UAE PDPL Executive Regulations — Current Status, and How to Prepare

Five areas to prepare, and what the Decree-Law already says

The Decree-Law sets the principles and leaves some details to the Executive Regulations. Until they are issued, this is what the law already requires, and where more detail is still to come:

• Document the lawful basis for each processing activity Under Article 4, processing needs consent or one of the listed exceptions, such as performing a contract, meeting a legal obligation or protecting the data subject's interests. The PDPL does not include a legitimate-interest basis.
• Get data subject request workflows ready Build workflows to handle requests from individuals about their data now, so they can adapt to any timelines the Executive Regulations set.
• Check your cross-border transfers Articles 22 and 23 allow transfers outside the UAE to countries with an adequate level of protection, and in other listed cases such as under a contract or with explicit consent. Detailed controls are left to the Executive Regulations (Article 23(2)).
• Prepare to notify breaches Breaches must be notified to the UAE Data Office, and to affected individuals where the breach would prejudice the privacy, confidentiality or security of their data (Article 9). The deadline will be set by the Executive Regulations, so have an incident response plan ready.
• Check whether you need a DPO Article 10 already requires a Data Protection Officer where processing poses a high risk because of new technology or data volume, involves systematic assessment of sensitive data including profiling, or covers a large volume of sensitive data. The DPO must have sufficient skills and knowledge.

If you process UAE personal data, this applies to you

The PDPL applies to controllers and processors in the UAE, and to those abroad that process personal data of people in the UAE (Article 2(1)). Article 2(2) excludes government data, security and judicial authorities, health data and banking or credit data governed by their own legislation, and free zones with their own data protection law.

Free zones: DIFC firms are covered by the DIFC Data Protection Law 2020 and ADGM firms by the ADGM Data Protection Regulations 2021. If your group has both onshore and free-zone entities, map which law applies to each.

A pragmatic plan for the next quarter

Don't treat this as a one-shot project. Treat it as a programme. Here's the sequence we run with ITSEC clients:

What non-compliance can cost

Article 26 leaves violations and administrative penalties to a Cabinet decision. No such decision appears on the UAE legislation portal (checked 23 September 2026), so there are no official fine amounts yet. The consequences fall into three areas: