PDPL Data Protection Law UAE

United Arab Emirates

2021

Privacy

Overview

The PDPL is the UAE’s first comprehensive federal law on personal data protection, issued in 2021. It regulates how organizations collect, process, store, and transfer personal data while ensuring individual privacy rights. The law aligns with global standards (similar to GDPR) and is supervised by the UAE Data Office.

The regulation applies broadly to public and private sector entities, including banks, insurers, healthcare providers, telecom operators, tech companies, e-commerce platforms, and government entities operating in or targeting the UAE.

Key Obligations

Obtain clear consent before collecting or processing personal data
Process data only for legitimate, declared purposes
Grant individuals rights to access, correct, erase, or restrict their data
Restrict cross-border data transfers unless the recipient jurisdiction ensures adequate protection