The UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, is the federal law on how personal data is collected, used, shared and kept in the United Arab Emirates. It sets processing controls and lawful grounds, puts duties on controllers and processors, gives individuals rights, and is overseen by the UAE Data Office. Many detailed rules depend on Executive Regulations.
Free account needed to download. You come straight back to the file.
Who it is for. Controllers and processors in the UAE, and those outside it that process personal data of people in the UAE. It does not cover government data and authorities, health and banking or credit data under their own laws, or free-zone firms under special data laws, such as the DIFC and ADGM.
What this list covers. English translation of the Decree-Law as published by Lexis Middle East (a copy hosted on privacyarabia.com), issued 20 September 2021 and in force from 2 January 2022, read on 7 November 2026. The official portal (uaelegislation.gov.ae) refused automated access, and the UAE government site u.ae lists the official PDF in Arabic only, which is the authoritative text. The Executive Regulations the law calls for in Art. 28 were not read, so check the UAE Data Office for whether they have been issued and for later changes: 103 provisions. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| Art. 1 | Controller or processor | Work out which role you play for each activity. A controller decides how and why personal data is used. A processor acts only on the controller's instructions. Most duties below fall on one role or the other. |
| Art. 2(1) | Who and what the law covers | The law covers electronic or other structured processing by controllers and processors in the UAE, whoever the people are, and by those abroad who process data of people in the UAE. It also names people who live or work in the UAE. |
| Art. 2(2) | What is outside the law | Government data and authorities, data held by security and judicial bodies, personal use, health and banking or credit data under their own laws, and free-zone firms under special data laws are outside it. |
| Art. 3 | Exemption for small processors | The UAE Data Office may relieve establishments that do not process much personal data from some or all of the duties, on criteria in the Executive Regulations. Do not assume relief until it has been granted. |
| Art. 31 | Commencement | The law came into force on 2 January 2022. Some duties depend on Executive Regulations, so track which parts the Data Office has made operative. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 4 | Consent is the default | Do not process personal data without the person's consent unless one of the grounds in this article applies. Pick the ground before you start and record why it fits. |
| Art. 4(1) | Public interest | Rely on this ground only where the processing is needed to protect the public interest. |
| Art. 4(2) | Data made public by the person | You may process data that the person has themselves made available and known to the public. Check that they, and not someone else, put it there. |
| Art. 4(3) | Legal claims and proceedings | You may process data where needed to start or defend a claim or legal action, or for judicial or security procedures. |
| Art. 4(4) | Occupational and preventive medicine | Health bodies and employers may process data needed for occupational or preventive medicine, fitness-for-work checks, diagnosis, care, treatment, health insurance or running care systems, as the laws in force allow. |
| Art. 4(5) | Public health | You may process data needed to protect public health, such as controlling epidemics, or to keep healthcare, medicines and medical devices safe and of good quality, within the laws in force. |
| Art. 4(6) | Archiving and research | You may process data needed for archiving, or for scientific, historical or statistical studies, as the laws in force allow. |
| Art. 4(7) | Interests of the person | You may process data where it is necessary to protect the interests of the person it relates to. |
| Art. 4(8) | Employment and social security | Controllers and individuals may process data needed to meet duties or use legal rights in employment, social security or social protection law, but only as far as those laws permit. |
| Art. 4(9) | Contract | You may process data needed to perform a contract with the person, or to act on their request to make, change or end one. |
| Art. 4(10) | Duties under other UAE laws | You may process data needed to meet obligations that another UAE law places on controllers. |
| Art. 4(11) | Further grounds in the Executive Regulations | The Executive Regulations may add more cases where consent is not needed. Check them before relying on a ground that is not listed here. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 5(1) | Fair, transparent and lawful | Process personal data fairly, openly and lawfully. Say what you do with it in terms the person can follow. |
| Art. 5(2) | Specific purpose | Collect data for a specific, clear purpose and do not use it later in a way that clashes with that purpose. Use for a similar or closely related purpose is allowed. |
| Art. 5(3) | Adequate and limited | Hold only the data that is enough for the purpose, and no more. Review forms and feeds for fields nobody uses. |
| Art. 5(4) | Accuracy | Keep personal data accurate and correct, and update it whenever that is needed. |
| Art. 5(5) | Correction and erasure procedures | Have measures and procedures that make sure wrong personal data is corrected or erased. |
| Art. 5(6) | Secure by design | Keep data secure, and protected against breach, infringement and unlawful or unauthorised processing, with technical and organisational measures that follow the laws in force. |
| Art. 5(7) | Retention limit | Do not keep data after its purpose has been met. The one exception is data that has been anonymised so the person can no longer be identified. |
| Art. 5(8) | Further controls in the Executive Regulations | The Executive Regulations may add other processing controls. Watch for them and build them into your procedures. |
| Art. 6(1)(a) | Prove consent | If you rely on consent, be able to show that the person gave it. Keep a record of when, how and for what. |
| Art. 6(1)(b) | Clear and accessible consent | Ask for consent in a clear, simple, unambiguous and easy-to-reach way, in writing or electronically. |
| Art. 6(1)(c) | Say consent can be withdrawn | Tell people when they consent that they can withdraw it, and that doing so must be easy. |
| Art. 6(2) | Withdrawal of consent | Let people withdraw consent at any time. Processing done on the earlier consent stays lawful. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 7(1) | Protect and secure data | Take technical and organisational measures to protect personal data from being exposed, damaged, altered or tampered with, scaled to the nature, scope and purpose of the processing and the risks to privacy. |
| Art. 7(2) | Compliance by design | Build compliance with the law, including the Art. 5 controls, into the way you design and run processing. Pseudonymisation is one such measure. |
| Art. 7(3) | Privacy by default | Set default settings so that processing stays within its purpose, limiting how much data is collected, what is done with it, how long it is kept and who can reach it. |
| Art. 7(4) | Record of processing | Keep a record that names the controller and DPO, the data categories, who may access them, retention, erasure and change steps, purpose, cross-border flows and security measures. Give it to the Data Office on request. |
| Art. 7(5) | Choose processors with guarantees | Appoint only a processor that gives sufficient guarantees it can apply technical and organisational measures meeting the law, its Executive Regulations and the Data Office's decisions. |
| Art. 7(6) | Information for the Data Office | Give the Data Office any information it asks for in carrying out its functions, when a competent court has so decided. |
| Art. 7(7) | Further controller duties | Meet any other controller duties set in the Executive Regulations. |
| Art. 13(2) | Tell people before you start | Before processing begins, give each person the purposes of processing, the sectors or bodies their data will be shared with (in or outside the UAE), and the safeguards for cross-border processing. |
| Art. 19 | Ways to make a request | Give people clear and suitable channels to contact you and to ask to use any of their rights under the law. |
| Art. 21(1) | Impact assessment before new technology | Before starting processing that uses modern technologies posing a high risk to privacy, assess its impact on personal data protection, in proportion to its nature, scope and purpose. |
| Art. 21(2) | When an assessment is required | An assessment is needed for systematic, wide-ranging profiling or automated evaluation of a person that has legal effects or seriously affects them, and for large-scale processing of sensitive personal data. |
| Art. 21(3) | Contents of an assessment | Cover why and how the processing affects data protection, whether it is necessary and suitable, the risks to privacy and confidentiality, and the measures that reduce those risks. |
| Art. 21(4) | One assessment for similar processing | You may carry out one assessment that covers several processing operations of a similar nature and risk. |
| Art. 21(5) | Involve the DPO | Work with your Data Protection Officer when you carry out an impact assessment. |
| Art. 21(6) | Data Office list of exempt processing | Check the list the Data Office publishes on its website of processing for which no impact assessment is needed. |
| Art. 21(7) | Review the assessment | Review assessment results from time to time to make sure processing still matches them, particularly when the level of risk has changed. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 8(1) | Follow the controller's instructions | Process data only on the controller's instructions and under their contract, which should set out the scope, subject, purpose, nature, data types and categories of people. |
| Art. 8(2) | Protection at design stage | Build technical and organisational protection in when choosing the means of processing and during it, allowing for cost, nature, scope and purpose. |
| Art. 8(3) | Keep to purpose and period | Process for the set purpose and period, and tell the controller if processing will run past that period so it can extend it or give new directions. |
| Art. 8(4) | Erase or return data | When the processing period ends, erase the data or hand it back to the controller. |
| Art. 8(5) | No disclosure | Do not disclose personal data or the results of processing, except where the law permits it. |
| Art. 8(6) | Secure the operation and devices | Protect and secure the processing operation, and the media and electronic devices used for it and the data stored on them. |
| Art. 8(7) | Processor's record | Keep a record of data processed for the controller, covering the controller, processor and DPO, data categories, who has access, retention, erasure steps, purpose, cross-border flows and security. Give it to the Data Office on request. |
| Art. 8(8) | Prove compliance | Provide whatever is needed to show you comply, when the controller or the Data Office asks. |
| Art. 8(9) | Follow the rules and the Office | Process according to the law and its Executive Regulations, or as the Data Office directs. The Executive Regulations will set the detailed procedures and standards (Art. 8(11)). |
| Art. 8(10) | Several processors need a written agreement | Where more than one processor is involved, set out each one's roles and responsibilities in a contract or written agreement. Without one they are jointly liable for the duties. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 9(1) | Report a breach to the Data Office | On learning of a breach that would harm the privacy, confidentiality or security of data, report it with the investigation results within the Executive Regulations' period. Include the cause, scale, effects, DPO, actions and records. |
| Art. 9(2) | Tell the people affected | Tell each person whose data is affected, and what you have done, when the breach would harm their privacy, confidentiality or security. Follow the period set by the Executive Regulations. |
| Art. 9(3) | Processor tells the controller | As soon as a processor learns of a breach, it must notify the controller so the controller can report to the Data Office. |
| Art. 9(4) | Data Office review | Expect the Data Office to check how the breach came about and whether your security measures were sound, and to apply the administrative penalties if the law was broken. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 20(1) | Security matched to the risk | Controllers and processors must set a level of information security that fits the risks of processing, in line with the best international standards and practices. Examples are encryption, pseudonymisation, resilient systems, recovery and regular testing. |
| Art. 20(2) | What to weigh in setting the level | When judging whether security is enough, consider the risk of damage, loss, change, disclosure or unauthorised access to data in transit, storage and use, and the cost, nature, scope and purpose of processing. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 10(1) | When a DPO is needed | Appoint a DPO with enough data protection skill and knowledge if processing is high risk because of new technology or data volume, or involves systematic assessment of sensitive data, profiling or automated processing, or large amounts of sensitive data. |
| Art. 10(2) | DPO may be employed or contracted | The DPO may be an employee or someone you authorise, based inside or outside the UAE. |
| Art. 10(3) | Publish the DPO's contact details | Specify how the DPO can be contacted and tell the Data Office. The Executive Regulations will set the technologies and data volumes that trigger the duty. |
| Art. 11(1) | What the DPO does | The DPO checks the controller's or processor's compliance, checks procedures, takes requests and complaints, advises on regular testing and risk assessment, and acts as the contact point with the Data Office. |
| Art. 11(2) | DPO confidentiality | The DPO must keep confidential the information received in carrying out these duties. |
| Art. 12(1)(a)-(b) | Involve and resource the DPO | Involve the DPO properly and on time in every data protection matter, and give them the resources and support to do the job. |
| Art. 12(1)(c) | No penalising the DPO | Do not dismiss the DPO or discipline them for anything connected with doing their duties under the law. |
| Art. 12(1)(d) | Avoid conflicts of interest | Make sure the DPO is not given other duties that conflict with their data protection role. |
| Art. 12(2) | People may contact the DPO directly | Let people contact the DPO directly on any matter about their data and processing so they can use their rights. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 13(1) | Right to information | On request, and free of charge, tell people which of their data you process, why, any automated decisions, who it is shared with, how long it is kept, how to correct, erase or object, transfer safeguards, breach steps and how to complain. |
| Art. 13(3) | When you may refuse an information request | You may refuse a request that is unrelated to this information or excessively repetitive, conflicts with an investigation, could weaken your security, or affects other people's privacy. |
| Art. 14(1) | Right to receive data in portable form | Give a person their data in a structured, machine-readable form, where processing is automated and based on consent or needed for a contract. |
| Art. 14(2) | Right to transfer data | Pass a person's data to another controller when they ask, wherever that is technically feasible. |
| Art. 15(1) | Right to correction | Correct or complete inaccurate personal data without undue delay when the person asks. |
| Art. 15(2) | Right to erasure | Erase data on request when it is no longer needed, consent is withdrawn, the person objects and there is no legitimate reason to continue, or it was processed unlawfully. Legal rules and the public interest still apply. |
| Art. 15(3) | Where there is no right to erasure | Erasure need not follow for public health data held by private bodies, where it would hinder an investigation or legal claim, where another law conflicts, or in other cases set by the Executive Regulations. |
| Art. 16(1) | Right to restrict processing | Restrict and stop processing when the person contests accuracy (for long enough to check), objects to use beyond the agreed purposes, or the processing is unlawful. |
| Art. 16(2) | Keeping data for legal claims | Keep data after its purpose is met if the person asks, where they need it to make or defend a legal claim or proceeding. |
| Art. 16(3) | Processing despite a restriction | Processing may go on without consent if it is limited to storage, needed for legal claims or judicial procedures, protects third parties' rights, or protects the public interest. |
| Art. 16(4) | Tell the person when a restriction ends | Notify the person when you lift a restriction on processing. |
| Art. 17(1) | Objection to direct marketing | Stop processing a person's data for direct marketing, including profiling for it, when they object. |
| Art. 17(2) | Objection to statistical surveys | Stop processing for statistical surveys when the person objects, unless the processing is necessary in the public interest. |
| Art. 17(3) | Objection to processing that breaks Art. 5 | Stop processing when the person objects and the processing does not meet the Art. 5 controls. |
| Art. 18(1) | Right to object to automated decisions | Let people object to decisions made by automated processing, including profiling, that have legal effects or seriously affect them. |
| Art. 18(2) | Where automated decisions cannot be objected to | No right to object applies where the automated processing is a term of the contract with the person, is required by another UAE law, or the person gave prior Art. 6-compliant consent. |
| Art. 18(3) | Safeguards for those automated decisions | Even where objection is excluded, put suitable measures in place to protect the person's privacy and confidentiality, without prejudice to their other rights. |
| Art. 18(4) | Human review on request | Use people to review an automated decision when the person asks. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 22(1) | Transfer to a country with its own data law | Data may go to a country or territory that has its own data protection law covering core rules, privacy and confidentiality safeguards, people's rights, and enforcement against controllers by a regulator or court, in cases the Data Office approves. |
| Art. 22(2) | Transfer under an international agreement | Data may go to a country with which the UAE has a bilateral or multilateral agreement on personal data protection, in cases the Data Office approves. |
| Art. 23(1)(a) | Contract with a recipient in a country without a data law | Where the country has no data protection law, transfer under a contract that binds the recipient to the law's standards and names a competent regulator or court that can enforce them against it. |
| Art. 23(1)(b) | Express consent to transfer | Transfer abroad on the person's express consent, if it does not conflict with the security and public interest of the UAE. |
| Art. 23(1)(c) | Transfer for legal claims | Transfer where needed to meet obligations, or to make, use or defend rights before the courts. |
| Art. 23(1)(d) | Transfer to make or perform a contract | Transfer where needed to make or carry out a contract between the controller and the person, or between the controller and a third party in the person's interest. |
| Art. 23(1)(e) | Transfer for judicial cooperation | Transfer where needed for a step in international judicial cooperation. |
| Art. 23(1)(f) | Transfer for the public interest | Transfer where needed to protect the public interest. |
| Art. 23(2) | Executive Regulations on transfers | Meet the controls and conditions that the Executive Regulations set for transfers made on the Art. 23(1) grounds. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 24(1) | Right to complain to the Data Office | People who believe the law has been broken, or that their data is processed unlawfully, may complain to the Data Office under its procedures. Make sure your own complaint route is easy to find. |
| Art. 24(2)-(3) | How complaints are handled | Expect the Data Office to take the complaint, check it with you as controller or processor, and impose administrative penalties if it finds a breach of the law or its decisions. |
| Art. 25 | Grievance against a Data Office decision | A party affected by a Data Office decision or penalty may send a written grievance to its General Manager within 30 days of notice, and an answer is due within 30 days. A decision cannot be appealed without one. |
| Art. 26 | Administrative penalties | The Cabinet issues a decision listing the violations and administrative penalties, on the Data Office General Manager's proposal. The law itself sets no amounts, so check the decision when it is published. |
| Art. 28 | Executive Regulations | The Cabinet is to issue Executive Regulations within six months of the law's promulgation. Many duties above depend on them, so check the Data Office for their status. |
| Art. 29 | Regularising your position | Controllers and processors must bring themselves into line within six months of the Executive Regulations being issued. The Cabinet may extend that by a further six months. |
Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.
The Decree-Law came into force on 2 January 2022 (Art. 31). It also calls for Executive Regulations (Art. 28) and gives controllers and processors six months from their issue to comply (Art. 29). Check the UAE Data Office for the current status of the Regulations.
Art. 2(2)(g) leaves out companies and institutions in UAE free zones that are subject to their own data protection legislation. Firms in other parts of the UAE are in scope.
Art. 4 allows it in listed cases, among them the public interest, legal claims, public health, performing a contract, employment law and obligations under other UAE laws. Art. 4(11) lets the Executive Regulations add more.
Under Art. 10, a DPO is needed where processing is high risk because of new technology or data volume, involves systematic assessment of sensitive data including profiling, or covers a large amount of sensitive data. The Executive Regulations set the detail.
Art. 9 requires the controller to report a breach to the UAE Data Office, and to tell affected people, in the period the Executive Regulations set. A processor must tell the controller immediately it learns of one.
Art. 26 leaves the violations and administrative penalties to a Cabinet decision. The Decree-Law sets no amounts itself, so check that decision for the current figures.
No. It is a plain-English summary, written from an English translation, for working out what to do. The official Arabic text, the Executive Regulations and the UAE Data Office's guidance are the authority.