On this page
Need help with UAE data protection compliance? We run the full engagement for you and route the formal audit through our local partner firms in the UAE, so you deal with one team and get all your work done.
The UAE PDPL is often described as “the UAE’s GDPR”. The comparison helps, but it also misleads: the scope is narrower, the free zones run separate regimes, and much of the procedural detail sits in executive rules and Data Office guidance rather than the law itself. This guide focuses on what you can act on now.
Does the UAE PDPL apply to you?
- Law
- Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
- In effect
- January 2022
- Regulator
- UAE Data Office
- Applies to
- Controllers and processors in the UAE, and those abroad processing data of people in the UAE
- Separate regimes
- DIFC Data Protection Law and ADGM Data Protection Regulations
- Main carve-outs
- Government data, security and judicial authorities, health and banking data with their own laws
Work through three questions:
- Where are you established? If your entity is licensed in DIFC or ADGM, their own data protection law applies inside the zone, not the federal PDPL. Mainland and other free-zone companies are generally in scope.
- Whose data do you process? Processing data about people in the UAE brings you in scope even if you are based abroad.
- Is your data covered by its own law? Health data, banking and credit data, and government data are governed by sector-specific rules. Many companies hold a mix, so map which datasets fall where.
Financial firms in the UAE should also read our guide to VAPT reports for DIFC, ADGM and CBUAE, because their testing requirements often come from the financial regulator rather than the PDPL.
The key duties for businesses
Lawful processing and consent
Process personal data only on a lawful basis, most often clear and specific consent that people can withdraw, or one of the exceptions the law allows.
Transparency and rights
Tell people what you collect and why. Handle requests to access, correct, erase, restrict, object and receive their data in a usable format.
Security of processing
Apply appropriate technical and organisational measures, based on the nature of the data and the risk, to protect against unauthorised access, loss and alteration.
Breach notification
Notify the UAE Data Office of breaches that threaten the privacy or security of personal data, and inform affected individuals where required.
Accountability
Keep records of processing, appoint a data protection officer where the law requires one, and assess the impact of high-risk processing before you start it.
Cross-border transfers
Transfer personal data abroad only to adequate jurisdictions or under the alternative safeguards and conditions the law sets out.
Detail still comes from secondary rules
Timelines for breach notification, thresholds for appointing a data protection officer and the procedure for some rights are set by executive regulations and Data Office guidance rather than the law itself. Build your programme on the duties in the law and recognised security practice, and adjust the procedures as the Data Office publishes guidance.
Where security testing fits
The PDPL does not say “penetration test”. It says personal data must be protected with measures appropriate to the risk. If there is a breach, the Data Office and your customers will ask what you did to prevent it. Independent testing, with findings fixed and retested, is the clearest answer you can give.
- Applications and portals that collect personal data: test authentication, access control between users and data exposure in responses
- APIs and mobile apps: test the back-end APIs, which often expose more data than the screens show
- Cloud storage and databases: check for public buckets, exposed databases and over-broad access roles
- Third-party integrations: verify what data processors and plugins can reach
- Logging and detection: confirm unusual access to personal data would be noticed and investigated
- Incident response: rehearse how you would decide whether and when to notify the Data Office
A practical UAE PDPL compliance plan
- Map your data. List the personal data you hold, where it lives, why you hold it and who it is shared with, including processors and foreign transfers.
- Decide the regime. Separate data governed by the PDPL from data under DIFC, ADGM or sector rules.
- Fix the lawful basis. Review consent wording and the exceptions you rely on; make withdrawal easy.
- Build rights handling. Set up intake, identity checks and response tracking for data subject requests.
- Secure and test. Apply access control, encryption and logging, then test applications, APIs and cloud environments that hold personal data.
- Prepare for breaches. Write and rehearse an incident plan with a clear step for notifying the Data Office and affected people.
- Review transfers and vendors. Update processor contracts and confirm the basis for every transfer outside the UAE.
How Summit helps with UAE PDPL readiness
Summit helps UAE companies test and evidence the security measures the PDPL expects: web application VAPT, API security testing, mobile app VAPT and cloud security assessment, with reports that map findings to data protection risk. We work with our local partner firms in the UAE for formal audits and have supported 100+ clients across the Gulf, handling scoping, testing, remediation support and evidence end to end.
Want evidence your personal data is protected?
We can test the systems that hold your customers’ personal data and give you a prioritised fix list. Read our UAE PDPL compliance guide or get a quote.
Related reading: Saudi PDPL enforcement in 2026 · DPDP Rules 2025 deadlines and safeguards · Which compliance frameworks require penetration testing
Frequently asked questions
What is the UAE PDPL?
The UAE Personal Data Protection Law is Federal Decree-Law No. 45 of 2021, the country's first federal data protection law. It took effect in January 2022 and sets rules for processing personal data, individuals' rights, security, breach notification and cross-border transfers.
Does the UAE PDPL apply in DIFC and ADGM?
No. The financial free zones with their own data protection laws are outside the federal PDPL. DIFC has its Data Protection Law and ADGM has its Data Protection Regulations, each with its own regulator.
Does the UAE PDPL apply to companies outside the UAE?
Yes, in some cases. It covers controllers and processors inside the UAE and those outside the UAE that process personal data of people in the UAE.
Who regulates the UAE PDPL?
The UAE Data Office, established under a separate federal decree-law, is the federal data protection regulator. It issues guidance and handles complaints and breach notifications.
Does the UAE PDPL require penetration testing?
The law does not name penetration testing. It requires appropriate technical and organisational measures to protect personal data. Regular penetration testing of systems holding personal data is the most direct way to show those measures work.
What sectors are excluded from the UAE PDPL?
The law excludes, among others, government data and government entities, personal data held by security and judicial authorities, health and banking or credit data that have their own legislation, and free-zone companies subject to their own data protection laws.
