion from the General Director of the Bureau, shall issue a decision to limit the actions which constitute a violation of this Decree by Law and its Executive Regulations, including administrative penalties to be imposed.
No article of the UAE PDPL gives the value of a fine or other penalty. The violations and the administrative penalties come from the decision of the Council of Ministers. Before you use a violation or a penalty value from that decision, find the decision on the UAE Legislation website.
Two articles tell the Bureau to impose the Article 26 administrative penalties:
- Article 9(4) — After the Bureau receives a breach notification from the Controller, it must "verify the reasons for the violation to ensure the integrity of the security measures taken". It must impose the penalties "in the event that a violation of its provisions and decisions issued in implementation of it is proven against the Controller or the Processor".
- Article 24(3) — The Bureau must impose the penalties "if it is proven that the Controller or the Processor violates its provisions, or the decisions issued in implementation of the same".
The breach notification obligations of the Controller and the Processor are on the page Security, Breaches, Impact Assessment, and Cross-Border Transfers.
Articles 27–29 — Authorization, the Executive Regulation, and regularization
Articles 27 to 29 of the UAE PDPL give a power and an obligation to the Council of Ministers. They also give a regularization obligation to Controllers and Processors. The time limits in Article 28 and in Article 29 start on different dates.
Article 27 — Authorization
Article 27 of the UAE PDPL gives a power to the Council of Ministers:
The Council of Ministers, based upon a suggestion from the General Director of the Bureau, may authorize any competent local government authority within the scope of its local competence, to exercise some of the Bureau' powers set out in this Decree by Law.
Article 27 gives no obligation to Controllers or Processors.
Article 28 — The Executive Regulation
Article 28 of the UAE PDPL gives the Council of Ministers an obligation with a time limit:
The Council of Ministers, based upon a suggestion from the General Director of the Bureau, shall issue the Executive Regulations of this Decree by Law within six (6) months as of the date on which the Decree by Law is promulgated.
The six months in Article 28 start on the date of promulgation of the Decree-Law. Article 28 does not show if the Council of Ministers issued the Executive Regulations, or when. Find the Executive Regulations on the UAE Legislation website.
Other UAE PDPL articles refer to rules in the Executive Regulations, the Bureau list, or Bureau approval. The table below gives examples. The page for each article gives its conditions:
| Provision | Item | Page |
|---|---|---|
| Article 4(11) | "Any other cases set out in the Executive Regulations" for processing without Consent | Article 4 |
| Article 5(8) | "Any other controls set out in the Executive Regulations" for processing | Article 5 |
| Article 7(7) | "Any other obligations set out in the Executive Regulations" for the Controller | Article 7 |
| Article 8(11) | "the procedures, controls, conditions, and technical standards" for the obligations of the Processor | Article 8 |
| Article 9(1) and (2) | The period, measures, and requirements of the breach notifications of the Controller | Article 9 |
| Article 10(4) | "the types of technologies and criteria for determining the volume of data" for a Data Protection Officer | Article 10 |
| Article 11(1)(e) | "Any other tasks or powers which are determined in accordance with the Executive Regulations" for a Data Protection Officer | Article 11 |
| Article 15(3)(d) | "Any other cases determined by the Executive Regulation" where erasure is not available | Article 15 |
| Article 21(6) | The Bureau list of processing operation types for which an impact assessment is not necessary | Article 21 |
| Article 22 | The approval of the Bureau for the cases of cross-border transfer | Articles 22–23 |
| Article 23(2) | "the controls and stipulations" for cross-border transfer in Article 23 | Articles 22–23 |
Article 29 — "Regularisation"
In Article 29 of the UAE PDPL, the Controller and the Processor must "regularize their status in compliance with the provisions of this Decree by Law":
- Start — the date of issue of the Executive Regulations. This date is different from the date of promulgation in Article 28.
- Period — maximum six months.
- Extension — the Council of Ministers "may extend such period for another similar period".
Article 31 gives a different date: the Decree-Law "shall come into force as of 02 January 2022". Before you use a date that starts from the issue of the Executive Regulations, find them on the UAE Legislation website. Also find if the Council of Ministers extended the period.
Articles 28 and 29 do not tell Controllers or Processors to monitor the issue of these instruments. Modulos recommends that you monitor them (UAE PDPL in Modulos).
Related pages
- The page UAE PDPL gives the dates of the law and the pages for each obligation.
- The page Lawful Processing and Data Subject Rights gives Consent, the Article 4 cases, Article 5, and the rights in Articles 13 to 19.
- The page Controllers, Processors, and the Data Protection Officer gives Articles 7, 8, and 10 to 12.
- The page Security, Breaches, Impact Assessment, and Cross-Border Transfers gives Articles 9 and 20 to 23.
- The page UAE PDPL in Modulos gives the Frameworks, the Requirements and the provisions that they apply to, and the steps that Modulos recommends.
- The page UAE PDPL FAQ refers each FAQ to the page with the full rules.
Sources
- The UAE PDPL is Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data. UAE Legislation. Provisions used: the part before Article 1 and Articles 1 to 3, 4(11), 5(8), 7, 8, 9, and 10. Also Articles 11(1)(e), 12(2), 15(3)(d), 19, 21, 22, 23(2), and 24 to 31.
- The UAE Government website, Data protection laws, section "UAE Data Office".
Disclaimer
This page gives general information. It is not legal advice.