UAE PDPL Explained: Federal Decree-Law No. 45 of 2021

Deep dives: DPO / DPIA · PDPL checklist · Cross-border transfers · CSA for UAE PDPL.

The UAE’s federal privacy statute is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (commonly “UAE PDPL”). It sets nationwide rules for personal data processing outside certain carve-outs. DIFC and ADGM operate separate data-protection regimes for their financial free zones — mention them briefly when your processing sits there.

Federal vs free zones: Decree-Law 45/2021 is the federal PDPL. DIFC Data Protection Law and ADGM Data Protection Regulations are separate. Map which regime applies before designing notices and transfer tools.

Scope (High Level)

Applies to processing of personal data in the UAE and, in defined cases, to controllers/processors outside the UAE when offering goods/services to or monitoring individuals in the UAE — subject to the Law’s own territorial and material scope rules and exceptions (including certain government processing). Confirm exemptions with counsel.

Rights and Duties

Transparency and purpose limitation themes
Data subject rights (access, erasure, and related rights as defined)
Controller / processor obligations and security measures
Cross-border transfer conditions under implementing regulations

Breach Notification

Follow UAE PDPL implementing regulations for notifying the competent authority and individuals. Confirm current guidance for exact timing rather than assuming GDPR’s 72-hour rule.

How CyberSilo Helps

See UAE PDPL compliance services and CSA Privacy for evidence automation alongside NESA-oriented security programmes.

Clarify Federal vs Free-Zone Scope

Build one operating model that respects Decree-Law 45/2021 and DIFC/ADGM where needed.

Talk to CyberSilo Privacy Automation

Frequently Asked Questions

What is the citation for UAE PDPL?

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

Do DIFC rules replace the federal PDPL?

DIFC and ADGM have their own regimes for processing in those free zones. Federal PDPL applies according to its scope — get a jurisdictional map from counsel.

Is UAE PDPL identical to GDPR?

No. Themes overlap; obligations, transfers, and enforcement differ. See our comparison guide.

Saudi PDPL · Cross-border transfers · Services · CSA Privacy

UAE PDPL Explained: Federal Decree-Law No. 45 of 2021

Scope (High Level)

Rights and Duties

Breach Notification