How to comply with the UAE PDPL: video walkthrough

The UAE's federal personal data law

The Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, is the United Arab Emirates' federal law on processing personal data. It sets controls for every processing activity, makes consent the default condition, gives people rights over their data, places duties on controllers and processors, restricts transfers abroad and puts supervision with the UAE Data Office. It covers processing in the UAE and, where the people concerned are in the UAE, processing done from abroad; free zones with their own data protection law, such as the DIFC and ADGM, sit outside it.

No certificate proves compliance with the law; an operating programme does. This short film walks through how one is built.

Map, decide, implement, maintain

Settle the scope: which entities, emirates and free zones are in, any DIFC or ADGM entity set aside for its own regime, the organisation's role as controller or processor for each activity, and whether work done abroad falls under Article 2. A gap analysis then lists what personal data is processed, where and by which suppliers, and tests notices, consents, contracts, security and procedures against each article.

Implementation settles consent or one of the law's listed cases for each activity, issues notices and procedures, signs processing contracts, decides whether a data protection officer is needed, switches on retention and security measures, completes the impact assessments due and trains the staff who handle personal data. The special record Article 7 requires is kept current from the data inventory. Breach handling is prepared with triage, named decision-makers and ready notices for the Data Office and individuals. Every outbound flow to cloud providers, group entities or offshore support is listed with its transfer route. An internal audit and management review close the gaps with evidence, and client audits and Data Office requests are then answered from records that already exist.

Sterling's expert and experienced consultants design and implement the programme with your team under Sterling OS™; the Data Office and your customers' auditors judge it. The law has been in force since 2 January 2022, while its Executive Regulations were not listed on the official UAE legislation portal as of September 2026, so the programme is checked against them once they are issued. Legal interpretation stays with your legal advisers.