Compliance

UAE Data Protection (PDPL): A Compliance Guide

2026-04-08 · 5 min read · By Aureus Worldwide

Data has become one of the most valuable and sensitive things a business holds, and the UAE now has a comprehensive federal law governing how it must be handled. The Personal Data Protection Law (PDPL), Federal Decree-Law No. 45 of 2021, sets out how organisations across the UAE must collect, use, store and share personal data, and gives individuals rights over their own information. For businesses, compliance is not optional. This guide explains the PDPL, who it applies to, and what organisations must do.

What the PDPL is

The PDPL is the UAE's federal framework for personal data protection, established by Federal Decree-Law No. 45 of 2021. It governs the processing of personal data, broadly, any operation performed on information relating to an identified or identifiable individual. The law sets principles for lawful handling, grants rights to individuals, and imposes obligations on the organisations that process their data. It reflects the global movement toward stronger data protection and brings the UAE into line with international expectations.

Who it applies to

The PDPL applies broadly to organisations that process the personal data of individuals, subject to its defined scope and exemptions. An important point for UAE businesses: the financial free zones of DIFC and ADGM operate their own separate data protection regimes, so businesses established there follow those laws rather than the federal PDPL. Most other UAE businesses that handle personal data, of customers, employees or others, fall within the PDPL and should assess their obligations. If you are in DIFC, see our DIFC data protection guide.

Core principles

The PDPL is built on principles that should govern any processing of personal data:

• Lawfulness and fairness, process data on a proper legal basis
• Purpose limitation, collect data for specified purposes, not open-endedly
• Data minimisation, collect only what is necessary
• Accuracy, keep data accurate and up to date
• Storage limitation, do not keep data longer than needed
• Security, protect data with appropriate measures

These principles are the foundation of compliance. An organisation that genuinely embeds them is most of the way to meeting its obligations.

Rights of individuals

The PDPL gives individuals, described as data subjects, rights over their personal data. These generally include:

Organisations must have processes to receive and respond to these requests within the framework's requirements. Being unable to handle a data subject request is itself a compliance gap.

What organisations must do

Compliance is practical, not just a policy on a shelf. Key obligations and good practice include:

1. Map your data, know what personal data you hold and why
2. Establish a lawful basis for each type of processing
3. Put in place policies and notices that inform individuals
4. Implement security measures to protect data
5. Build processes to handle data subject requests
6. Have a plan for data breaches if they occur
7. Take care with transfers of data, including across borders

Because the PDPL's implementing regulations and specifics continue to develop, confirm current detail with the relevant authority rather than relying on assumptions.

Build a compliance programme

Data protection is best treated as an ongoing programme, not a one-off project. That means assigning responsibility for it, training staff who handle data, reviewing your practices periodically, and keeping documentation that demonstrates compliance. It connects naturally to broader governance and to mechanisms like whistleblowing for raising concerns. Our compliance officers service helps build and run such programmes.

Cross-border data transfers

A practical area that catches many UAE businesses out is transferring personal data outside the country, to a cloud provider, an overseas head office, or a third-party processor. The PDPL places conditions on such transfers to ensure data remains protected when it leaves the UAE. Because so many businesses use international software and services, this is rarely avoidable, which makes it important to understand the requirements rather than transferring data without thought. Map where your data actually goes, including via the systems you use, and ensure those flows meet the framework's conditions. As implementing detail develops, confirm the current requirements with the relevant authority.

Handling a data breach

No security is perfect, so every organisation should be ready for a data breach. A breach is, broadly, an incident that compromises the security of personal data, loss, unauthorised access or disclosure. Being prepared means having a plan to detect, contain and assess a breach quickly, to take remedial action, and to meet any notification obligations the framework imposes. Organisations that plan for breaches in advance respond calmly and limit the damage; those that improvise in the moment often make matters worse. A clear, rehearsed breach-response process is a core part of PDPL compliance, not an optional extra, and it reassures customers and regulators that the business takes data seriously.

How Aureus Worldwide helps

Aureus Worldwide helps UAE businesses comply with the PDPL: mapping the personal data you hold, establishing lawful bases, drafting policies and notices, building data-subject-request and breach processes, and embedding it all into an ongoing programme through our compliance officers service. We help you protect data and meet your legal obligations under Federal Decree-Law No. 45 of 2021. To strengthen your data protection, contact us.

Talk to our chartered accountants →