The UAE's federal data protection law, Federal Decree-Law No. 45 of 2021, has been in force since 2 January 2022. Yet as of mid 2026 its Executive Regulations had still not been issued, and on 14 June 2026 the government announced a new Federal Authority for Artificial Intelligence and Data. This guide explains what the law already asks of businesses and what is still pending.
What the UAE PDPL is
The Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, is the general privacy law for onshore UAE. It was published on 27 November 2021 and came into force on 2 January 2022. Its regulator was set up as the UAE Data Office under a separate law, Federal Decree-Law No. 44 of 2021.
The law is consent based. Businesses may process personal data with the person's consent or under one of the exceptions the law lists. Unlike the GDPR, the PDPL has no general legitimate interests basis, so a company cannot simply weigh its own commercial interest against the individual's and proceed.
Where the PDPL does not apply
The PDPL does not cover government data, or health data and banking and credit data that are governed by their own laws. It also does not apply inside the two financial free zones, which run their own regimes: the DIFC Data Protection Law, DIFC Law No. 5 of 2020, and the ADGM Data Protection Regulations 2021.
This matters for groups with more than one UAE entity. A company licensed onshore in Dubai follows the PDPL, while a sister entity in the DIFC follows the DIFC law and registers with the DIFC Commissioner of Data Protection. Map each entity to its regime before writing a single privacy policy for the group.
Status of the Executive Regulations in 2026
The PDPL leaves many details, including administrative penalties, to Executive Regulations and a Cabinet decision. Law firm reports as of mid 2026 say these regulations have not been issued. As a result, practical enforcement has not started and no fine amounts are set.
On 14 June 2026 the UAE announced the Federal Authority for Artificial Intelligence and Data. It absorbs the functions of the Emirates Data Office, and reports at the time noted that the PDPL Executive Regulations were still outstanding. Businesses should expect the new authority to be the body that eventually issues guidance and enforces the law.
| Date | Event |
|---|---|
| 27 November 2021 | PDPL published |
| 2 January 2022 | PDPL in force |
| Mid 2026 | Executive Regulations still not issued, per law firm reports |
| 14 June 2026 | Federal Authority for AI and Data announced, absorbing the Data Office |
Core obligations already in the law
Even without regulations, the text of the PDPL sets clear duties. The table below lists the main ones by article so your team can check its processes against the law itself rather than waiting for secondary rules. Use it as the spine of a gap review: for each row, name the owner, the system or document that shows compliance, and the date it was last checked.
| Duty | PDPL reference | What it means in practice |
|---|---|---|
| Lawful basis | Articles 4 to 6 | Consent or a listed exception; no general legitimate interests |
| Records of processing | Articles 7(4) and 8(7) | Keep a written record of purposes, data, recipients and transfers |
| Processors | Article 8 | Use processors only under a binding contract |
| Breach notice | Article 9 | Tell the Data Office immediately and inform affected people |
| DPO | Articles 10 and 11 | Appoint one for high-risk or large-scale sensitive processing |
| Data subject rights | Articles 13 to 18 | Access, correction, erasure, restriction, objection, portability |
| Impact assessment | Article 21 | Run a DPIA before high-risk processing |
| Transfers | Articles 22 and 23 | Adequate country or a listed exception |
Breach notification under Article 9
A controller must notify the Data Office immediately on becoming aware of a breach that affects the privacy, confidentiality or security of personal data, and must also notify the affected data subjects. Processors must alert the controller as soon as they become aware. Because the regulator is being restructured, keep your incident plan flexible about the receiving body but strict about speed. Write the processor notice duty into every vendor contract so that a supplier breach reaches you without delay.
Cross-border transfers from onshore UAE
Articles 22 and 23 allow transfers to countries with an approved adequate level of protection, or under listed exceptions such as explicit consent or where the transfer is needed to perform a contract. The PDPL has no contractual safeguard route for countries that are not approved, so standard contractual clauses alone do not solve the problem as they might in the DIFC or ADGM.
In your privacy policy, disclose that data leaves the UAE, name the destinations or categories of recipients, and state which basis you rely on. For many SaaS businesses that will be explicit consent or contract necessity until adequacy decisions are published.
What to do now
Treat the PDPL as live law even though fines are not yet set. The duties in the text have applied since 2 January 2022, and building processes now avoids a rush once the regulations and fines are published. Before you publish or update a policy, you can run it through XDQ xAgents (https://xagents.xdqlabs.com), which checks a privacy policy against rules like these and flags missing clauses for review. This guide is general information, not legal advice. Confirm with a qualified lawyer.
- Confirm which UAE entities fall under the PDPL, DIFC or ADGM
- Record a lawful basis for every purpose, without relying on legitimate interests
- Build an incident plan that notifies the regulator immediately
- Document the transfer basis for each destination outside the UAE
- Watch for Executive Regulations from the new federal authority
Frequently asked questions
Is the UAE PDPL in force?
Yes. Federal Decree-Law No. 45 of 2021 has been in force since 2 January 2022. However, its Executive Regulations had not been issued as of mid 2026, so practical enforcement has not begun and the amount of administrative fines has not been set.
Does the UAE PDPL apply in the DIFC or ADGM?
No. The DIFC and ADGM free zones have their own data protection laws, DIFC Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021. The PDPL also excludes government data and health and banking data covered by their own laws.
Who enforces the UAE PDPL in 2026?
The law created the UAE Data Office as regulator. On 14 June 2026 the UAE announced the Federal Authority for Artificial Intelligence and Data, which absorbs the Data Office's functions. Businesses should expect guidance and enforcement to come from the new authority.
What are the penalties under the UAE PDPL?
None are set yet. Administrative penalties are to be fixed by a Cabinet decision and the Executive Regulations, which had not been issued as of mid 2026. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Sources
- Bird & Bird: UAE Federal Decree-Law on Personal Data Protection compared with GDPR, Bird & Bird, 2021
- Morgan Lewis: UAE establishes Federal Authority for Artificial Intelligence and Data (June 2026), Morgan Lewis, 2026
- Al Tamimi: UAE establishes new Federal Authority for AI and Data, Al Tamimi & Company, 2026
- DIFC Data Protection Law No. 5 of 2020 (official text, government.ae), UAE Government Portal (government.ae), 2020
- CMS: ADGM Data Protection Regulations, what businesses need to know, CMS
- CMS: DIFC Data Protection Law, CMS
