UAE data protection: the federal PDPL, DIFC and ADGM
Three regimes, one country: a federal law awaiting its regulations and two financial centres enforcing GDPR-style rules, the DIFC now with a private right of action. Here is which applies and what to do.
Which law applies to you
Data protection in the UAE depends on where an organisation is established. Onshore, including the mainland and ordinary free zones, the Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 (the PDPL) applies, in force since 2 January 2022 and supervised by the UAE Data Office established by Federal Decree-Law No. 44 of 2021. The DIFC has its own Data Protection Law, DIFC Law No. 5 of 2020, enforced by the DIFC Commissioner of Data Protection, and ADGM has its Data Protection Regulations 2021, enforced by its Office of Data Protection. All three are broadly modelled on the EU GDPR.
| Establishment | Regime | Regulator |
|---|---|---|
| Mainland or ordinary free zone | Federal PDPL (Federal Decree-Law No. 45 of 2021), plus sector rules | UAE Data Office |
| DIFC | DIFC Data Protection Law No. 5 of 2020, as amended in 2025 | DIFC Commissioner of Data Protection |
| ADGM | ADGM Data Protection Regulations 2021 | ADGM Office of Data Protection |
Sector rules sit on top: health data, for example, is subject to specific federal rules including restrictions on storing health information outside the UAE, and banks and insurers follow Central Bank requirements. A group with entities in more than one zone may be subject to several regimes at once.
Obligations, and an enforcement gap
The PDPL requires a lawful basis for processing, with consent as the main basis and defined exceptions; transparency toward individuals; data minimisation and accuracy; security measures; records of processing; a data protection officer in defined cases; notification of breaches to the Data Office and, where relevant, to individuals; and safeguards for transfers outside the UAE, which are permitted to countries with adequate protection or under specified conditions. Individuals have rights of access, correction, erasure, restriction, objection and portability.
The law's full operation depends on executive regulations, which were due within months of its issue but have been repeatedly delayed; their status has been reported inconsistently, and the law provides for a compliance window from their issue. That has produced an enforcement gap onshore. It is not a reason to ignore the law: the obligations are in force on its face, contracts and group policies increasingly require compliance, and sector regulators already enforce their own data rules. Check the current status of the regulations before relying on any grace period.
In 2026 the UAE moved to consolidate oversight of artificial intelligence and data in a new federal authority. How that affects the Data Office's role under the PDPL should be confirmed as the arrangements take effect.
Active regulators, real fines
DIFC
DIFC Law No. 5 of 2020 was amended by DIFC Amendment Law No. 1 of 2025, in force 15 July 2025. The amendments clarify extraterritorial reach, require documented assessments for international transfers, introduce a private right of action allowing individuals to claim compensation in the DIFC Courts for breaches, and add rules on processing by AI and autonomous systems. The DIFC Commissioner issues fines and directions.
ADGM
The ADGM Data Protection Regulations 2021 follow the GDPR closely, with an independent Commissioner, data subject rights, breach notification and international transfer rules, and administrative fines of up to USD 28 million. ADGM regularly publishes guidance.
For firms in the financial centres, data protection is an actively supervised area, alongside the financial regulators' own requirements on outsourcing, cloud and cybersecurity. Their regimes are the most mature in the region, and the DIFC's private right of action adds litigation risk to regulatory risk.
A programme for onshore and offshore entities
Map
Identify which entities are onshore, DIFC or ADGM, what personal data each processes and where it flows, including to group systems abroad.
Document
Privacy notices, records of processing, a data protection policy, processor contracts and transfer mechanisms appropriate to each regime.
Secure and respond
Security measures, a breach response plan with notification steps for each regulator, and a procedure for data subject requests.
Govern
A named person responsible for data protection, a DPO where required, and training; in the DIFC, an assessment of AI and automated processing.
Organisations that already comply with the GDPR can reuse much of their programme, adjusting for the UAE regimes' specific requirements on consent, transfers, health data and notification. The step most often missing is a clear view of which regime applies to which entity.
Federal Decree-Law No. 26 of 2025
A newer layer affects digital services. Federal Decree-Law No. 26 of 2025 on Child Digital Safety imposes obligations on digital platforms and internet service providers in relation to users under 18, including age verification, content filtering, parental controls and cooperation with authorities. It works alongside the PDPL, which does not contain detailed rules on children's data. Businesses offering apps, games, education platforms or social features to UAE users should assess whether they fall within its scope.
Together with consumer protection and e-commerce rules, this means that consumer-facing digital businesses in the UAE face more than a single data law. A product launch plan should include a regulatory check on all of them, not only on the PDPL.
A group with three entities
A group runs a mainland sales company in Dubai, a DIFC investment advisory firm and a back-office services company in an ordinary free zone, sharing a CRM hosted in Europe. The mainland company and the free zone company are subject to the federal PDPL; the DIFC firm to the DIFC Data Protection Law with its private right of action and documented transfer assessments. All three transfer data to the European CRM.
The group needs three things it does not yet have: a transfer assessment for the DIFC firm meeting the 2025 requirements; a transfer basis for the onshore entities consistent with the PDPL; and a breach plan that notifies the right regulator for each entity. A single group privacy policy written for the EU covers much of the substance, but not the routing: which regulator, which rights procedure, which transfer document. That routing is where UAE data compliance usually fails.
Where consumers notice first
For most businesses the most visible processing is the website and marketing. Under the PDPL and the financial centre regimes, collecting personal data through forms requires a privacy notice at the point of collection, and analytics and marketing cookies should only be set after an informed choice where consent is the basis. Electronic marketing is subject to consent and opt-out requirements, and the UAE's telecoms regulator also restricts unsolicited commercial messages. Complaints in this area are easy for individuals to make and easy for regulators to verify.
Three checks remove most of the exposure: analytics that load only after consent, a working one-step unsubscribe honoured promptly, and contact form data stored securely and deleted when no longer needed. Businesses that market to UAE residents from abroad should apply the same checks, because the PDPL reaches processing of the data of people in the UAE.
The internal side of compliance
Employers hold more personal data about their staff than about most customers: identity documents, passports and visas, salaries, medical records from visa screening, family details for sponsorship, and increasingly monitoring data from devices and offices. All of it is personal data under the PDPL and the financial centre regimes, and some of it, such as health information, is sensitive and subject to stricter conditions. Retaining employees' passports, a practice the labour authorities prohibit, is also a data protection issue.
A defensible approach is to tell employees what is collected and why in an employee privacy notice, restrict access to HR and payroll data, set retention periods linked to legal obligations such as visa, tax and labour records, and assess monitoring tools before introducing them, particularly in the DIFC where processing by automated systems has specific rules since 2025.
Health, finance and telecoms
The general data protection regimes are not the whole picture. Health information is subject to federal rules on the use of information and communications technology in health, which restrict storing and processing health data outside the UAE except where permitted. Banks, insurers and payment firms follow Central Bank requirements on customer data, outsourcing and cloud, and DIFC and ADGM financial firms follow their regulators' rules as well as the data protection law. Telecoms and digital services face rules from the telecoms regulator. A business in one of these sectors should map the sector rules first, because they are often stricter than the general law.
Questions we get asked first
Which data protection law applies in the UAE?
The federal PDPL (Federal Decree-Law No. 45 of 2021) on the mainland and in ordinary free zones; the DIFC Data Protection Law in the DIFC; and the ADGM Data Protection Regulations 2021 in ADGM.
Is the UAE PDPL in force?
The law has been in force since 2 January 2022, but its executive regulations, needed for full operation, have been repeatedly delayed. Their status should be checked before relying on any compliance window.
What changed in DIFC data protection in 2025?
DIFC Amendment Law No. 1 of 2025, in force 15 July 2025, clarified extraterritorial reach, required documented transfer assessments, introduced a private right of action in the DIFC Courts and added rules on AI processing.
What are the fines in ADGM?
Administrative fines of up to USD 28 million under the ADGM Data Protection Regulations 2021.
Can personal data be transferred outside the UAE?
Yes, under conditions set by each regime: to jurisdictions with adequate protection or with appropriate safeguards. Health data is subject to specific restrictions.
Does UAE law regulate children's data?
Federal Decree-Law No. 26 of 2025 on Child Digital Safety imposes obligations on digital platforms regarding users under 18, alongside the general data protection rules.
Know your regime, then comply as if it is enforced
The UAE has three data protection regimes. The financial centres enforce theirs actively, and the DIFC now allows individuals to sue. The federal PDPL is in force but awaits its regulations. Map which law applies to each entity, document transfers and breaches for each regulator, and treat the onshore law as binding now.
Processing personal data in the UAE?
We map your entities to the right regime and set up the notices, records, transfer documents and breach plan each requires.
Email us →Related reading
This article is general information, current as of 2026, and is not advice for any specific situation. Confirm current rules with the MOIC, the NBR or the relevant authority before acting.