UAE data-protection law: the sources, by article.
A plain-language reference to the instruments that actually govern personal data in the UAE — the Federal PDPL, DIFC and ADGM, plus the GDPR for EU-facing business — each cited to its primary text and article numbers. Verified, and kept current.
In short
Four instruments, one question: where is your business established?
The onshore UAE Federal PDPL (Decree-Law No. 45 of 2021) is consent-first and has no general legitimate-interest basis.
DIFC (Law No. 5 of 2020) and ADGM (DPR 2021) are separate, GDPR-modelled free-zone regimes — not "the PDPL".
The PDPL Executive Regulations are not yet issued as of 2026, so several operational specifics remain legally undefined.
Every claim below is cited to the primary instrument and article number, with a link to the official source.
Onshore UAE
Federal PDPL — Decree-Law No. 45 of 2021
The onshore federal regime, in force since 2 January 2022 and supervised by the UAE Data Office. Consent is the default lawful basis, with a closed list of exceptions — there is no general "legitimate interest" basis as under the GDPR. Several operational parameters are deferred to the Executive Regulations, which remain unissued as of 2026.
Lawful basis — Art. 4
Consent by default, with a closed exception list. No general legitimate-interest basis.
Transparency & rights — Arts. 13-17
Access, correction, erasure, restriction, objection. The only temporal standard is "without undue delay" (Art. 15) — no fixed numeric deadline in the primary law.
Cross-border — Arts. 22-23
To countries the UAE Data Office designates as adequate, or on enumerated exceptions.
Breach & DPO — Arts. 9, 10
Notify the UAE Data Office upon awareness; risk-based DPO triggers. Exact timings and thresholds are deferred to the Executive Regulations.
Free zone
DIFC — Data Protection Law No. 5 of 2020
The Dubai International Financial Centre runs its own GDPR-modelled regime, supervised by the DIFC Commissioner of Data Protection. It recognises six lawful bases (including legitimate interests) and sets a one-month response deadline.
Lawful bases — Art. 10
Six bases mirroring the GDPR; consent governed by Art. 12.
Rights — Arts. 32-40
Access, rectification and erasure within one month, free (Art. 33); a DIFC-specific non-discrimination right (Art. 39).
DPO — Art. 16
Required for high-risk processing; the DPO must reside in the UAE.
Breach — Art. 41
Notify the Commissioner "as soon as practicable" — no fixed 72-hour clock.
Free zone
ADGM — Data Protection Regulations 2021
Abu Dhabi Global Market runs a separate GDPR-modelled regime (it uses "sections"), supervised by the ADGM Office of Data Protection. Its response deadline is a deliberate two months, and it keeps a GDPR-style 72-hour breach rule.
Lawful bases — s. 5
Six bases mirroring the GDPR; consent conditions in s. 6.
Rights — ss. 13-20
Response within two months (s. 10), extendable by one month; free by default.
DPO — s. 35
GDPR-style triggers: public authority, large-scale regular monitoring, or large-scale special-category data.
Breach — s. 32
Notify the Commissioner not later than 72 hours.
For EU-facing business
EU GDPR — Regulation 2016/679
If you target or monitor people in the EU, the GDPR can apply alongside your UAE regime. Orentara builds to a combined DIFC + EU posture by default.
Lawful bases — Art. 6
Six bases, including legitimate interests.
Transparency — Arts. 13-14
Controller notice at collection; response within one month (Art. 12).
Transfers — Chapter V
Adequacy, standard contractual clauses, binding corporate rules or derogations.
Breach — Art. 33
Notify the supervisory authority within 72 hours.
Side by side
DIFC, ADGM, Federal PDPL and the GDPR, compared.
The points that get conflated most — lawful bases, response times and breach timing — laid out against each instrument. Where your business is established decides which column is yours.
| Dimension | Federal PDPL | DIFC | ADGM | EU GDPR |
|---|---|---|---|---|
| Applies to | Onshore / mainland UAE | DIFC-registered entities | ADGM-registered entities | Businesses targeting or monitoring people in the EU |
| Lawful bases | Consent by default + a closed exception list (Art. 4) | Six bases (Art. 10) | Six bases (s. 5) | Six bases (Art. 6) |
| Legitimate-interest basis | No | Yes | Yes | Yes |
| Data-subject request time | No fixed period — "without undue delay" (Art. 15) | 1 month (Art. 33) | 2 months (s. 10) | 1 month (Art. 12) |
| Breach notification | On awareness; period set by the Executive Regulations (Art. 9) | "As soon as practicable" (Art. 41) | Not later than 72 hours (s. 32) | Within 72 hours (Art. 33) |
| DPO requirement | Risk-based; no headcount threshold (Art. 10) | High-risk processing; DPO resides in the UAE (Art. 16) | GDPR-style triggers (s. 35) | GDPR-style triggers (Art. 37) |
| Supervisory authority | UAE Data Office | DIFC Commissioner of Data Protection | ADGM Office of Data Protection | EU/EEA supervisory authorities |
As of 2026. The UAE Federal PDPL Executive Regulations are not yet issued, so some operational specifics (deadlines, breach timing, penalties) remain legally undefined. Factual reference, not legal advice. Primary sources are linked in the sections above.
Try it
Find your regime in one question.
Your establishment decides which law governs your website — not where your customers are. Pick yours to see what applies.
Pick where your business is established to see which law applies.
Embed it
Put this picker on your own site.
Paste this where you want the picker to appear — results link back here: <iframe src="https://orentara.com/embed/en/regime-picker" width="100%" height="560" style="border:0" title="Which UAE data-protection law applies?"></iframe>
Which one applies?
Which UAE data-protection law applies to you?
It is decided by where your business is established, not by where your customers are. Onshore companies fall under the Federal PDPL; DIFC and ADGM entities under their own free-zone regimes; EU-facing businesses may add the GDPR.
Onshore (mainland)
Federal PDPL — Decree-Law No. 45 of 2021.
DIFC entity
DIFC Data Protection Law No. 5 of 2020.
ADGM entity
ADGM Data Protection Regulations 2021.
EU audience
Add the GDPR (Regulation 2016/679) on top of your UAE regime.
FAQ
Reference questions
Is the UAE PDPL in force?
Yes. The Federal PDPL (Decree-Law No. 45 of 2021) has been in force since 2 January 2022. Its Executive Regulations, which will set several operational specifics, have not yet been issued as of 2026 — and a six-month compliance window runs from their issuance.
Are there fixed PDPL fines yet?
The primary decree-law does not fix specific penalty amounts; administrative penalties follow the forthcoming Executive Regulations. Be wary of sources quoting exact figures as if they were already settled.
Does the PDPL have a "legitimate interest" basis like the GDPR?
No. The Federal PDPL is consent-first, with a closed list of exceptions (Art. 4); there is no general legitimate-interest basis. DIFC and ADGM, being GDPR-modelled, do recognise it.
What is the deadline to answer a data-subject request?
It depends on the regime: DIFC is one month, ADGM two months, and the Federal PDPL fixes no numeric deadline in the primary law ("without undue delay", Art. 15). A single "30-day" figure is a GDPR import, not the PDPL.
Where can I read the primary texts?
Each section above links the official source: the UAE legislation portal for the Federal PDPL, difc.com for the DIFC law, adgm.com for the ADGM regulations, and EUR-Lex for the GDPR.
Next steps
From the law to a compliant site.
A plain-language walk through Federal Decree-Law No. 45 of 2021 and what it means for your website.
How we build sites with data protection designed into the build, documented and defensible.
Send your URL and get a short written readiness report — where you stand and what to fix first.
Book a consultation
Need this applied to your site?
We build to these instruments by design and document every decision, so an audit or a data-subject request is answerable from day one. Book a short, qualified consultation.
- Direct reply from the founder
- No obligation, no sales sequence
- Your details handled per the PDPL