UAE PDPL Executive Regulations — What's Changing, and What It Means for Your Business
Federal Decree-Law No. 45 of 2021 is moving toward its long-awaited Executive Regulations. Here's what to expect, what to prepare for, and what to do in the next 90 days.
The UAE PDPL Executive Regulations are taking shape — organisations should be preparing now.
Federal Decree-Law No. 45 of 2021 was always going to need its Executive Regulations before full enforcement could begin. As implementing regulations progress, the compliance bar for UAE-facing organisations is rising. Here's the breakdown of what to expect, who it affects, and what your team should do to prepare — confirm exact timing and the specific Cabinet Decision reference against the UAE's Official Gazette before setting hard internal deadlines.
In Progress
Confirm the exact Cabinet Decision reference against the Official Gazette before relying on a specific date.
UAE mainland
Federal scope — DIFC & ADGM continue under their own data laws.
From publication
Controllers and processors must be compliant within the stated transition window.
UAE Data Office
Federal authority for guidance, complaints, and supervision.
The five biggest expected shifts under the Executive Regulations
The original Decree-Law set the principles. The Executive Regulations operationalise them — turning broad obligations into specific, audit-able controls. Here's what your DPO and CISO should be briefing leadership on:
- Lawful-basis tracking becomes formal Controllers must document the legal basis for every processing activity in a records-of-processing register. Consent, contract, legal obligation, vital interest, and legitimate interest are each defined with operational tests.
- Data subject rights carry response SLAs Access, correction, deletion, and portability requests carry binding response timelines. Internal workflows that can't meet the SLAs are non-compliant by default.
- Cross-border transfers tighten Transfers outside the UAE require either an adequacy decision, contractual safeguards, or explicit consent — with documented impact assessments for higher-risk destinations.
- Breach notification clock starts Reportable breaches must be notified to the UAE Data Office within a defined window, and to affected data subjects where risk is high. Pre-built incident response plans are no longer optional.
- DPO appointment criteria clarified The Executive Regulations specify when a Data Protection Officer is mandatory (sensitive data at scale, large-scale monitoring, certain regulated sectors) and define DPO independence, reporting line, and skills.
If you process UAE personal data, this applies to you
The PDPL — and its Executive Regulations — applies to controllers and processors operating in the UAE, plus any entity worldwide handling UAE residents' personal data. Sectors with immediate exposure include banking, FinTech, healthcare, telecom, e-commerce, SaaS, HR / payroll, marketing platforms, and any company running customer loyalty, CRM, or behavioural-analytics systems.
Outside the federal scope: DIFC firms (covered by DIFC Data Protection Law 2020) and ADGM firms (covered by ADGM Data Protection Regulations) continue under their own free-zone regimes — but cross-border data flows between mainland and these free zones still need PDPL-compliant safeguards.
A pragmatic plan for the next quarter
Don't treat this as a one-shot project. Treat it as a programme. Here's the sequence we run with ITSEC clients:
Data discovery & mapping
Inventory every system that touches personal data. Classify by category (basic, sensitive, biometric, financial). Map data flows in and out of the organisation.
Gap assessment against the Executive Regulations
Compare current controls against the regulation's enumerated requirements. Output: a prioritised remediation list with risk scores.
Policy & control implementation
Records of processing register, consent management, data subject request workflows, breach response runbook, cross-border transfer safeguards, DPO appointment if applicable.
Validation, training, audit-readiness
Tabletop exercises on breach response. Staff training. Mock audit. Documented evidence package for any future Data Office inquiry.
What non-compliance can cost
Administrative fines are set by Cabinet decision, with severity scaling against breach impact, intent, and remediation. In practice, the regulatory consequence chain has three layers:
Fines proportional to violation type and turnover. Repeat or aggravated offences carry escalated penalties.
Processing suspension orders, mandatory remediation programmes, regulator-supervised audits.
Public enforcement notices, loss of customer trust, knock-on impact on partner due-diligence checks.
Get a PDPL Executive Regulations gap assessment
ITSEC has supported UAE compliance programmes since 2011 — banks, healthcare, FinTech, telco, SaaS.
PDPL Executive Regulations 2026 — Questions, Answered
Everything UAE businesses are asking about the new Executive Regulations — from who's affected, to compliance timelines, to what the penalties actually look like.