The UAE data protection law, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (often called the PDPL), is the UAE’s federal framework for how organizations collect, use, store and share personal data. It sets principles similar to other modern privacy laws: lawful processing, purpose limitation, data minimization, security, data subject rights and breach notification. Companies in financial free zones such as DIFC and ADGM follow their own separate data protection regimes. Because implementation details continue to evolve, organizations should monitor official guidance and take legal advice.
This article is general information, not legal advice.
Key Takeaways
- The PDPL applies to processing of personal data in the UAE and to some processing outside the UAE relating to people in the UAE.
- DIFC and ADGM have their own data protection laws and regulators.
- Core obligations include lawful basis, transparency, security, records of processing and breach notification.
- Cross-border transfers are subject to conditions.
- Technical controls in Microsoft 365 and Azure support many security and governance requirements.
Which Regime Applies?
| Where you operate | Main framework |
|---|---|
| Mainland UAE and most free zones | Federal Decree-Law No. 45 of 2021 (PDPL) |
| Dubai International Financial Centre | DIFC Data Protection Law No. 5 of 2020 |
| Abu Dhabi Global Market | ADGM Data Protection Regulations 2021 |
| Health data | Additional sector rules, including federal health data requirements |
Key Obligations for Businesses
- Lawful processing: generally consent or another permitted basis.
- Transparency: clear privacy notices.
- Data minimization and accuracy.
- Security: appropriate technical and organizational measures.
- Records of processing activities.
- Data subject rights: access, correction, erasure, restriction, objection and portability in defined cases.
- Breach notification to the regulator and, in some cases, affected individuals.
- Data protection officer where required.
- Cross-border transfer conditions.
Practical Compliance Steps
- Map personal data: what you collect, where it is stored and who it is shared with.
- Determine which regime applies to each entity.
- Update privacy notices and consent processes.
- Implement security controls and access management.
- Review vendors and transfer arrangements (see third-party risk management).
- Prepare a breach response procedure linked to your incident response plan.
- Train staff and document decisions.
Technical Controls That Help
- Data residency in Azure UAE North and UAE Central regions where needed.
- Microsoft Purview DLP and sensitivity labels.
- MFA and Conditional Access.
- Audit logging and retention policies.
- Encryption at rest and in transit.
How Skytech Enterprise Helps
From our Dubai base, Skytech Enterprise supports UAE organizations with data mapping, data protection and DLP, and security controls aligned to UAE requirements through our cyber consulting and advisory services. Read more in our cyber security services Dubai guide. Contact our UAE team.
Frequently Asked Questions
What is the UAE PDPL?
It is Federal Decree-Law No. 45 of 2021, the UAE’s federal law governing the protection of personal data.
Does the PDPL apply in DIFC and ADGM?
DIFC and ADGM have their own data protection laws and regulators, which apply to entities in those free zones.
Is consent always required under the PDPL?
Consent is a primary basis, but the law provides other bases in specific cases. Seek legal advice for your processing activities.
Must personal data stay in the UAE?
Cross-border transfers are permitted under conditions set out in the law. Some sectors have stricter localization requirements.
Does the PDPL require breach notification?
Yes. The law includes obligations to notify the regulator of breaches that affect personal data privacy, and in some cases individuals.
How does Microsoft 365 help with PDPL compliance?
Microsoft 365 and Azure provide security, data protection and residency features that support compliance, but responsibility for configuration and processes remains with the organization.