UAE PDPL questions and answers for business owners

Not legal advice. This page summarises the text of the law to help you plan. It is not a legal opinion. Confirm your obligations with a UAE-qualified lawyer or data protection adviser, and check whether the Executive Regulations and the Cabinet decision on penalties have been issued or updated.

Where the law comes from

The official text is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, on the UAE legislation portal. The government portal u.ae summarises it on its data protection laws page and links the official Arabic text (PDF), which is what we checked each answer against. The regulator is the UAE Data Office, set up by Federal Decree-Law No. 44 of 2021.

Does it apply to us?

Article 2 applies the law to:

• every data subject who lives in the UAE or has a place of business there;
• every controller or processor in the UAE, whether the people whose data it processes are inside or outside the country;
• every controller or processor outside the UAE that processes data of people in the UAE.

It does not apply to, among others:

• government data, and government entities that control or process personal data;
• personal data held by security and judicial authorities;
• a person processing their own data for personal purposes;
• health data and banking and credit data that have their own legislation;
• companies in free zones that have their own data protection law, such as ADGM and DIFC.

A group with an onshore company and a DIFC or ADGM company may answer to two regimes. Write down which entity holds which data before you decide anything else.

What counts as personal data?

Article 1 defines personal data as any data about an identified or identifiable person: name, voice, photo, ID number, online identifier, location, and physical, economic, cultural or social characteristics. Sensitive personal data includes family, ethnic origin, political or religious beliefs, criminal records, biometrics and health. In a normal office, that means HR files, passport and Emirates ID copies, payroll, CCTV, visitor logs, CRM records and the contents of mailboxes.

The rules you work under

Article 5 sets the processing rules. In plain terms:

1. Process fairly, transparently and lawfully.
2. Collect for a clear, stated purpose and do not reuse it for something unrelated.
3. Collect only what you need.
4. Keep it accurate and correct it when it is wrong.
5. Keep it secure against breach, unlawful processing, loss and damage.
6. Do not keep it after the purpose ends, unless it is anonymised.

Article 7 adds that a controller keeps a record of its processing: the categories of data, who can access it, the purpose, how long it is kept, cross-border transfers and the security measures. Article 20 requires security measures suited to the risk, such as encryption, pseudonymisation and the ability to restore data after an incident. Article 21 requires a data protection impact assessment before processing that uses new technology likely to create a high risk.

Data subject rights, one line each

• Information (Article 13): what data you hold, why, who receives it, how long you keep it and how to complain. Free of charge.
• Portability (Article 14): their data in a structured, machine-readable form, and moved to another controller where technically possible.
• Correction and erasure (Article 15): fix wrong data without undue delay; erase it when it is no longer needed, consent is withdrawn or processing was unlawful. There are exceptions, such as legal claims.
• Restriction (Article 16): pause processing while accuracy is disputed or a purpose is challenged.
• Stopping processing (Article 17): including for direct marketing and profiling linked to it.
• Automated decisions (Article 18): object to decisions made only by automated processing with legal or serious effects, and ask for a person to review them.

Article 19 says you must give people a clear way to contact you to exercise these rights. In practice, that is a named mailbox and a short internal procedure.

Breach notification

Article 9 requires the controller, once aware of a breach that would prejudice the privacy, confidentiality or security of personal data, to notify the UAE Data Office within the period and under the procedures set by the Executive Regulations. The notice covers the nature and cause of the breach, the approximate number of people and records, the data protection officer's details, the likely effects, the measures taken and the corrective action. Where the breach affects people's privacy, you must tell them too. A processor that finds a breach must tell the controller as soon as it knows.

The law does not fix a number of hours. Whatever period applies, you can only meet it if someone sees the alert, knows who decides and has logs that show what was accessed.

Sending data outside the UAE

Article 22 allows transfers to a country whose data protection legislation covers the points listed in the law, including the rights of data subjects and supervision by a regulator, or with which the UAE has a bilateral or multilateral data protection agreement. Article 23 allows transfers elsewhere in listed cases, including:

• a contract that binds the receiving company to the standards of the PDPL;
• the person's express consent, where it does not conflict with UAE public or security interests;
• where the transfer is needed to conclude or perform a contract with the person, or for legal claims.

For most companies this is a cloud question. Microsoft 365 tenants can store core data in the UAE when they qualify; check Microsoft's data residency overview and your tenant's data location. Then list every other SaaS tool your staff use and where it stores data.

Practical IT steps, in order

1. List your systems. Microsoft 365, ERP, HR and payroll, CRM, CCTV, visitor management, file servers, and the SaaS tools paid for on company cards.
2. Record what each holds: categories of personal data, sensitive data, where it is stored, who can access it, how long it is kept and who owns it. This becomes your Article 7 record.
3. Lock down access. MFA for every account, no shared admin logins, and a leaver process that removes access the same day. Our onboarding and offboarding checklist covers it.
4. Encrypt laptops and phones and make sure you can wipe a lost device.
5. Set retention. Delete or anonymise what you no longer need, including old exports and leavers' mailboxes, and remember that backups hold data too.
6. Make requests answerable. Test that you can find one person's data across mail, files and the ERP in a day.
7. Prepare for a breach. Alerts go to someone who reads them, logs are kept long enough to investigate, and a one-page procedure says who assesses, who decides and who notifies.
8. Check contracts with every vendor that touches personal data, including your IT provider, and note where each one stores data.

The detailed Microsoft 365 work (Purview labels, data loss prevention, retention and audit) is in our guide UAE PDPL compliance for IT teams. For phishing, the most common way personal data leaks from small offices, try the phishing examples quiz with your team.

Where Missan fits

We do the technical side: the system inventory, access control, Microsoft 365 configuration, encryption, logging and breach readiness, and the evidence your lawyer or DPO asks for. We do not give legal advice and we do not certify compliance. Missan Global has worked in UAE IT for 22+ years from its head office in Sharjah. How an engagement runs is on the PDPL compliance page.

Related Missan services

• PDPL compliance support (technical side)
• Microsoft 365, Copilot and Defender
• windream document management and retention
• Managed cybersecurity and MDR

Frequently asked questions

What is the UAE PDPL?

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. It sets rules for collecting and using information about identifiable people, gives those people rights over their data, and sets conditions for sending data outside the UAE. Article 31 says it took effect on 2 January 2022.

Does the PDPL apply to my company?

If you are an onshore UAE company that processes information about staff, customers or other individuals, very probably yes. Article 2 covers controllers and processors in the UAE, and also those outside the UAE who process data of people in the UAE. It excludes, among others, government data and government entities, security and judicial authorities, personal household use, health and banking data that have their own laws, and free zone companies that have their own data protection law, such as those in DIFC and ADGM.

Do I need consent for everything?

No. Article 4 bans processing without consent, then lists cases where it is allowed without it, including performing a contract with the person, meeting your obligations under employment and social security law, meeting other legal obligations, and legal claims. Where you do rely on consent, Article 6 says you must be able to prove it, it must be clear and simple, and the person must be able to withdraw it easily.

What rights do customers and employees have?

Articles 13 to 18 give a right to information about how their data is used (free of charge), to receive their data in a structured, machine-readable form, to correct or erase it, to restrict processing, to stop processing (for example for direct marketing), and to object to decisions made only by automated processing that have serious effects on them. Article 24 lets them complain to the UAE Data Office.

How quickly do we have to report a data breach?

Article 9 says the controller must notify the UAE Data Office once it becomes aware of a breach that would prejudice the privacy, confidentiality or security of personal data, within the period and under the procedures set by the Executive Regulations. The law itself does not name a number of hours. You must also tell the affected people where the breach affects their privacy. A processor must tell the controller as soon as it knows.

Can we store data outside the UAE, for example in a cloud service?

Yes, under conditions. Article 22 allows transfers to countries with data protection laws that meet the criteria in the law, or with which the UAE has a data protection agreement. Article 23 allows transfers elsewhere in listed cases, such as a contract that binds the receiving company to the PDPL standards, the person's express consent, or where the transfer is needed to perform a contract with them.

Do we need a Data Protection Officer?

Article 10 requires one when processing creates a high risk because of new technology or the volume of data, involves systematic evaluation of sensitive data including profiling, or covers a large volume of sensitive data. The officer can be an employee or an appointed outside person, inside or outside the UAE. Many owner-run companies name a responsible person even when the law does not require a formal DPO.

What are the fines?

Article 26 leaves the list of violations and the administrative penalties to a Cabinet decision. Check the current decision with your legal adviser rather than relying on figures quoted online.

Is this page legal advice?

No. It is a plain-language summary of the law text to help you plan. For decisions about your obligations, speak to a UAE-qualified lawyer or your data protection adviser. Missan helps with the IT side and does not certify compliance.

This guide is general information for planning, not legal or tax advice. Regulations and deadlines change; confirm the current position with the official source linked in the text and with your own advisers. Last reviewed 25/10/2026.