The UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) came into full effect in 2023, and enforcement activity has been increasing through 2025 and into 2026. For businesses operating in the UAE that process personal data — which includes almost every company — compliance is no longer optional. This guide breaks down the practical technical and organisational steps required.
What Data Does UAE PDPL Cover?
UAE PDPL applies to any data that identifies or can identify a natural person — names, email addresses, phone numbers, employee records, CCTV footage of individuals, IP addresses, and biometric data (which is classified as sensitive data requiring a higher standard of protection). It applies to businesses established in the UAE and to businesses outside the UAE that process data about UAE residents.
Key Obligations for UAE Businesses
- Lawful basis: You must have a documented legal basis for processing each category of personal data (consent, contract, legal obligation, or legitimate interest)
- Privacy notices: Individuals must be informed of what data you collect, why, how long you keep it, and who you share it with
- Data subject rights: You must be able to respond to access, correction, and deletion requests within 30 days
- Data transfers: Transferring personal data outside the UAE requires either that the destination country has adequate protections or that specific safeguards are in place
- Breach notification: Significant data breaches must be reported to the UAE Data Office within 72 hours
- Data Protection Officer: Large-scale processors of sensitive data are required to appoint a DPO
Technical Controls Required
PDPL requires organisations to implement 'appropriate technical and organisational measures' to protect personal data. In practice, this means the following must be in place and demonstrable:
- Encryption of personal data at rest and in transit
- Access controls ensuring only authorised personnel can access personal data
- Audit logging of who accesses, modifies, or exports personal data
- Regular vulnerability assessments and penetration testing
- Endpoint protection and anti-malware on all devices handling personal data
- Secure destruction of data when retention periods expire
Penalties for Non-Compliance
The UAE Data Office can impose administrative fines of up to AED 5 million (approximately USD 1.36 million) for violations. More serious breaches involving sensitive personal data or deliberate non-compliance can result in criminal referrals. Beyond regulatory fines, a data breach that becomes public in the UAE can cause significant reputational damage in a market where business relationships are relationship-driven.
Practical Steps to Get Compliant
- 1Data mapping: Identify every system and process that handles personal data
- 2Gap analysis: Compare your current controls against PDPL requirements
- 3Privacy policy and notices: Update your website privacy policy and internal data handling procedures
- 4Technical controls: Implement or verify encryption, access controls, and audit logging
- 5IT security audit: Conduct a formal audit of your systems and remediate findings
- 6Penetration testing: Test your defences against realistic attack scenarios
- 7Staff training: Ensure all employees handling personal data understand their obligations
- 8Incident response plan: Document how you will detect, contain, and report a data breach
Free-standing PDPL compliance projects are expensive and disruptive. The most efficient approach is to align PDPL compliance with your existing IT security audit cycle so the same evidence serves both purposes.
Sector-Specific Considerations
Healthcare organisations in Dubai and Abu Dhabi must also comply with HAAD/DOH regulations on health data, which overlap with but are more stringent than PDPL in some areas. Financial services firms are subject to CBUAE guidance on data governance. Free zone companies may have additional requirements from their regulator (ADGM, DIFC, etc.) which run in parallel to the federal PDPL.