PDPL Data Protection Law UAE
United Arab Emirates
2021
Privacy
Overview
Key Obligations
- Obtain clear consent before collecting or processing personal data
- Process data only for legitimate, declared purposes
- Grant individuals rights to access, correct, erase, or restrict their data
- Restrict cross-border data transfers unless the recipient jurisdiction ensures adequate protection
- Appoint a Data Protection Officer (DPO) in certain high-risk cases
- Notify the UAE Data Office and affected individuals of data breaches
- Maintain records of processing activities and implement security safeguards
Stay ahead of risk with Signzy
Explore tools that help you onboard, monitor, and verify with confidence
Transaction Monitoring
Monitor transactions in real-time and analyse past behaviour to identify suspicious activities and ensure regulatory compliance across the user journey.
Business Verification
Verify businesses with reliable documents OCR, EIN checks, UBO data, sanctions screening, global registry checks, and more.
MENA API Marketplace
A comprehensive API marketplace for the Middle East and North Africa, offering localized verification and compliance solutions.
Related Regulations
FAQ
Who regulates the PDPL in the UAE?
The UAE Data Office is the national supervisory authority.
Does the law apply to companies outside the UAE?
Yes, if they process personal data of individuals in the UAE.
Are data transfers outside the UAE allowed?
Yes, but only to countries deemed to provide adequate protection, or with approved safeguards.
What are the penalties for non-compliance?
Administrative fines, business restrictions, and potential criminal liability depending on severity.