Two-minute brief
UAE PDPL requirements explained: video brief
A two-minute brief on the articles of Federal Decree-Law No. 45 of 2021 that shape a privacy programme.
Key takeaways
- Article 5 sets the processing controls for every activity.
- Consent is the default, with listed cases that do not need it.
- Controllers keep a special record for the Data Office.
- A data protection officer is required for high-risk or large-scale sensitive processing.
- Transfers abroad need an adequate destination or a listed ground.
Processing, consent and accountability
The Decree-Law has 31 articles; the obligations that shape a programme sit in Articles 4 to 23. This short film walks through them. The official English translation defers to the Arabic original, and legal interpretation stays with legal advisers.
Article 5 sets the processing controls: process fairly, transparently and lawfully, for a specific and clear purpose, keep data limited to that purpose, accurate and current, keep it secure, and do not keep it once the purpose is exhausted unless anonymised. Articles 4 and 6 allow no processing without consent unless a listed case applies, such as a contract with the person, obligations under other UAE laws or legal claims; consent must be provable, clear and easy to withdraw. Articles 7 and 8 require technical and organisational measures, a special record of personal data submitted to the Data Office on request, and processors that act on instructions under contract. Article 9 requires breaches to be notified to the Data Office and, where privacy would be prejudiced, to the people concerned.
DPO, rights, security and transfers
Articles 10 to 12 require a data protection officer where processing carries a high risk, involves systematic assessment of sensitive personal data including profiling, or covers a large volume of sensitive personal data. Articles 13 to 19 give people rights to information, portability, correction, erasure, restriction and objection, including objection to automated decisions with human review on request, free of charge. Article 20 requires security matched to the risks, including encryption and pseudonymisation, resilient systems, timely recovery and testing. Article 21 requires an impact assessment before high-risk processing. Articles 22 and 23 allow transfers abroad to destinations with adequate data protection legislation or on a listed ground, such as a contract binding the recipient to the law or express consent.
The law has been in force since 2 January 2022 and is supervised by the UAE Data Office; free zones with their own law, such as the DIFC and ADGM, sit outside it, and no certificate exists under it.
PDPL (UAE) at a glance
- Purpose
- Personal data protection in the UAE: processing on consent or a case the law allows, kept secure and recorded, with people's rights respected
- Relevant to
- Controllers and processors in the UAE, and those abroad that process personal data of people in the UAE; free zones with their own data protection law, such as the DIFC and ADGM, sit outside it
- Edition
- Federal Decree-Law No. 45 of 2021, in force since 2 January 2022; its Executive Regulations were not listed on the official UAE legislation portal as of September 2026
- Certification
- None exists under the law. The UAE Data Office supervises and handles complaints; ISO/IEC 27701 certification can evidence the programme but is not legal compliance
- Sterling's role
- Scoping, gap analysis and implementation with your team, Effivity, training and internal audit, then Sustain™ as the regulations arrive
- Cost and timing
- Total investment for a UAE PDPL compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 6 months
PDPL (UAE): questions people ask
Is the UAE PDPL in force if the Executive Regulations have not been issued?
Yes; it has been in force since 2 January 2022. The Executive Regulations will add detail, including the period and procedure for breach notification, controls on transfers to countries without adequate protection and any further cases for processing without consent. Article 29 then allows six months to regularise, extendable by the Cabinet, and Article 26 leaves penalties to a Cabinet decision; as of September 2026 the official legislation portal lists neither. Six months is short for a first programme, so build now.
Is there a UAE PDPL certification?
No. The Decree-Law creates no certification scheme. ISO/IEC 27701 certification from an accredited body shows an audited privacy management system, and ISO/IEC 27001 evidences security, but neither is legal compliance with the PDPL. A "PDPL certified" seal sold for a fee is a badge, not a status.
Which organisations and data are outside the PDPL?
Article 2 excludes government data and government entities, personal data held by security and judicial authorities, individuals' processing for personal purposes, health data and banking and credit data that have their own legislation regulating their protection, and companies in free zones with their own data protection legislation, such as the DIFC (DIFC Law No. 5 of 2020) and ADGM; a group with entities onshore and in those zones deals with more than one regime. Article 3 also lets the Data Office exempt some establishments that do not process a large volume of personal data. Confirm sector exclusions with your legal advisers.
We are based outside the UAE. Does the PDPL apply to us?
Yes, if you process personal data of data subjects inside the UAE: Article 2 covers controllers and processors outside the State, such as a Manila contact centre serving a Dubai retailer or a European SaaS provider hosting a UAE client's customer data. As a processor, Article 8 applies directly and the client's contract sets scope, purpose and duration.
Can we rely on legitimate interests, as we do under the GDPR?
Not as a general ground. Article 4 prohibits processing without consent except in listed cases: the public interest, data the person made public, legal claims, occupational and preventive medicine, public health, archival and scientific purposes, the person's own interests, employment and social security obligations, a contract with the person, obligations under other UAE laws and further cases the Executive Regulations may add. Activities that rested on legitimate interests in a GDPR record need a fresh decision.
Keep exploring
Related to this video
The complete guide
Everything on PDPL (UAE)
Start with the PDPL (UAE) page, or go straight to the guide you need.
On the PDPL (UAE) page
More videos: Privacy and data protection
- How to comply with HIPAACompliance walkthrough · 3 min 24 s
- HIPAA requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27701Implementation walkthrough · 3 min 14 s
- ISO/IEC 27701 requirements explainedTwo-minute brief · 2 min
- How to comply with GDPRCompliance walkthrough · 3 min 24 s
- GDPR requirements explainedTwo-minute brief · 2 min
- How to comply with the Philippine Data Privacy ActCompliance walkthrough · 3 min 15 s
- Philippine Data Privacy Act requirements explainedTwo-minute brief · 2 min
- How to comply with India's DPDP Act 2023Compliance walkthrough · 3 min 15 s
Talk to a consultant
Plan your UAE PDPL compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice