Key takeaways
- Under the UAE PDPL, consent is the default basis and there is no general "legitimate interest" ground — the sharpest divergence from the GDPR.
- The PDPL frames transparency partly as a right the individual exercises, not only a notice the controller pushes out.
- The primary law fixes no response deadline and no hard breach clock; those are deferred to the still-pending Executive Regulations.
- Do not confuse the UAE PDPL with Saudi Arabia's PDPL — different law, authority and detail, though much online comparison content mixes them up.
The same family, different rules
The GDPR is the reference model for modern data-protection law, and the UAE PDPL — Federal Decree-Law No. 45 of 2021 — borrows its vocabulary. But borrowing the words is not the same as copying the rules, and a site built on the assumption that they are identical will get some things wrong. There is also a naming trap: Saudi Arabia has its own PDPL, and much of the "PDPL vs GDPR" content online is about the Saudi law, not the UAE one. Everything below is about the UAE.
1. Lawful basis: consent-first, no legitimate interest
The GDPR gives six equal lawful bases, and many organisations lean on "legitimate interests" to avoid asking for consent. The UAE PDPL does not offer that option. Under Article 4, processing personal data without the owner's consent is prohibited except for a closed list of cases — contractual necessity, legal or judicial procedures, protecting the person's vital interests, public health, archival or statistical purposes, and a controller's legal obligations, among others. There is no general legitimate-interest balancing test. In practice, anything you would have justified as "legitimate interest" under the GDPR has to map to consent or a specific statutory exception under the PDPL.
2. Transparency: a right, not just a notice
Under the GDPR, transparency is a proactive duty: Articles 13 and 14 require the controller to push a defined notice to the individual. The UAE PDPL frames much of the same information as a data-subject right under Article 13 — something the individual is entitled to obtain — with a narrower duty to proactively provide certain items, such as purposes, recipients and cross-border safeguards, before processing begins. The disclosures end up similar; the structure, and the way you evidence it, differ.
3. Deadlines and penalties: still pending
The GDPR fixes concrete numbers — a one-month deadline for data-subject requests, a 72-hour breach-notification window. The UAE PDPL primary law fixes neither. Data-subject rights carry only a "without undue delay" standard, and breach notification is "immediately upon becoming aware", with the exact periods, cross-border mechanisms and penalty amounts all deferred to Executive Regulations that, as of 2026, have not been issued. So any confident "30 days" or "AED-X fine" you read about the UAE PDPL is usually a GDPR import or an unverified figure.
What it means for your website
If you build to the GDPR and assume the PDPL matches, you will most likely rely on a lawful basis the PDPL does not recognise. The safer design is consent-first: capture consent that is specific, informed and revocable, document each processing purpose, and map every activity to a real PDPL basis. Build it that way once, and the differences stop being risks and become decisions you can explain.
The UAE PDPL rewards consent you can prove — not a lawful basis you assert.
Where to go next
For the law in plain language, read the UAE PDPL explained. For the primary instruments by article, see our reference to the sources of UAE data-protection law, or check where your own site stands with a free PDPL readiness check.
Written by Orentara
Founder-led boutique