Live threats
HighClaude Dispatch Flaw Enables Browser Extension RCE on Host OS BreachBrenner Base Tunnel SE Confirms Data Breach; Extortion Group Claims 812 GB Stolen Rule changeOPM proposes to modify OPM/Central-21 system of records and rename employee survey DeadlineEgyptian court fines and orders closure of independent outlet Mada Masr, sentencing editor Lina Attalah CriticalPatched Zyxel GS1900 Switches Remain Exploitable (CVE‑2026‑107441) BreachClaude Code’s ‘Don’t Ask Again’ Feature Leaks Passwords and API Keys in Over 1,100 Public GitHub Repos Rule changeCNIL issues guidance on session replay tools, urging transparency, consent and data minimisation CriticalCritical Rails Active Storage ImageMagick Bug Allows Arbitrary File Write/Read
Updated 07:25 UTC All intelligence →
Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
EN
JoinJoin
Regulations › Rest of world › United Arab Emirates

PDPL (UAE)

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE)

In force privacy
WhenIn effect since 2 January 2022
Who enforces itUAE Data Office
Who it applies toProcessing of personal data in the UAE outside the free zones with their own laws, such as DIFC and ADGM.
Tell the regulatorNotify the Data Office on becoming aware of a breach prejudicing privacy, within a period the… DPO requiredDPO required for high-risk processing, systematic assessment of sensitive data including profi… RegistrationNo controller registration or licensing Transfers abroadTransfer to countries with adequate protection approved by the Data Office, or via contract, e… Request deadlineNo fixed response period Maximum fineNo fines in force
86%

of UAE (federal)'s 21 requirements are already met by European Union (GDPR). Here is what PDPL (UAE) adds, biggest gaps first.

Lawful basisReach and lawful basisBig gap
GDPR1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
PDPL (UAE) adds3 Processing without consent is prohibited except in listed cases (public interest, contract, legal obligation, public data and others); no legitimate interests ground. Art. 4 · source ↗
Reach abroadReach and lawful basisGap
GDPR2 Applies to non-EU controllers offering goods or services to, or monitoring the behavior of, people in the EU.
PDPL (UAE) adds3 Applies to controllers and processors outside the UAE that process personal data of data subjects inside the State. Art. 2(1)(c) · source ↗
ConsentReach and lawful basisGap
GDPR2 Consent must be freely given, specific, informed and unambiguous by clear affirmative action, and the controller must be able to demonstrate it.
PDPL (UAE) adds3 Controller must prove consent; it must be specific, clear, unambiguous, in writing or electronic form, and easy to withdraw. Arts. 1, 6 · source ↗

Already covered by GDPR: Sensitive data, Children, Rights, Request deadline, Marketing, DPO required, DPO qualifications, Registration, DPIA, Records, Retention, Tell the regulator, Tell people, Transfers abroad, Localization, Maximum fine, Criminal liability, Private action.

A gap means PDPL (UAE) is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the mapFollow Regulatory Watch
  • In force
  • Coming into force
  • Sector laws
AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL