PrivacyTerrain

Editorial caveat

Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.

medium confidence, Federal UAE should eventually be modeled distinctly from major free-zone regimes such as DIFC and ADGM.

Child regimes: ADGM, DIFC

At a glance

Key presentation points

A compact summary of high-signal fields before the full structured record.

Effective statusin-force1 primary + 1 secondary • Reviewed 17/04/2026

Territorial scopeApplies to controllers and processors in the UAE and outside the UAE processing personal data of individuals in the UAE, subject to exclusions.1 primary + 1 secondary • Reviewed 17/04/2026

Regulator or enforcement authority summaryFederal UAE regulator structure distinct from DIFC and ADGM1 primary • Reviewed 17/04/2026

Requires legal basisYes1 primary + 1 secondary • Reviewed 17/04/2026

Structured record

Regulation details grouped by topic

Each value keeps its field context, linked sources, notes, and review date together to avoid detached or ambiguous statements.

Identity

Effective status: in-forceSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Law status: activeSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Effective date: 2022-01-02Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Last amended: 2021-09-20Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Scope

Extraterritorial application: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Territorial scope: Applies to controllers and processors in the UAE and outside the UAE processing personal data of individuals in the UAE, subject to exclusions.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Private sector coverage: Applies broadly to private-sector controllers and processors, except in exempt free zones with separate regimes.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Public sector coverage: Government entities may be excluded or subject to separate rules depending on the context.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Definitions

Personal data definition: Personal data means any data relating to a specific natural person or a natural person who can be identified.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Sensitive data recognized: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Legal Basis

Legal bases: consent, contract, legal obligation, public interest, legitimate interestsSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Requires legal basis: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Rights

Right of access: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to deletion: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to object: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to portability: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to appeal: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to erasure or delete summary: Erasure / deletion rightsSupport: 1 primary • Reviewed 17/04/2026Sources: UAE PDPL text (primary)Note: The UAE federal regime should be distinguished from DIFC and ADGM while still recognizing deletion-oriented rights.
Right to rectification or correction summary: Rectification rightSupport: 1 primary • Reviewed 17/04/2026Sources: UAE PDPL text (primary)Note: The federal UAE regime includes correction-oriented rights within its broader framework.

Breach

Breach deadline (hours): 0Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Breach notification required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Governance

DPO required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Impact assessment required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Records of processing required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Enforcement

Maximum fine: Penalties are expected through implementing regulations and enforcement practice rather than a single headline figure in the core law.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Private right of action: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Regulator or enforcement authority summary: Federal UAE regulator structure distinct from DIFC and ADGMSupport: 1 primary • Reviewed 17/04/2026Sources: UAE PDPL text (primary)Note: The UAE's regulator summary should preserve the distinction between the federal regime and financial free-zone frameworks.

Transfers

Cross-border transfer restricted: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Data localization required: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Marketing

Cookie consent rule: Online tracking analysis is shaped by consent, transparency, and emerging UAE digital regulation practice.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UAE PDPL text (primary); UAE Data Office guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Official sources

UAE PDPL textPrimary official law • en • html
UAE Data Office guidanceSecondary official material • en • html

United Arab Emirates