draft-dpa-uae-pdpl
Installation
SKILL.md
Data Processing Agreement — UAE Personal Data Protection (Federal + DIFC/ADGM)
When to use this
The UAE data-protection landscape is fragmented across three legal regimes. Before drafting a DPA, identify which regime governs:
| Entity registration | Applicable law | Regulator |
|---|---|---|
| UAE federal / onshore (mainland + most free zones) | Federal Decree-Law 45/2021 (UAE PDPL) + implementing regulations | UAE Data Office (within UAE Digital Government Authority) |
| DIFC (Dubai International Financial Centre) | DIFC Data Protection Law (DIFC Law 5/2020) | DIFC Commissioner of Data Protection |
| ADGM (Abu Dhabi Global Market) | ADGM Data Protection Regulations 2021 | ADGM Registration Authority |
Same entity, different regimes: A multinational may have subsidiaries in all three. The applicable regime is determined by the entity's legal registration, not the data subject's location. A Dubai mainland company processing data about DIFC employees still uses the UAE PDPL; a DIFC-incorporated company uses DIFC Law 5/2020.
Use this skill for UAE federal / onshore entities. Use the DIFC/ADGM sections below for those regimes.
Required inputs
Same as [[draft-dpa-gdpr]] — adapt for UAE PDPL specifics as set out below.