The United Arab Emirates (UAE) has addressed the challenge of data privacy in the ever-evolving digital economy with the introduction of Federal Decree-Law No. 45 of 2021 regarding Personal Data Protection (PDPL). This law establishes the UAE’s first comprehensive federal data protection regime, aligning the country with international best practices and reinforcing its status as a global business hub.
What is the PDPL?
The PDPL provides a unified legal framework for the collection, processing, storage, and transfer of personal data across the UAE. Its primary objectives are to:
- Safeguard the personal data of individuals within the UAE.
- Ensure that privacy rights are respected and protected.
- Regulate how organizations in the UAE and abroad manages the data of UAE residents.
Personal data is broadly defined to include any information that can directly or indirectly identify an individual. This can range from names and ID numbers to location data, online identifiers, and details relating to one’s physical, mental, or social identity.
Scope and Applicability
The PDPL has wide reach. It applies to:
Organizations (data controllers and processors) based in the UAE, regardless of where the individuals are located
Entities outside the UAE that process the personal data of individuals residing in the UAE.
Key Exemptions
Certain entities are exempt from the law, including:
- UAE government authorities and government data.
- Personal data processed for purely personal or household activities.
- Data processed by security and judicial authorities.
Entities in financial free zones such as the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM), which have their own data protection frameworks.
Core Principles of Data Processing
The PDPL is built on widely recognized data protection principles, closely modeled after the EU’s General Data Protection Regulation (GDPR):
- Lawfulness, Fairness, and Transparency: Data must be processed lawfully, fairly, and transparently.
- Purpose Limitation: Data must be collected for specific, clear, and legitimate purposes and not further processed in a manner incompatible with those purposes.
- Data Minimization: Only data necessary for the specified purpose should be collected and processed.
- Accuracy: Data must be accurate, kept up to date, and corrected or erased if found to be inaccurate.
- Storage Limitation: Data should not be retained longer than necessary for the purpose for which it was collected.
- Security and Confidentiality: Appropriate technical and organizational measures must be in place to protect data against unauthorized access, loss, or unlawful processing.
Rights of Data Subjects
The PDPL gives individuals strong rights over their personal data, such as:
- Access: Request access to personal data and details about how it’s processed.
- Correction: Ask for inaccurate or incomplete data to be corrected.
- Erasure: Request deletion of data when consent is withdrawn or it’s no longer needed.
- Restriction: Request a temporary halt to processing in specific cases, such as when disputing accuracy.
- Data Portability: Receive data in a structured, machine-readable format and transfer it to another controller.
- Object to Processing: Object to processing for certain purposes, like direct marketing or legitimate interest.
- Automated Decisions: Contest decisions made solely through automated processing that significantly impact them.
- Withdraw Consent: Revoke consent at any time without affecting past lawful use.
- Lodge Complaints: File complaints with the UAE Data Office if rights are believed to be violated.
Obligations for Data Controllers and Processors
- Consent: Obtain clear, informed consent unless another legal basis applies.
- Record-Keeping: Keep detailed records of data processing activities.
- Security: Use strong technical and organizational measures to protect data.
- DPO Appointment: Designate a Data Protection Officer for high-risk or large-scale processing.
- DPIAs: Assess and mitigate privacy risks for high-risk processing.
- Breach Notification: Report data breaches to the UAE Data Office and notify affected individuals when required.
- Cross-Border Transfers: Only transfer data abroad if adequate protection or safeguards are in place.
Enforcement and Penalties
Non-compliance can lead to serious consequences:
- Fines ranging from AED 50,000 to AED 5 million—or more for repeated offenses
- Criminal penalties, including jail time for severe violations
- Civil claims from affected individuals
- Reputational damage that can hurt public trust and business continuity
The Role of the UAE Data Office
Established under a separate law (Federal Decree-Law No. 44 of 2021), the UAE Data Office oversees the implementation of the PDPL. It handles complaints, provides guidance, and enforces penalties for violations.
Conclusion
The UAE’s new Personal Data Protection Law (PDPL) represents a significant shift in data privacy management, granting more rights to individuals and imposing greater responsibilities on organizations. Businesses operating in or with the UAE need to immediately adjust their data practices to comply with this law and prepare for future updates to its executive guidelines. For help navigating the complexities of UAE’s PDPL and ensuring your business meets compliance requirements, GoTrust offers expert privacy research and simplifies these regulations into clear, actionable steps.