UAE PDPL Compliance — Data Protection Cybersecurity

The PDPL (Federal Decree-Law No. 45 of 2021) has been in force since 2 January 2022. Under Article 29, controllers and processors must comply within six months of its Executive Regulations being issued, and the Cabinet may extend this period. The Executive Regulations have not yet been issued: none are listed on the UAE legislation portal (checked 23 September 2026), so no compliance deadline is running yet. We advise building to the Decree-Law's requirements now.

We strongly recommend beginning your compliance journey now rather than waiting for the implementing detail. Building the required technical and organizational measures — from data mapping to consent management systems — typically takes 4-8 months depending on organizational complexity.

The PDPL excludes companies in UAE free zones that have their own data protection legislation (Article 2(2)). DIFC (Dubai International Financial Centre) and ADGM (Abu Dhabi Global Market) both have such regimes. DIFC operates under its own Data Protection Law (DIFC Law No. 5 of 2020) enforced by the Commissioner of Data Protection, while ADGM has its own Data Protection Regulations 2021.

Groups with both onshore and free-zone entities may need to follow more than one data protection framework, so map which law applies to each entity.

A Data Protection Impact Assessment (DPIA) is a risk evaluation expected under the PDPL for processing activities that pose a high risk to data subjects' rights and freedoms. Article 21 requires one before processing that uses new technologies posing a high risk, and for large volumes of sensitive data or systematic assessment such as profiling.

A DPIA should describe the nature and purpose of processing, assess necessity and proportionality, identify risks to data subjects, and detail the measures implemented to mitigate those risks. Organizations should conduct DPIAs before initiating high-risk processing and keep documented records available for the UAE Data Office on request.

The PDPL does not universally mandate a Data Protection Officer. Article 10 requires one where processing poses a high risk because of new technologies or data volume, involves systematic and comprehensive assessment of sensitive personal data (including profiling and automated processing), or covers a large volume of sensitive personal data. The Executive Regulations may add further detail.

Under Article 11, the DPO checks the organisation's data protection procedures, receives requests and complaints, gives technical advice, and serves as the link with the UAE Data Office. Even where not strictly required, appointing a DPO demonstrates a commitment to data protection best practices.

Under the PDPL, transferring personal data outside the UAE is permitted only under specific conditions. Under Article 22, in cases approved by the UAE Data Office, the destination must have data protection legislation with a supervising authority, or the UAE must be party to a bilateral or multilateral agreement with it.

If neither applies, Article 23 permits transfers under a contract or agreement binding the recipient to PDPL-equivalent measures, with the data subject's explicit consent, where necessary for a contract or legal claims, for international judicial cooperation, or to protect the public interest. Organizations should conduct a transfer risk assessment before initiating cross-border data flows and maintain documentation of all transfer mechanisms used. The detailed controls are left to the Executive Regulations (Article 23(2)).

While the PDPL is inspired by GDPR and shares many foundational principles, there are key differences. The PDPL is enforced by the UAE Data Office (rather than national DPAs), does not explicitly recognize "legitimate interest" as a processing basis the way GDPR does, and leaves administrative penalties to a Cabinet decision (Article 26), rather than setting a statutory ceiling as GDPR does (up to €20M or 4% of worldwide annual turnover).

The PDPL also has unique provisions for UAE free zones — DIFC and ADGM maintain separate data protection regimes, whereas GDPR is unified across EU member states. The DPO requirement is not universal under the PDPL, and several operational details that GDPR specifies directly are instead left to the PDPL's Executive Regulations, which have not yet been issued. Organizations operating in both jurisdictions should implement a harmonized compliance framework that satisfies both regimes.

Under Article 9, the PDPL requires notification to the UAE Data Office, and to the affected data subjects, of a breach that would prejudice the privacy, confidentiality or security of their personal data. No notification deadline is fixed yet: the period is left to the Executive Regulations, which have not yet been issued. For comparison, ADGM applies 72 hours and DIFC requires notice as soon as practicable; we advise building to a 72-hour standard.

Article 9 says a notification should describe the nature, form and causes of the breach and the approximate number of records affected, give the DPO's details, set out the likely effects and the corrective measures taken or proposed, and include supporting documentation. Organizations should maintain a documented incident response plan, run regular breach simulation drills, and keep a breach register recording all incidents regardless of whether notification was required.

PDPL compliance costs vary significantly based on organizational size, complexity, and current maturity level. SMEs with straightforward data processing activities may invest AED 50,000-150,000 for a complete compliance program, while large enterprises with multiple subsidiaries, cross-border operations, and complex data ecosystems may require AED 300,000-1,000,000+.

Key cost factors include data mapping and gap assessment, policy and procedure development, technology investments (consent management, DSAR portals, encryption), staff training, and ongoing monitoring. These costs should be weighed against administrative penalties (to be set by Cabinet decision under Article 26), plus reputational damage and operational disruption. ITSEC offers scalable compliance packages tailored to your organization's specific needs and budget; contact us for a customized assessment.