The ADGM Data Protection Regulations 2021 were enacted on 14 February 2021 and have applied fully since February 2022, after a 12-month transition for existing firms. They follow the GDPR closely, require breach notice within 72 hours and allow fines of up to USD 28 million for administrative breaches. Here is what firms in Abu Dhabi Global Market need to have in place.
Scope and timeline
The ADGM Data Protection Regulations 2021 apply to entities established in, or operating from, the Abu Dhabi Global Market financial free zone. The regulator is the ADGM Office of Data Protection, led by the Commissioner of Data Protection. The UAE federal PDPL does not apply inside ADGM. The regulations were enacted on 14 February 2021. Establishments incorporated before that date had a 12-month transition, which ended in February 2022, and new establishments had 6 months. The regulations have been fully applicable since February 2022.
Accountability duties
ADGM firms must keep records of processing, run data protection impact assessments for high-risk processing and put written contracts in place with processors. A data protection officer is required in defined cases, with an exemption for firms with fewer than five employees unless their processing is high risk. Controllers must also file an annual notification with the Office of Data Protection and pay a data protection fee. Treat this like a licence renewal: missing it is an easy failure for a regulator to spot.
- Records of processing activities
- DPIA before high-risk processing
- DPO where required (under five employees exempt unless high risk)
- Written processor contracts
- Annual notification and data protection fee
- Policy document for special category data
Rights individuals can use
Individuals in ADGM have rights of access, correction and deletion, restriction, objection, data portability and the right to object to certain automated decision-making. Where consent is the basis, they can withdraw it at any time. Build one intake channel for all of these requests and record the date received, the identity check and the outcome. That record is often the first thing a regulator asks for in a complaint.
Breach notification within 72 hours
A controller must notify the Commissioner within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to risk data subjects' rights. If the notice is late, it must give reasons for the delay. Where a high risk to individuals is likely, the controller must also tell affected data subjects without undue delay.
ADGM's fixed 72-hour window is stricter in form than the DIFC standard of notifying the Commissioner as soon as practicable under Article 41(1) of the DIFC law. A group with entities in both centres can run a single 72-hour process to satisfy both.
ADGM compared with DIFC and onshore UAE
The three UAE regimes differ in ways that matter for multi-entity groups. The table summarises the points most often confused. A group with entities onshore, in the DIFC and in ADGM needs to meet all three, and the safest internal standard usually takes the strictest point from each column.
| Point | ADGM | DIFC | Onshore UAE PDPL |
|---|---|---|---|
| Law | Data Protection Regulations 2021 | DIFC Law No. 5 of 2020 | Federal Decree-Law No. 45 of 2021 |
| Breach notice | 72 hours | As soon as practicable | Immediately |
| Top fine | USD 28 million (administrative) | USD 100,000 per contravention (Schedule 2); serious fines uncapped | Not yet set |
| Regulator filing | Annual notification and fee | Notification of processing, kept current | Not verified |
| Regulator | ADGM Office of Data Protection | DIFC Commissioner of Data Protection | Data Office, moving to the Federal Authority for AI and Data |
Transfers out of ADGM
Transfers outside ADGM need an adequacy decision, appropriate safeguards such as standard contractual clauses, or a specific derogation. Importantly, onshore UAE is not treated as an adequate destination for ADGM purposes, so sending data from an ADGM entity to a group company in Dubai or Abu Dhabi city needs a transfer mechanism. List every transfer in your record of processing and disclose them in the privacy policy, including the mechanism used for each.
Fines and next steps
Fines can reach USD 28 million for administrative breaches, and larger fines are possible for more serious violations. That is far above the reported DIFC Schedule 2 cap, so ADGM firms should not assume the two centres carry similar risk.
Start with the annual notification, the 72-hour breach plan and the onshore transfer gap. To check an ADGM privacy policy, XDQ xAgents (https://xagents.xdqlabs.com) flags missing rights, transfer disclosures and breach commitments. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Frequently asked questions
Does the UAE PDPL apply in ADGM?
No. ADGM has its own ADGM Data Protection Regulations 2021, enforced by the ADGM Office of Data Protection. The federal PDPL excludes the ADGM and DIFC free zones, so ADGM entities follow the ADGM regulations instead.
What is the ADGM breach notification deadline?
72 hours from becoming aware of the breach, unless it is unlikely to risk individuals' rights. Late notices must explain the delay, and affected individuals must be told without undue delay where a high risk to them is likely.
Do small ADGM firms need a DPO?
Firms with fewer than five employees are exempt from appointing a data protection officer unless their processing is high risk. Other firms must check whether they fall within the defined cases that require a DPO under the regulations.
Is onshore UAE adequate for ADGM data transfers?
No. Onshore UAE is not treated as adequate for ADGM purposes, so transfers to group companies outside ADGM need safeguards such as standard contractual clauses or a derogation. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Sources
- Taylor Wessing: New ADGM data protection law, key changes, Taylor Wessing, 2021
- CMS: ADGM Data Protection Regulations, what businesses need to know, CMS
- DIFC Data Protection Law No. 5 of 2020 (official text, government.ae), UAE Government Portal (government.ae), 2020
- Baker McKenzie: DIFC regulators, enforcement priorities and penalties, Baker McKenzie
- Bird & Bird: UAE Federal Decree-Law on Personal Data Protection compared with GDPR, Bird & Bird, 2021
- Morgan Lewis: UAE establishes Federal Authority for Artificial Intelligence and Data (June 2026), Morgan Lewis, 2026
