CevroUnited Arab Emirates: UAE PDPL and what it requires
Federal Decree-Law No. 45 of 2021 (PDPL): a law that is enacted or being phased in, with enforcement practice still maturing. Overseen by UAE Data Office.
Key requirements at a glance
| Registration with the regulator | Not required |
|---|---|
| Data protection officer | Depends on thresholds or circumstances |
| Breach notification | No fixed hourly deadline in our reference |
| Cross-border transfer restrictions | Required |
| Data localization | Not required |
Penalties and enforcement
Administrative penalties are to be defined by a Cabinet decision (Art. 26) and had not been published at the time of review.
What to know in practice
Applies onshore: the DIFC and ADGM free zones run separate regimes. The breach notification period and DPO appointment criteria are deferred to Executive Regulations that had not been issued at the time of review, so no deadline is recorded here. Check the current status before relying on this.
The security duty
Under Art. 20: Personal data security: technical and organisational measures appropriate to the risk, including encryption, resilience and testing of effectiveness. Source: published text, checked 2026-10.
How Cevro helps
- Maps UAE PDPL to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Counts your automated technical checks as evidence toward the security duty in Art. 20.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in United Arab Emirates?
UAE Data Office oversees Federal Decree-Law No. 45 of 2021 (PDPL).
Is breach notification mandatory under UAE PDPL?
Our reference does not record a fixed hourly deadline for UAE PDPL. Check the statute and UAE Data Office guidance for the notification timing that applies to you.
Does United Arab Emirates restrict cross-border data transfers?
Yes. Moving personal data out of United Arab Emirates is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under UAE PDPL?
Only in some cases, usually depending on the scale or sensitivity of your processing. Confirm whether you cross the threshold.
What are the penalties for non-compliance in United Arab Emirates?
Administrative penalties are to be defined by a Cabinet decision (Art. 26) and had not been published at the time of review.