Data Privacy & Regulation

UAE PDPL Compliance Consulting

UAE PDPL · Personal Data Protection Law (United Arab Emirates)

For organizations in the UAE and companies processing personal data of people in the Emirates. We confirm which UAE data protection law applies, map personal data, assess gaps against Federal Decree-Law No. 45 of 2021, and design notices, rights, breach and transfer processes.

Reviewed by Santhosh Kapalavai, CISA, CISM, CCISO, HITRUST CCSFP, CHQP, ISO/IEC 27001 Lead Auditor

What is UAE PDPL?

The UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, is the UAE's federal data protection law. It sets rules for lawful processing, individuals' rights, security, breach notification and cross-border transfers. Entities in the DIFC and ADGM free zones follow their own data protection laws instead.

Key Focus Areas

Lawful processing and consent

Data subject rights

Security of processing

Breach notification

Cross-border data transfers

Data protection officer requirements

Processor obligations

Sensitive personal data

What our engagement includes

Applicability review across federal law and free zones

Personal data inventory and records of processing

Gap assessment against the UAE PDPL

Privacy notices, consent and rights procedures

Breach notification and cross-border transfer processes

Staff awareness training

How the engagement works

Applicability review

Confirm which UAE law applies to each entity, including free-zone status.

Data mapping

Identify personal data, purposes, systems, vendors and transfers.

Gap analysis

Compare current practices with the PDPL and prioritize gaps.

Policy and process design

Write notices, consent, rights-request and breach procedures.

Training and monitoring

Train teams and set up ongoing reviews as regulations evolve.

Timeline and cost factors

Typical timeline: Commonly 2–5 months, depending on data volume, systems and vendors. Cost depends on scope, organization size, number of locations and systems, current maturity and how much hands-on implementation support you need. Any certification, assessment or audit body fees are separate and set by that body.

Questions buyers ask

It is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, the UAE's federal data protection law. It sets rules for processing personal data and the rights of individuals.

No. The DIFC and ADGM free zones have their own data protection laws. We confirm which law applies to each of your entities.

The law establishes the UAE Data Office as the regulator. Detailed obligations depend on executive regulations, so we confirm current requirements during scoping.

It can apply to organizations outside the UAE that process personal data of people in the country. We assess this during scoping.

No. The PDPL is a law, not a certification. We help you build and evidence a compliance program.

GRC Consulting Services Saudi PDPL GDPR ISO 27701

Ready to Get Started with UAE PDPL?

Speak with our experts about consulting, implementation, and audit support for Personal Data Protection Law (United Arab Emirates).

Schedule a Consultation View All Frameworks