UAE Personal Data Protection Law

UAE PDPL

Federal Decree-Law No. 45/2021, the UAE's first comprehensive personal data protection law. Enforced by MoIAT. Applies to all data processing in the UAE except within ADGM and DIFC, which have their own data protection regimes.

Key Requirements

• Establish a lawful basis for processing (consent, contract, vital interests, or legitimate interests)
• Respond to data subject access, correction, and erasure requests
• Notify the data protection authority within 72 hours of a personal data breach
• Conduct a Data Protection Impact Assessment (DPIA) for high-risk processing
• Restrict cross-border transfers to countries with adequate protection or with appropriate safeguards
• Disclose automated decision-making to affected individuals

Related Documents (1)