The UAE has a federal Personal Data Protection Law in force since 2 January 2022, but the Executive Regulations that set its breach deadlines, DPO thresholds and penalties have still not been published, so organisations must comply with a law whose details are incomplete. At the same time the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) run their own mature, actively supervised data protection regimes. This guide explains which regime applies to which entity, the obligations that are already fixed in the federal text, how the free zone rules differ, and what the law means for AI agents and the service accounts and keys that reach personal data. It is written for security, privacy and engineering leads with operations in the UAE.
Key takeaways
- Three regimes, not one: Federal Decree-Law No. 45 of 2021 (PDPL) covers mainland UAE; DIFC Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021 cover entities in those free zones, which are excluded from the PDPL.
- Federal law is active but incomplete: the official UAE Legislation portal lists the PDPL as active with no executive regulations, and independent reviews through 2026 report they have not been issued.
- The compliance clock has not started: Article 29 gives six months to align from the date the Executive Regulations are issued, but the substantive duties are written into the law and are a sound baseline now.
- The UAE Data Office is not yet visibly regulating: the government portal (updated December 2025) says it "will act" as federal regulator.
- Free zones are where enforcement lives: ADGM requires breach notice within 72 hours with fines up to USD 28 million, and DIFC Regulation 10 already governs autonomous AI systems processing personal data.
Scope: who and what is covered
Article 2 of the PDPL applies to processing, by automated or other means, of personal data of data subjects who reside or have a place of business in the UAE; to controllers and processors in the UAE whether processing happens inside or outside the country; and to controllers and processors outside the UAE that process data of data subjects inside it.
| Excluded from the federal PDPL (Article 2(2)) | What applies instead |
|---|---|
| Government data and government entities | Federal and emirate-level government data rules |
| Data held by security and judicial authorities | Their own legislation |
| Processing by an individual for personal purposes | Not regulated |
| Health data with its own legislation | Federal Law No. 2 of 2019 on ICT in health fields |
| Banking and credit data with its own legislation | Central Bank rules and credit information law |
| Free zone companies with their own data protection law | DIFC Data Protection Law or ADGM Data Protection Regulations |
How the three regimes compare
| Topic | Federal PDPL | DIFC Law No. 5 of 2020 | ADGM DPR 2021 |
|---|---|---|---|
| Regulator | UAE Data Office (Federal Decree-Law No. 44 of 2021), not yet publicly operating | DIFC Commissioner of Data Protection | ADGM Office of Data Protection, Commissioner of Data Protection |
| Status | In force since 2 January 2022; Executive Regulations not issued | Commenced 1 July 2020; amended by DIFC Laws Amendment Law No. 1 of 2025 | In force and supervised |
| Breach notice to regulator | On awareness; timing to be set by Executive Regulations (Article 9) | Required; confirm exact timing in the current consolidated text | Within 72 hours of becoming aware |
| Penalties | To be set by Cabinet decision (Article 26) | Administrative fine schedule per contravention, plus court compensation | Fines up to USD 28 million |
| AI and autonomous systems | Automated decision rights (Article 18), DPIA for new technologies (Article 21) | Regulation 10: deployers, operators, Autonomous Systems Officer | General rules on automated decisions |
| Transfers | Adequacy approved by the Data Office (Article 22) or listed grounds (Article 23) | Adequacy list, SCCs, BCRs; documented assessment since 2025 amendments | EU adequacy decisions and DIFC recognised; otherwise SCCs, BCRs or approved mechanisms |
Neither free zone treats mainland UAE as adequate, so data moving from a DIFC or ADGM entity to a mainland affiliate needs contractual safeguards.
Key obligations
These duties are written into the federal text and apply now, even though details await the Executive Regulations.
Lawful processing and rights
- Consent by default (Articles 4 and 6): processing without consent is prohibited unless an exception applies, such as contract performance, legal obligation, public interest, legal claims, medical purposes, employment obligations or data the subject made public. Consent must be provable, clear and as easy to withdraw as to give.
- Rights (Articles 13 to 18): information, portability in a machine-readable format (Article 14), correction and erasure (Article 15), restriction (Article 16), objection including to direct marketing and profiling (Article 17), and objection to automated decisions with legal or serious effects, with human review on request (Article 18). See the DSAR Guide.
Controller and processor duties
| Article | Duty |
|---|---|
| 7 | Technical and organisational measures, privacy by design and default, pseudonymisation, a processing record available to the Data Office, and processors with sufficient guarantees |
| 9 | Notify the Data Office of a breach that would prejudice privacy, confidentiality or security; notify data subjects where it would prejudice their privacy; processors alert controllers as soon as they become aware |
| 10 to 12 | Appoint a DPO for high-risk processing using new technologies or large volumes, systematic assessment of sensitive data including profiling, or large volumes of sensitive data; file contact details; protect the DPO's independence |
| 20 | Security appropriate to risk: encryption and pseudonymisation, ongoing confidentiality, integrity, availability and resilience, timely restoration after incidents, and regular testing of effectiveness |
| 21 | DPIA before high-risk processing with modern technologies; mandatory for systematic profiling with legal or serious effects and large-scale sensitive data; consult the DPO; review when risk changes |
| 22 and 23 | Cross-border transfers only to adequate jurisdictions or under listed grounds such as contract, explicit consent, legal claims or judicial cooperation |
Breach notification content (Article 9(1))
- The nature, form, causes and approximate number of affected records.
- Contact details of the DPO.
- Likely effects of the breach.
- Corrective measures taken or proposed.
- Documentation of the breach and the corrective measures.
- Any other information the Data Office requires.
Until the Executive Regulations set a deadline, a 72-hour internal target is a defensible default that also satisfies ADGM and aligns with GDPR. See the Breach Notification Laws by Country Guide.
Security duties and the IA Standards
Article 20 is outcome-based. For a control catalogue, government entities and critical sectors use the UAE Information Assurance Standards; see the UAE Information Assurance Standards Guide rather than duplicating those controls here.
Timeline and current status
| Date | Event |
|---|---|
| 21 May 2020 | DIFC Data Protection Law No. 5 of 2020 enacted; commenced 1 July 2020 |
| 2021 | ADGM Data Protection Regulations 2021 issued |
| 20 September 2021 | Federal Decree-Law No. 45 of 2021 issued; published in Official Gazette No. 712 on 26 September 2021 |
| 2 January 2022 | Federal PDPL takes effect (Article 31) |
| March 2022 (deadline) | Article 28 required Executive Regulations within six months of promulgation; not met |
| 1 September 2023 | DIFC Regulation 10 on autonomous and semi-autonomous systems |
| 2025 | DIFC Laws Amendment Law No. 1 of 2025 amends the DIFC Data Protection Law |
| December 2025 | Government portal still describes the UAE Data Office in future tense |
| Pending | Federal Executive Regulations; then six months to align (Article 29), extendable by the Cabinet |
Cabinet decision numbers said to contain the Executive Regulations circulate online, but none appears on the official UAE Legislation portal entry for the PDPL. Check that portal before relying on any claimed regulation, and expect detail on breach timing, DPO thresholds and penalties to change once it is published.
Enforcement and penalties
- Federal: Article 26 leaves violations and administrative penalties to a Cabinet decision. No published penalty schedule or mainland enforcement decision could be traced to a primary source; fine ranges quoted in the market should not be relied on. Data subjects can complain to the Data Office (Article 24), and decisions can be challenged by written grievance within 30 days (Article 25).
- DIFC: the Commissioner applies a schedule of administrative fines per contravention, revised with the 2025 amendments, and individuals can seek compensation.
- ADGM: the Commissioner can impose fines of up to USD 28 million.
- Parallel exposure: sector regulators (Central Bank, health authorities) and the cybercrime law may apply to the same incident.
What it means for AI agents and non-human identities
- DIFC is already prescriptive: under Regulation 10 a deployer of an autonomous system processing personal data is treated as controller, and commercial high-risk use needs an Autonomous Systems Officer and must meet the Commissioner's audit and certification requirements, processing only for human-defined or human-approved purposes. See the Human-in-the-Loop for AI Agents Guide.
- Automated decisions (PDPL Article 18): an agent that makes decisions with legal or serious effects must support objection and human review. Log the inputs and the decision so a reviewer can reconstruct it. See the AI Agent Audit Trails for Regulators Guide.
- DPIA triggers: new technologies and profiling are named triggers in Article 21, so an agent deployment over customer data is a DPIA by default.
- Transfers through model APIs: prompts containing personal data sent to a model hosted abroad are a cross-border transfer under Articles 22 and 23. Redact, minimise, and record the ground relied on.
- Credentials as breach vectors: Article 20 requires confidentiality and regular testing; API keys, OAuth tokens and service accounts with personal data access need owners, scopes, rotation and logging. See the Non-Human Identity (NHI) Guide.
Compliance steps
- Classify each entity: mainland, DIFC, ADGM or another free zone, and whether health, banking or government carve-outs apply. One group can be subject to all three regimes.
- Baseline on the strictest common rules: where DIFC or ADGM apply, use them as the group standard; they are closest to GDPR and are enforced.
- Build the processing record (PDPL Article 7(4)), including AI agents, integrations and processors. See the Data Mapping and ROPA Guide.
- Assess DPO need under Article 10 and the free zone rules; appoint and record contact details.
- Run DPIAs for profiling, sensitive data and new technology, starting with AI deployments.
- Map transfers: list destinations, grounds under Articles 22 and 23, and free zone mechanisms including flows from free zones to the mainland. See the International Data Transfers Map.
- Prepare breach notices with the Article 9(1) fields pre-filled and a 72-hour internal clock; run a tabletop that includes ADGM or DIFC if relevant.
- Pilot and roll back: introduce controls such as prompt redaction or transfer blocks in a pilot ring, measure business impact, and keep a documented rollback and interim risk acceptance.
- Watch for the Executive Regulations on the UAE Legislation portal and plan a six-month gap review when they land.
Framework mapping
| PDPL article | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| 2, 4 (scope, lawful basis) | GV.OC-03 | PT-2, PT-3 | A.5.31, A.5.34 |
| 7(4) processing record | ID.AM-07 | PT-3 | A.5.34 |
| 9 breach notification | RS.CO-02, RS.MA-01 | IR-6, IR-8 | A.5.24, A.5.26 |
| 20 security | PR.DS-01, PR.DS-02, PR.AA-05 | AC-6, IA-4, AU-2 | A.8.24, A.5.15 |
| 21 DPIA | GV.OC-03 | RA-8 | A.5.34 |
| 22, 23 transfers; 7(5) processors | GV.OC-03 | SA-9 | A.5.14, A.5.20 |
Measuring it
- Regime coverage: percentage of UAE entities classified to a regime with a named privacy owner.
- Time to notify: hours from awareness to regulator notice in exercises (target under 72).
- Record coverage: share of systems, agents and integrations processing UAE personal data in the record.
- Transfer coverage: share of cross-border and free-zone-to-mainland flows with a documented ground or safeguard.
- Credential hygiene: share of non-human identities with personal data access that have an owner, scope review and rotation date.
Common failure patterns
- Waiting for the Executive Regulations: the core duties in Articles 7, 9, 20 and 21 are already law; late starters face a six-month window once regulations land.
- Applying the PDPL to a DIFC or ADGM entity: free zone entities follow their own regime, and the reverse mistake is just as common for mainland affiliates.
- Treating free-zone-to-mainland flows as domestic: both free zones treat these as transfers needing safeguards.
- Relying on untraceable penalty figures: budget and risk models built on unofficial fine ranges are guesswork.
- Deploying AI in DIFC without Regulation 10 checks: high-risk commercial use without an Autonomous Systems Officer is not permitted.
- Losing track of keys and tokens: without per-identity logging, the approximate record count required by Article 9 cannot be produced. Leaked credentials opening personal records is a recurring pattern, as in the United Nations Breach.
Practitioner checklist
- Map every UAE entity to the federal PDPL, DIFC, ADGM or a sector carve-out.
- Check the UAE Legislation portal for Executive Regulations each quarter and record the result.
- Maintain a processing record covering AI agents, service accounts and processors.
- Appoint a DPO where Article 10 or free zone rules require, and file contact details.
- Complete DPIAs for profiling, sensitive data and AI deployments.
- Document a ground or safeguard for every transfer, including free zone to mainland.
- Pre-build breach notices with the Article 9(1) fields and a 72-hour internal target.
- For DIFC AI systems, confirm Regulation 10 roles and appoint an Autonomous Systems Officer where required.
- Scope, rotate and log every credential that can reach personal data.
Standards and references
- UAE Legislation: Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data
- UAE Government portal: Data protection laws
- DIFC: Data Protection Law, DIFC Law No. 5 of 2020
- Baker McKenzie: Global Data and Cyber Handbook, UAE regulators, enforcement and penalties
- Recording Law: UAE data privacy laws, federal PDPL, DIFC and ADGM
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Saudi Arabia PDPL Guide · UAE Information Assurance Standards Guide · Global Privacy Regulatory Map · Qatar Data Protection Law Guide. This guide summarises the UAE federal Personal Data Protection Law and the DIFC and ADGM regimes as at October 2026 and is not legal advice.