Data protection & privacy law in UAE (2026)

Legal framework

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), administered by the Emirates Data Office (established under Federal Decree-Law No. 44 of 2021); DIFC and ADGM financial free zones maintain parallel, independent GDPR-aligned regimes

Key points: data & privacy in UAE

1. 01Primary Law (PDPL)

   Federal Decree-Law No. 45 of 2021 is the UAE's first comprehensive, omnibus personal data protection statute, in force from 2 January 2022. It applies extraterritorially to any entity, domestic or foreign, processing personal data of individuals located in the UAE.

   uaelegislation.gov.ae u.ae

2. 02Supervisory Authority

   The Emirates Data Office, created by Federal Decree-Law No. 44 of 2021, is the mainland supervisory authority responsible for enforcement, issuing binding guidance, maintaining controller registers, and receiving data-breach notifications.

   u.ae resourcehub.bakermckenzie.com

3. 03Data Subject Rights & Legal Bases

   Data subjects hold rights to access, rectification, erasure, restriction of processing, and data portability, broadly comparable to GDPR. Consent is the primary legal basis for processing personal data; limited exceptions exist for public interest and legal obligations.

   uaelegislation.gov.ae u.ae

4. 04Free Zone Parallel Regimes

   DIFC operates under DIFC Data Protection Law No. 5 of 2020 (substantively amended by Amendment Law No. 1 of 2025, effective 15 July 2025, expanding individual rights and cross-border transfer rules); ADGM operates under its Data Protection Regulations 2021, each with an independent supervisory office and enforcement powers.

   adgm.com practiceguides.chambers.com

5. 05Cross-Border Transfers

   Transfers of personal data outside the UAE are permitted only to jurisdictions determined by the Emirates Data Office to provide adequate protection, or subject to approved safeguards such as standard contractual clauses or binding corporate rules.

   u.ae iclg.com

6. 06Penalties & Child Digital Safety

   The PDPL provides for administrative fines up to AED 5 million (~USD 1.36 million) and criminal penalties (minimum 6 months' detention) for serious violations. Federal Decree-Law No. 26 of 2025 on Child Digital Safety further imposes mandatory age verification, content-filter, and parental-control obligations on digital platforms, with elevated penalties for breaches involving minors.

   uaelegislation.gov.ae practiceguides.chambers.com

Timeline of decisions

1. 1 Oct 2025Law · official
   Child Digital Safety Law enacted (Federal Decree-Law No. 26/2025)

   Establishes a cross-sector federal framework banning collection of personal data of children under 13 without verifiable parental consent and prohibiting targeted advertising to minors; requires age verification, content filtering, and parental controls from all digital platforms and ISPs. Effective 1 January 2026 with a one-year compliance window.

   UAE Federal Legislation Portal (uaelegislation.gov.ae)

2. 8 Jul 2025Law · official
   DIFC Data Protection Law No. 5/2020 substantially amended (effective 15 July 2025)

   Most significant overhaul of the DIFC data-protection regime since 2020: introduced a statutory private right of action allowing data subjects to sue controllers directly before DIFC Courts without first filing with the Commissioner, expanded extraterritorial scope to any controller processing data in the DIFC, and tightened rules on disclosures to public authorities.

   DIFC Official Legal Database

3. 1 Jan 2023Guidance · official
   PDPL Executive Regulations issued (Cabinet Decision No. 111/2023)

   Detailed implementing rules for the 2021 PDPL: 72-hour mandatory breach notification to the Data Office and 7-day notification to affected individuals, DPO appointment conditions, cross-border data transfer whitelisting criteria, and mandatory Data Protection Impact Assessments for high-risk processing. Organizations received a six-month grace period; full enforcement deadline set for 1 January 2027.

   UAE Government Official Portal (u.ae)

4. 2 Jan 2022Law · official
   UAE PDPL and Cybercrime Law No. 34/2021 simultaneously enter into force

   Federal Decree-Law No. 45/2021 (PDPL) and Federal Decree-Law No. 34/2021 on Combatting Rumours and Cybercrimes became operative on the same date, creating a dual enforcement regime: civil/administrative penalties up to AED 10 million under the PDPL and criminal prosecution (including imprisonment) for unauthorised data access and disclosure under the Cybercrime Law.

   UAE Government Official Portal (u.ae)

5. 1 Jan 2022Law · official
   UAE Federal Personal Data Protection Law (PDPL) Enters Into Force

   Federal Decree-Law No. 45 of 2021 became operative, establishing the UAE's first comprehensive federal data protection regime with direct AI implications: rights to object to and seek human review of automated decisions, mandatory disclosure that interactions are AI-driven, and cross-border data transfer controls, forming the principal federal legal overlay on AI systems handling personal data.

   UAE Artificial Intelligence Office

6. 20 Sept 2021Law · official
   UAE Data Office and PDPL both enacted (Federal Decree-Laws No. 44 and 45/2021)

   Twin federal decrees on the same date: FDL No. 44/2021 established the Emirates Data Office as the national data-protection regulator with powers to issue guidance, set adequacy decisions for cross-border transfers, and levy fines; FDL No. 45/2021, the Personal Data Protection Law, created the UAE's first comprehensive federal privacy statute, introducing GDPR-style data-subject rights, consent requirements, sensitive-data categories, and data-minimisation principles.

   UAE Federal Legislation Portal (uaelegislation.gov.ae)

7. 14 Feb 2021Law · official
   ADGM Data Protection Regulations 2021 enacted

   Abu Dhabi Global Market replaced its 2015 regime with a GDPR-aligned framework introducing comprehensive data-subject rights, mandatory breach notification, DPO requirements, controller accountability, and restrictions on cross-border transfers. Came into force after a 12-month transition for existing ADGM entities and 6 months for new entrants.

   ADGM (Abu Dhabi Global Market)

Sources

1. 1.uaelegislation.gov.ae/en/legislations/1972/download
2. 2.u.ae/en/about-the-uae/digital-uae/data/data-protection-laws
3. 3.adgm.com/operating-in-adgm/office-of-data-protection
4. 4.adgm.com/media/announcements/abu-dhabi-global-market-enhances-data-protection-
5. 5.practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/uae/trends-and-developme
6. 6.iclg.com/practice-areas/data-protection-laws-and-regulations/uae
7. 7.resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/uae/topics/regulator