uae-pdp-law
UAE Personal Data Protection Law Compliance
Overview
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDP Law) was issued on 20 September 2021 and entered into force on 2 January 2022, with a compliance grace period. The Executive Regulations were issued by Cabinet Decision No. 111 of 2023, published in the Official Gazette on 23 October 2023, and companies were given until 1 January 2025 to achieve compliance. The UAE Data Office (established under the law) is the supervisory authority responsible for enforcement.
The UAE PDP Law is the first comprehensive federal data protection law in the UAE. It is important to note that the UAE also has separate data protection regimes in the financial free zones: the Dubai International Financial Centre (DIFC) Data Protection Law No. 5 of 2020 and the Abu Dhabi Global Market (ADGM) Data Protection Regulations 2021. These free zone laws operate independently of the federal law.
Key Definitions
| UAE PDP Law Term | GDPR Equivalent | Definition |
|---|---|---|
| Personal Data | Personal data | Any data related to an identified or identifiable natural person (Article 1) |
| Sensitive Personal Data | Special category data | Data revealing racial or ethnic origin, political opinion, religious beliefs, criminal records, biometric data, health data, genetic data (Article 1) |
| Controller | Controller | Any person who determines the purposes and means of personal data processing (Article 1) |
| Processor | Processor | Any person who processes personal data on behalf of the controller (Article 1) |
| Data Subject | Data subject | The natural person to whom personal data relates (Article 1) |