UAE PDPL Explained: Federal Decree-Law No. 45 of 2021

Scope (High Level)

Applies to processing of personal data in the UAE and, in defined cases, to controllers/processors outside the UAE when offering goods/services to or monitoring individuals in the UAE — subject to the Law’s own territorial and material scope rules and exceptions (including certain government processing). Confirm exemptions with counsel.

Rights and Duties

• Transparency and purpose limitation themes
• Data subject rights (access, erasure, and related rights as defined)
• Controller / processor obligations and security measures
• Cross-border transfer conditions under implementing regulations

Breach Notification

Follow UAE PDPL implementing regulations for notifying the competent authority and individuals. Confirm current guidance for exact timing rather than assuming GDPR’s 72-hour rule.

How CyberSilo Helps

See UAE PDPL compliance services and CSA Privacy for evidence automation alongside NESA-oriented security programmes.

Frequently Asked Questions

What is the citation for UAE PDPL?

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

Do DIFC rules replace the federal PDPL?

DIFC and ADGM have their own regimes for processing in those free zones. Federal PDPL applies according to its scope — get a jurisdictional map from counsel.

Is UAE PDPL identical to GDPR?

No. Themes overlap; obligations, transfers, and enforcement differ. See our comparison guide.

Related Privacy Resources

Saudi PDPL · Cross-border transfers · Services · CSA Privacy