Data protection in the UAE: three regimes in one country
The federal law has been in force since 2022 but is not yet an operative enforcement regime. The free zones are a different story — and one of them now lets data subjects sue directly for distress.
The United Arab Emirates does not have a single data protection regime. It has a federal law, at least two substantial free-zone regimes with their own commissioners, sectoral rules for health and banking data, and a criminal provision that in practice does more work than any of them. Advising accurately means establishing which of these applies to the entity in question before anything else.
The federal law
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data came into force on 2 January 2022. Its structure is broadly recognisable to anyone familiar with the European model.
Scope (Article 2). The law applies to data subjects resident in the UAE; to controllers and processors in the UAE processing the data of subjects inside or outside the country; and to controllers and processors outside the UAE processing the personal data of UAE-resident data subjects.
Exclusions (Article 2). These are broad and are the practical crux. The law does not apply to government data or government authorities; security and judicial authority data; personal data processed by an individual for purely personal purposes; health data governed by separate legislation; banking and credit data governed by separate legislation; or entities in free zones that have their own data protection legislation.
Lawful processing (Article 4). Processing without consent is permitted in a list of circumstances including public interest, data made public by the subject, legal claims and judicial procedures, occupational or preventive medicine, public health, archival and research purposes, protection of the subject’s interests, employment and social-security obligations, contract performance, and other statutory obligations.
Processing controls (Article 5). Fair, transparent and lawful processing; specific purposes; adequacy; accuracy; security; and retention no longer than necessary.
Consent (Article 6). The controller bears the burden of proof. Consent must be clear, simple, unambiguous and easily accessible, in writing or electronic form, and withdrawable at any time without affecting the lawfulness of prior processing.
Breach notification (Article 9). The controller must notify the Data Office immediately on becoming aware of a breach, setting out its nature, causes, the affected records, the data protection officer’s contact details, expected effects and corrective measures — and must notify affected data subjects where the breach prejudices confidentiality. Processors notify controllers. Note that the timing of the notification to data subjects is left to the Executive Regulations, which have not been issued; that limb therefore has no operative timeline at present.
Data protection officer (Article 10). Required where processing poses high-level risk, involves systematic assessment of sensitive data, or involves large volumes of sensitive data. The officer may be based inside or outside the UAE.
Data subject rights (Articles 13 to 16). Access; portability; correction and erasure; and restriction of processing.
Impact assessment (Article 21). Required for new technologies posing high risk.
Cross-border transfer (Articles 22 and 23). Transfer is permitted to countries with adequate legislation or under a bilateral or multilateral agreement, and otherwise under contractual safeguards, express consent, contractual necessity, international cooperation, or public interest.
The honest position on enforcement
Article 28 required Executive Regulations to be issued within six months. Article 29 gave controllers and processors six months from issuance, extendable, to come into compliance.
As at August 2026, the Executive Regulations have not been issued.
The consequences should be stated plainly to any client, because a great deal of commentary presents the UAE as having a functioning European-equivalent regime:
- The six-month deadline in Article 28 has been missed by more than four years.
- The compliance clock in Article 29 has not started, because it runs from issuance of the Regulations.
- Penalties remain undefined. The law leaves violations and administrative penalties to a Cabinet decision that has not been published.
- The UAE Data Office, established by Federal Decree-Law No. 44 of 2021, is not fully operational, with the telecommunications and digital government authorities providing administrative support during a transitional period.
- Regulatory enforcement to date has been effectively nil. Compliance is driven by internal assessment and contractual requirements, not by regulatory action.
The accurate formulation is that the federal PDPL is in force but not yet operative in any practical enforcement sense. Organisations should nonetheless build to it — the obligations exist, the Regulations may issue at any time, and the compliance window will be short once they do — but they should not be told that a federal regulator is currently policing the law.
Sectoral regulators continue to operate within their own domains, and the criminal route described below is live.
The DIFC
The Dubai International Financial Centre operates Data Protection Law No. 5 of 2020, administered by its own Commissioner of Data Protection, amended by DIFC Law No. 2 of 2022 and by the DIFC Laws Amendment Law No. 1 of 2025, enacted on 8 July 2025.
Article 10 sets out the lawful bases: consent, contract, legal compliance, vital interests, DIFC body functions, and legitimate interests subject to a balancing test.
Article 28 governs data sharing with authorities, and now requires a controller to exercise reasonable caution and diligence to determine the validity and proportionality of an authority’s request and to assess the impact on data subjects’ rights. This is a genuinely useful provision where a client is asked to hand over personal data on an informal or foreign request.
Article 64A — the private right of action. Introduced in 2025, this allows data subjects to sue controllers and processors directly in the DIFC Courts for contraventions causing damage, including non-financial loss such as distress, without first going to the Commissioner.
This is the most significant development in UAE data protection for some time. It is the closest thing in the country to a common-law privacy claim, it is heard in an English-language common-law court, and it does not depend on a regulator choosing to act. For a client harmed by the mishandling of their personal data by a DIFC entity, it is a real and immediate remedy where the federal law currently offers none.
The 2025 amendments also clarified territorial scope, tightened Article 28, and increased fines for several contraventions, including for failures relating to impact assessments and to Article 28 itself. A separate regulation made in 2023 addresses artificial intelligence and autonomous systems in data processing — among the earliest such rules at this level anywhere.
ADGM
The Abu Dhabi Global Market operates Data Protection Regulations 2021, enacted in February 2021 and applied to new entities from August 2021 and existing entities from February 2022, administered by its own Commissioner and Office of Data Protection.
Two features distinguish it:
- Registration with the Commissioner is required before processing begins — a divergence from both the DIFC and the federal regime, and an easy compliance failure for a newly incorporated entity.
- Breach notification is within 72 hours to the Commissioner, with affected individuals notified promptly subject to exemptions.
Rights include access, rectification, erasure, portability, objection and the right to contest automated decision-making. Cross-border transfers rest on adequacy determinations by the Commissioner, or on consent, contracts, binding corporate rules or standard contractual clauses. Separate rules made in September 2025 permit the processing of sensitive data without consent in narrow circumstances relating to insurance and to safeguarding vulnerable individuals.
Where a fine level or a specific procedural requirement matters to a decision, it should be confirmed against the current ADGM rulebook rather than secondary sources.
The criminal route that is actually enforced
While the administrative regime develops, Article 6 of Federal Decree-Law No. 34 of 2021 makes the unauthorised acquisition or dissemination of personal data by electronic means a criminal offence, carrying a minimum of six months’ imprisonment and/or a fine of AED 20,000 to 100,000, aggravated for medical, financial and health data. Article 44 covers the publication of images without consent.
For an individual whose personal data has been misused or published in the UAE, this is currently the most direct route — and it is available now, without waiting for regulations.
What to do with this
If you operate in the UAE. Establish which regime governs each entity in your structure. An onshore company, a DIFC entity and an ADGM entity in the same group are subject to three different sets of obligations, and internal data flows between them may be cross-regime transfers.
If you are building for compliance. Build to the federal law’s substantive obligations now. They are in force, and the compliance window once the Regulations issue will be short.
If you have been harmed. Identify who holds the data and where. If it is a DIFC entity, the direct claim under Article 64A is likely the strongest route. If the conduct is a misuse or publication of personal data by any party, the criminal provisions are enforceable today.
If you are advising from outside. Do not describe the UAE as having a functioning federal data protection enforcement regime. It has a law in force, a regulator that is not yet fully operational, undefined penalties, two active free-zone regimes, and a criminal statute that is doing the work in the meantime.
It describes the law as understood at the date of review and does not take account of your circumstances. Law and platform practice both change. Reading it does not create an advocate–client relationship with JM Sons Advocates. Before acting or deciding not to act, take advice on your own facts.