UAE PDPL · Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
UAE PDPL compliance consulting for a privacy programme that is ready before the regulator asks.
The United Arab Emirates' Personal Data Protection Law governs organisations in the UAE and those abroad that process personal data of people in the UAE. Build a programme that stands up to the UAE Data Office and your customers' auditors, with consent or one of the law's exceptions behind every activity, the special record kept and breaches, transfers and requests handled. Sterling's expert and experienced consultants build it with your teams, assemble the evidence and stay with you as the Executive Regulations arrive, in 60+ countries. We ensure a successful UAE PDPL compliance programme for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced data protection consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling builds the controls, the governance and the evidence; compliance is assessed by the UAE Data Office and your customers' auditors
8,100+ client engagements in 60+ countries.
UAE PDPL client experience
What it is
What is the UAE PDPL and what is it used for?
The Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, is the United Arab Emirates' federal law on processing personal data. It sets controls for every processing activity, makes consent the default condition, gives people rights to information, portability, correction, erasure, restriction and objection, places duties on controllers and processors, restricts transfers abroad and puts supervision with the UAE Data Office, created by Federal Decree-Law No. 44 of 2021. It covers processing in the UAE and, where the people concerned are in the UAE, processing done from abroad.
No certificate proves compliance with the PDPL; an operating programme does: a decided condition for each activity, the special record Article 7 requires, notices before processing begins, contracts binding processors, security matched to risk and evidence that each works. The law also departs from the GDPR where it counts, with no general legitimate-interests ground and no fixed 72-hour breach window, so a relabelled European template misses the point.
Current text. Federal Decree-Law No. 45 of 2021 was issued on 20 September 2021 and has been in force since 2 January 2022. Article 28 required the Cabinet to issue Executive Regulations within six months; as of September 2026 the official UAE legislation portal lists none, nor the Cabinet decision on violations and administrative penalties provided for in Article 26. Once the regulations are issued, Article 29 gives controllers and processors six months to regularise, extendable by the Cabinet for a similar period; confirm the position with your legal advisers. Companies in free zones with their own data protection legislation, such as the DIFC (DIFC Law No. 5 of 2020) and ADGM, follow those regimes, which are related to this page but not covered by it. UAE PDPL Executive Regulations: status and how to prepare
Who it is for
Who needs to comply with the UAE PDPL?
Article 2 covers controllers and processors in the UAE, and those abroad that process personal data of data subjects inside the UAE. Government data and entities, security and judicial authorities, personal-purpose processing, health and banking data governed by their own legislation and free zones with their own data protection law are excluded (see the FAQs); a free-zone address alone is not an exemption. Organisations come to Sterling from four starting points:
- A UAE client, bank or procurement team asks for evidence. Questionnaires ask who your DPO is, where data is hosted, how a breach reaches the Data Office and what binds your subcontractors. The answer must be a record, a procedure and a contract.
- You serve UAE customers from another country. A contact centre in Manila, a development team in India or a SaaS provider in Europe handling data of people in the UAE falls within Article 2 and needs a UAE layer on top of its home law.
- Your UAE business grew faster than its paperwork. Spreadsheets of customers, marketing on messaging apps, CCTV, HR files, an unmapped CRM: consent was never recorded, and direct marketing is exactly where Article 17 lets people tell you to stop.
- You already run a GDPR or ISO/IEC 27001 programme. Much carries over, but the UAE law has its own processing conditions, record, breach route and transfer tests: you need a documented UAE layer, not a second programme.
Business benefits
What UAE PDPL compliance does for your business
The value shows on ordinary days: a bank's onboarding questionnaire, a customer leaving your marketing list, a departing employee asking for their HR file, a cloud move that sends data abroad. Each gets an owner, a procedure and a record.
- Faster vendor approvalsWhen a UAE client's risk team sends its questionnaire, the special record, processing contracts, your sub-processor list and security evidence are already on file.
- Marketing on solid groundConsent captured with its wording and date, withdrawal as easy as the law requires, and objections to direct marketing honoured on every channel.
- Breaches run by procedureThe incident assessed, the Data Office notified on becoming aware of a breach, affected people told where their privacy and confidentiality are prejudiced, and the outcome recorded.
- Requests answered, not avoidedInformation, portability, correction, erasure, restriction and objection requests received through one channel, verified, decided against the law's exceptions and logged.
- Transfers you can defendCloud hosting, group offices and offshore support mapped, with the Article 22 or Article 23 route recorded for each flow instead of assumed.
- One programme for the whole groupBuild the core once (inventory, roles, procedures, controls) and add a documented layer for each further law you meet, such as the GDPR or India's Digital Personal Data Protection Act.
Judge progress by a few numbers: activities with a recorded condition, requests closed within your service level, processors under contract, time from incident to decision. Counting policies proves nothing.
Requirements
What are the main UAE PDPL requirements?
The Decree-Law has 31 articles; the obligations that shape a programme sit in Articles 4 to 23, with complaints, grievances and penalties in Articles 24 to 26. Sensitive personal data (data revealing family, ethnic origin, political or philosophical opinions, religious beliefs, criminal record, biometric data or health) raises the stakes for DPO and impact assessment decisions. The table is a plain-language map; the official English translation defers to the Arabic original, and legal interpretation stays with your legal advisers.
| Article | What it requires of you | What it looks like in practice |
|---|---|---|
| Art. 5 Processing controls | Process fairly, transparently and lawfully, for a specific and clear purpose; keep data limited to that purpose, accurate and current; correct or delete errors; keep it secure; do not keep it once the purpose is exhausted unless anonymised | Each activity described once with purpose, categories, retention and security, and a schedule that deletes or anonymises on time |
| Art. 4 and 6 Consent and the cases without it | No processing without consent unless a listed case applies, such as a contract with the person, obligations under other UAE laws, employment and social security duties, legal claims, the public interest or public health; consent must be provable, clear, simple, unambiguous, easily accessible and easy to withdraw | The condition recorded against every activity, consent evidence with wording and date, and an opt-out that actually stops the processing |
| Art. 7 and 8 Controller and processor obligations | Technical and organisational measures, the Article 5 controls built in and processing limited to its purpose by default; a special record of personal data, submitted to the Data Office on request; only processors able to apply the required measures; processors act on instructions under contract, erase data when the period ends and keep their own record | The special record kept current from the inventory, processor contracts stating scope, purpose, data types and duration, and scheduled supplier reviews |
| Art. 9 Reporting personal data breaches | On becoming aware of a breach, notify the Data Office of its nature, causes, records affected, the DPO's details, likely effects and measures taken, as the Executive Regulations set; tell the people concerned where it would prejudice the privacy and confidentiality of their data; processors alert the controller as soon as they become aware | Incident handling with triage, named decision-makers, ready notices for the Data Office and individuals, and a log of every breach |
| Art. 10 to 12 Data protection officer | A DPO where processing carries a high risk to confidentiality and privacy from new technologies or volume, involves systematic and comprehensive assessment of sensitive personal data including profiling and automated processing, or covers a large volume of sensitive personal data; involve and resource the DPO and never penalise them for doing the job | The DPO decision and reasoning on file, the Article 11 tasks in the role, contact details notified to the Data Office and a direct line for data subjects |
| Art. 13 to 19 Rights of the data subject | Free of charge on request, the information Article 13 lists, with purposes, recipients inside and outside the UAE and cross-border safeguards given before processing starts; portability, correction, erasure, restriction and objection within the law's conditions; objection to automated decisions, with human review on request; clear contact routes | Audience-specific notices, an intake that verifies identity and logs each request, a response standard per right, and a search that finds every record about one person |
| Art. 20 Personal data security | Technical and organisational measures matched to the risks and to recognised international practice, including encryption and pseudonymisation, confidential, accurate and resilient systems, timely recovery after a failure and testing of the measures | Risks to personal data linked to the controls that treat them, on the ISO/IEC 27001 method where you use it, with test records |
| Art. 21 Data protection impact assessment | An assessment before high-risk processing using modern technologies, required for systematic and comprehensive automated evaluation of personal aspects, including profiling, with legal consequences, and for large volumes of sensitive personal data; covering the processing, necessity and proportionality, risks and measures, with the DPO, and reviewed periodically | Projects and purchases screened at the start, a standard format, approval before launch and a fresh look when processing changes |
| Art. 22 and 23 Cross-border transfer and sharing | Transfers abroad in cases the Data Office approves, where the destination has data protection legislation with the essential provisions and a supervisory or judicial authority, or the UAE has joined a data protection agreement with it; otherwise only on an Article 23 ground, such as a contract binding the recipient to the law, express consent, a contract with or for the person, legal proceedings, international judicial cooperation or the public interest | Every outbound flow (cloud, group entities, offshore support) listed with its Article 22 or 23 route and revisited when a destination's position changes |
What does useful UAE PDPL evidence look like?
Start with the special record: if it matches the systems your people actually use, most other evidence follows. Then the condition behind each activity, notices given before collection, signed processing contracts, the impact assessments Article 21 requires, the DPO decision, breach and request logs (including the incidents not notified, and why), transfer routes and training records, all produced from real processing and held in Effivity from the first workshop.
UAE PDPL requirements explained, article by articleCompliance process
How do you become UAE PDPL compliant?
Sterling designs and builds the programme with your team; others judge it. The UAE Data Office receives breach notifications and complaints and can call for your records, and your customers' auditors test the programme whenever a contract depends on it. Both want evidence, not assurances.
- 01Define what the programme needs to cover.Agree which entities, emirates and free zones are in, set aside any DIFC or ADGM entity for its own regime, fix your role for each activity and check whether work done abroad falls under Article 2.
- 02Gap analysis: test the current position against the law.The gap analysis lists what personal data is processed, where and by which suppliers, then tests notices, consents, contracts, security and procedures against each article; effective practice stays and every gap gets an action, owner and date.
- 03Implement, and record as you go.Settle the consent or Article 4 case per activity, issue notices and procedures, sign processing contracts, decide on the DPO, switch on retention and security measures, finish the impact assessments due and train the staff who handle personal data.
- 04Audit, review and address the findings.The internal audit tests the programme against the Decree-Law, the management review with the DPO or privacy lead decides what to fix, and every gap we find is closed with evidence before anyone external looks.
- 05Complete the regulator or customer review.Client audits, questionnaires and Data Office requests are answered from evidence that already exists; if customers want a certificate, the management system can go on to ISO/IEC 27701 certification.
- 06Maintain the programme and absorb the regulations.New systems are screened, new suppliers contracted, requests and incidents logged and reviewed; once the Executive Regulations are issued, the programme is checked against them inside the Article 29 window.
Compare outputs before prices: mapped data, a decided condition per activity, documents written for UAE law rather than relabelled from the GDPR, trained people and evidence in a system you control. A "PDPL certificate" delivered in days certifies nothing the law recognises. How to choose a credible UAE PDPL provider · The certification buyer's checklist
Cost
How much does UAE PDPL compliance cost?
Three things drive the price: how much processing there is to map, how sensitive the data is and how much groundwork exists. A small trader with one CRM and a group running a multi-country contact centre sit at opposite ends; either way, a Sterling proposal shows every component and states everything that is included.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Activities, systems and suppliers to map, your role as controller or processor, entities and emirates covered, deliverables, and the share of work your team takes on (Design™ or Drive™) |
| Independent review | Only if you choose one: an ISO/IEC 27701 certification body or a third-party assessor, priced separately; client audits and Data Office enquiries cost time, not fees |
| Internal resources and legal | Process-owner and IT time for mapping, retention, access and security changes, DPO or privacy-lead capacity, training, remediation and any legal review of notices, contracts and transfers |
| Software and learning | Included in a Sterling engagement: Effivity runs the programme and Sterling Academy trains your people, with users, courses and the access period set out in the proposal |
| Continued support | Internal audits, impact assessment support, a watch on the Executive Regulations and Data Office guidance, and refresher learning under Sustain™ |
What moves the price
- Activities, systems and suppliers handling personal data, and how much is mapped already
- Your role for each activity, and whether sensitive personal data is involved
- Entities and emirates in scope, plus any DIFC or ADGM company under its own regime
- Cloud, group or offshore transfers that need a documented route
- A fixed date from a client, a contract or the Executive Regulations
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Legal, assessor and certification fees identified separately, so the full programme cost can be compared
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does UAE PDPL compliance take?
Most programmes take three to six months: shorter where ISO/IEC 27001 or a GDPR programme needs a UAE layer, longer where many systems, suppliers and entities are mapped for the first time. Decisions, not drafting, set the pace (conditions, retention, transfer routes, the DPO), and controls then need time to leave records, tracked in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | How quickly system owners, contracts and records can be reached, and how fast the inventory fills in |
| Build and implementation | Decisions on conditions, retention and transfer routes, signature of processing contracts, IT work on access, deletion and security, and training |
| Evidence and review | Weeks of operation for controls to leave records, impact assessments finished, then internal audit and management review |
| Regulator or customer review | When client audits and questionnaires fall, any Data Office request and, for a certificate, the ISO/IEC 27701 certification body's schedule |
Put any fixed date, from a contract, a client audit or a board meeting, into the first conversation; it decides which choices come first. Full compliance promised within days, before anyone has seen a data flow, is a date being sold, not a programme.
Challenges
Common UAE PDPL implementation challenges
Five obstacles account for most stalled PDPL programmes, and none of them is fatal.
Personal data is spread across systems nobody has mapped.
Mapping works through the organisation department by department with the people who run each system, capturing purpose, categories, recipients, retention and transfers. The output is the Article 7 special record, and faster answers to every request, retention question and breach.
A GDPR template set was adopted and relabelled for the UAE.
The UAE law has no general legitimate-interests ground, no breach deadline in hours and its own transfer tests. We keep what carries across, rewrite the rest and document the difference.
Consent was never captured, or cannot be proved.
Consent is the default under Article 4, and Article 6 makes the controller prove it. We move activities that fit another listed case, such as a contract or an obligation under other UAE laws, and set up consent capture with wording, date and working withdrawal where consent remains the basis.
Data leaves the organisation without contracts or a documented transfer route.
List every recipient, put contracts in place that fix scope, purpose, data types and duration, and record the transfer route for each flow, starting with the suppliers holding the most sensitive data.
Nobody knows when to call the Data Office.
Incidents arrive through one route, are rated by named people and, where notification is due, go out on prepared templates for the Data Office and the individuals affected, ready to take the period and procedure the Executive Regulations set.
Your engagement
What your UAE PDPL engagement includes
One team and one all-inclusive proposal cover the whole job: the mapping and the decisions, the documents and the software, the training, and the review that shows the programme operating.
Scope, gap analysis and implementation plan
Entities, roles, systems and suppliers in scope, where each obligation stands today, and actions, owners and dates, agreed before work begins.
Data mapping, the special record and documentation
Sterling's template sets, written for UAE law and adapted to your processing: the Article 7 record, consent and exception decisions, retention rules, notices, processing contracts, impact assessment and breach procedures.
Effivity ISO & GRC software
The programme lives in Effivity from the first workshop, included with the engagement at no additional cost.
Training for everyone
Preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement, and internal auditor training for your audit team, as applicable to your standard.
Internal audit and management review
Run by us or with your own auditors, as agreed, with each finding closed with evidence before anyone external looks.
Review readiness and support
Client audits, questionnaires and Data Office requests prepared for in advance, with support through ISO/IEC 27701 certification if you seek it.
Compliance is assessed by the UAE Data Office and your customers' auditors. Sterling consults; legal advice stays with your lawyers.
How we deliver
How Sterling supports your UAE PDPL implementation
Sterling OS™, our delivery operating system, runs every UAE PDPL engagement in five phases, each with named deliverables, decision owners and evidence. Your people carry as much of the work as you choose; method, software and accountability stay fixed.
- 01Design™Guided implementation: your team does the work with Sterling's method, templates, workshops and coaching behind it.
- 02Drive™Fully managed consulting: Sterling consultants take on the mapping, drafting and contracting with your teams and legal advisers.
- 03Sustain™Life after go-live: impact assessment support, a periodic look at requests and incidents, the annual internal audit, refreshers and induction training.
- 04Automate™One Effivity workspace for the special record, risks, impact assessments, requests, breaches, processors, transfers, audits and management review.
- 05Revise™Updates when the Executive Regulations, a Cabinet decision on penalties or new Data Office guidance arrive, or when your entities, systems or countries change.
The first week settles four things: engagement team, weekly session, deliverables and decision owners. Reviews then track progress against them, so a stalled decision surfaces in time.
How Sterling OS™ worksOften combined with
Standards organisations pair with PDPL (UAE)
- ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
- APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
- APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
- Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
- CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
- Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.
Effivity · UAE PDPL programme software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the UAE PDPL, Federal Decree-Law No. 45 of 2021.
Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries, comes with every Sterling UAE PDPL engagement. Your consultant configures one workspace for the programme within the agreed scope, so evidence is created as the work happens rather than assembled the week before a client audit. For Sterling consulting clients the Effivity subscription is included with the engagement, at no additional cost.
Purpose, minimisation and retention for each activity
Purpose, categories, retention and security on each activity's record, with retention dates that trigger deletion or anonymisation.
Consent, and the cases that do not need it
Per activity, the consent evidence (wording, date, any withdrawal) or the Article 4 case relied on, with the reasoning a reviewer will ask for.
The special record, generated rather than retyped
Built from the inventory: controller and DPO details, categories, access, processing periods, erasure mechanisms, cross-border movements and security measures, ready when the Data Office asks.
Processors, contracts and their own records
Each processor with its contract, scope, purpose, duration and next review; for processors themselves, the record Article 8 requires for each controller.
Incidents assessed, notified and closed
Triage, the notification decision for the Data Office and the people affected, processor alerts, corrective measures and a log that keeps unnotified incidents too.
Impact screening, assessment and sign-off
A short screening for new systems and projects; where Article 21 applies, the processing, its necessity and proportionality, risks, measures, the DPO's view and a review date.
Requests from individuals, intake to answer
One queue for every request, whatever the channel: identity checked, the right identified, any exception recorded with its reason, the reply stored, and automated decisions routed for human review.
Transfers, audits, training and review
Outbound flows with their routes, the internal audit plan and findings, Sterling Academy training records and management review decisions; forms and reports shaped to your work without code.
What this means at the audit
Client auditors ask for the special record, the latest impact assessment, the breach log, processor contracts and training records; the Data Office can call for the record at any time and looks into breach notifications and complaints. In Effivity each answer is already on screen with dates, owners and attachments, and Sustain™ keeps the same workspace running after go-live.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Existing inventories, registers and records migrated rather than retyped
- Admin and user training for your team
- Modules for ISMS, PIMS, QMS, BCMS and more as you add standards
UAE PDPL client experience
Client letters on file, available on request.
Signed client letters for UAE PDPL are available on request. The client feedback wall lists every letter by standard.
Programmes with the UAE PDPL in scope
Where the PDPL sits in a wider assurance programme.
- 01Integrated management systems
UAE groups with onshore and free-zone entities: one privacy programme, more than one regime
How such a programme runs: onshore companies follow the PDPL, any DIFC or ADGM entity is scoped under its own free-zone law, and ISO/IEC 27001 supplies the security controls both rely on. One inventory feeds each regime's records, one incident procedure routes breaches to the right regulator and one evidence base serves client audits; ISO/IEC 27701 certification can follow if customers want one.
Sterling Academy · UAE PDPL e-learning
Give every employee the PDPL basics, and your privacy team the depth.
Everyone from new joiners to the DPO learns through short video lessons, practice checkpoints and a final exam, and each learner who passes receives a numbered Certificate of Completion, verifiable online. Through their Sterling consultant, consulting clients receive preferential Sterling Academy course access and special pricing, including complimentary awareness training for their people as part of the engagement.
- PDPL awareness for every employee: personal and sensitive personal data, and what to do when a request or an incident arrives
- Practitioner courses for the DPO or privacy lead, process owners and the teams handling requests, marketing consent and suppliers
- Internal auditor training, as applicable to your standard, for the people who will audit the programme, as part of the engagement
- Completion tracked by department, with a report for a client auditor or the Data Office
- Induction training built in, so every new joiner is covered before the next review
- Questions from learners answered by a Sterling consultant
Where we work
Where Sterling delivers PDPL (UAE)
Keep exploring
Explore more about PDPL (UAE)
Watch a video on how to comply with UAE PDPL here.
Watch a video on UAE PDPL requirements here.
Why Sterling
Want successful UAE PDPL compliance? Come to Sterling.
A mainland business in one emirate, a group across onshore companies and free zones, a service centre abroad working on UAE data: the programme differs, the approach does not. Sterling sets up one PDPL programme with owners where the work happens, clear controller and processor roles and room for the sector laws and client contracts around it, with a Sterling office in Dubai.
60+ countries, one accountable lead
Management systems implemented for BPOs, technology firms, manufacturers, contractors and service businesses in 60+ countries since 2003, with one engagement team answerable wherever you operate.
All-inclusive proposal
One proposal covers consulting, Effivity, training and Academy access; legal, assessor and certification fees are listed on their own. No surprises, ever.
A programme people can follow
Documents only where they earn their place, and procedures, training and software shaped around how personal data really flows, so the programme survives your busiest month.
Expert and experienced consultants
Consultants with long experience of security and privacy management systems across sectors and countries since 2003, who get the programme right first time so the client audit confirms what already runs.
The Sterling Promise
What our UAE PDPL compliance success guarantee means
Our support continues until the agreed PDPL outcome is reached: data mapped, decisions on record, controls running, evidence in place and your people able to handle the next audit, request or incident unaided. Plain explanations, hands-on delivery, the software and the training turn the fee into lasting capability.
Entities, roles, scope, outcome and responsibilities are written into the engagement; you provide accurate information and access to the systems and contracts in scope, and operate the agreed controls. The UAE Data Office and your customers' auditors assess compliance and your legal advisers interpret the law; the commitment covers the agreed programme support, not a legal opinion and not a promise that no breach or complaint will occur.
After the programme is in place
What happens after UAE PDPL compliance?
Compliance has no finish line: systems, suppliers, campaigns, acquisitions and markets change what you process, and complaints and incidents keep arriving. The law will move too: the Executive Regulations and the penalties decision are not yet on the official portal, and related laws keep appearing, such as the 2025 Federal Decree-Law on child digital safety, which the portal lists alongside the PDPL.
Under Sterling OS™ Sustain™ we screen your new projects, go through requests and incidents with you, follow the Executive Regulations and Data Office guidance as they appear, refresh training and run the yearly internal audit.
FAQs
Frequently asked questions about the UAE PDPL
Is the UAE PDPL in force if the Executive Regulations have not been issued?
Yes; it has been in force since 2 January 2022. The Executive Regulations will add detail, including the period and procedure for breach notification, controls on transfers to countries without adequate protection and any further cases for processing without consent. Article 29 then allows six months to regularise, extendable by the Cabinet, and Article 26 leaves penalties to a Cabinet decision; as of September 2026 the official legislation portal lists neither. Six months is short for a first programme, so build now.
Is there a UAE PDPL certification?
No. The Decree-Law creates no certification scheme. ISO/IEC 27701 certification from an accredited body shows an audited privacy management system, and ISO/IEC 27001 evidences security, but neither is legal compliance with the PDPL. A "PDPL certified" seal sold for a fee is a badge, not a status.
Which organisations and data are outside the PDPL?
Article 2 excludes government data and government entities, personal data held by security and judicial authorities, individuals' processing for personal purposes, health data and banking and credit data that have their own legislation regulating their protection, and companies in free zones with their own data protection legislation, such as the DIFC (DIFC Law No. 5 of 2020) and ADGM; a group with entities onshore and in those zones deals with more than one regime. Article 3 also lets the Data Office exempt some establishments that do not process a large volume of personal data. Confirm sector exclusions with your legal advisers.
We are based outside the UAE. Does the PDPL apply to us?
Yes, if you process personal data of data subjects inside the UAE: Article 2 covers controllers and processors outside the State, such as a Manila contact centre serving a Dubai retailer or a European SaaS provider hosting a UAE client's customer data. As a processor, Article 8 applies directly and the client's contract sets scope, purpose and duration.
Can we rely on legitimate interests, as we do under the GDPR?
Not as a general ground. Article 4 prohibits processing without consent except in listed cases: the public interest, data the person made public, legal claims, occupational and preventive medicine, public health, archival and scientific purposes, the person's own interests, employment and social security obligations, a contract with the person, obligations under other UAE laws and further cases the Executive Regulations may add. Activities that rested on legitimate interests in a GDPR record need a fresh decision.
Do we need a data protection officer?
Article 10 requires one for processing with a high risk to confidentiality and privacy because of new technologies or volume, for systematic and comprehensive assessment of sensitive personal data including profiling and automated processing, and for large volumes of sensitive personal data. The DPO may be an employee or an authorised person, in or outside the UAE, and Article 12 protects the role. Record the decision and reasons either way.
What has to happen when a personal data breach occurs?
Under Article 9 the controller notifies the UAE Data Office on becoming aware of the breach, in line with the Executive Regulations, and tells the people affected where it would prejudice the privacy and confidentiality of their data; processors alert the controller as soon as they become aware. No number of hours is fixed, so act at once.
Can we transfer personal data to cloud providers, group offices or suppliers outside the UAE?
Yes, on the Article 22 and 23 routes. Article 22 covers cases the Data Office approves: legislation at the destination giving a proper level of protection, or a data protection agreement the UAE has joined with that country. Otherwise Article 23 allows transfers on grounds such as a contract binding the recipient to the law, express consent, a contract with or for the person, legal proceedings, international judicial cooperation or the public interest, subject to controls in the Executive Regulations. Record the route per flow.
What penalties does the UAE PDPL carry?
The Decree-Law sets no fine amounts. Article 26 leaves violations and administrative penalties to a Cabinet decision proposed by the Data Office's Director General; as of September 2026 none appears on the official legislation portal. The Data Office can impose penalties when a complaint is upheld or a breach investigation finds a violation, and its decisions can be challenged by written grievance within 30 days. Treat any quoted "PDPL fine" with caution until that decision exists.
What do you need to prepare a UAE PDPL proposal?
The entities and emirates involved, your role for the data, roughly how many systems and suppliers touch personal data, whether sensitive data is involved, what exists today and any fixed date. That is enough to scope the work and fix the fee; mapping comes later, inside the programme.
Before the first call
Prepare a useful UAE PDPL readiness brief
A data inventory can wait. A short description of the personal data you handle, and of who is asking, is enough; seven questions cover it:
- What triggered this: a client questionnaire, a contract clause, a Data Office enquiry or a question from your board?
- Which entities are involved, in which emirates or free zones, and does any sit in the DIFC or ADGM?
- For which activities are you a controller, and for which a processor acting for someone else?
- Where does personal data live: which systems, cloud services and suppliers, in which countries?
- Is any of it sensitive under the PDPL (health, biometric, criminal-record data and the like), and do you profile people or make automated decisions?
- What is already in place: notices, consent records, processing contracts, a breach procedure, ISO/IEC 27001 or a GDPR programme?
- Who will own the decisions and give the time, and is there a date the programme has to meet?
Seven answers are enough to size the work and fix the fee. They start a conversation; they are not a scored assessment and not legal advice.
Don’t be fooled by certification scams
If it takes ten days, it is not UAE PDPL compliance.
The PDPL has no certificate, and the shortcuts fill that gap: "PDPL certified" seals, one person's training certificate shown as the company's, GDPR template packs with the country swapped and a website privacy notice sold as the whole job. The saving lasts until a client's auditor asks for the special record or the Data Office asks how a breach was handled.
How to choose a credible UAE PDPL provider
- Ask for the list of outputs: the special record, a condition per activity, notices, processing contracts, impact assessments, procedures and trained staff, each with an owner.
- Question any certificate or seal on offer. The PDPL has no certification scheme; at most, a certificate shows that a management system such as ISO/IEC 27701 was audited by an accredited body.
- Check that the documents cite UAE law. Templates relying on legitimate interests or a 72-hour window were written for the GDPR and relabelled.
- Find out who does what, which legal, assessor or certification costs sit outside the fee, and who helps when an audit or incident tests the programme.
- Ask where the evidence will be kept and how staff will be trained. A programme on the consultant's laptop leaves with them.
- Decline "PDPL compliant in a week", "PDPL certified" badges and a privacy notice presented as compliance. The law requires processing that meets its conditions, and only an operating programme shows that.
Keep exploring
More on PDPL (UAE) and related standards
Talk to a consultant
Plan your UAE PDPL compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice