Data Protection Monitor
Global Privacy & Data Protection Intelligence

Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.

United Arab Emirates Data Protection & Privacy Regulation

AE schema gdpri-v2 trajectory: not yet assessed hybrid regime overlaps: Sentinel (AML/CFT), World Payments, artificial-intelligence

Last updated · 10 categories · 177 claims · 88 sources in the cumulative register

The United Arab Emirates has established a Federal Authority for Artificial Intelligence and Data, effective 14 June 2026, consolidating the UAE Artificial Intelligence Office, the Telecommunications and Digital Government Regulatory Authority's Information and Digital Government Sector, and the UAE/Emirates Data Office under a single Cabinet-reporting structure.

Data collected Data published

AI-assembled from cited sources

Not fully checked this cycle: AdTech & Commercial Privacy, Enforcement & Redress (3 open gaps).

Evidence re-verified: ·Position last changed: ·
Record history & provenance ▾

Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

Open in Co-Pilot ↗Build ReportCompare
Framework postureHybrid regime10 of 10 modules populated · AI-synthesised · Tier-1/2 verified
Lead supervisory authorityUAE Data Office (Emirates Data Office)Primary statutory & supervisory perimeter
Next milestone (> 2026-10-26)None scheduledNo dated future statutory milestone on record
Module coverage & confidence10 / 10 modules assessed0 Confirmed · 10 Probable · 0 Uncertain

Jurisdiction brief

Latest update · 3 November 2026

Lead Signal

The UAE's data-protection institutional architecture consolidated with the establishment of the Federal Authority for Artificial Intelligence and Data, effective 14 June 2026. The new Cabinet-reporting body absorbs the Office of Artificial Intelligence, the Information and Digital Government Sector of the Telecommunications and Digital Government Regulatory Authority, and the UAE Data Office into a single institution. The UAE Data Office never became fully operational prior to this absorption, meaning the new Authority effectively represents the UAE's first operationally consolidated federal regulator with a clear data-protection mandate, now paired structurally with the AI-policy function in a single body.

Key regulatory facts for United Arab Emirates
Regulatory DimensionUnited Arab Emirates Standing Position
JurisdictionUnited Arab Emirates (AE)
Regulatory ScopeData Protection & Privacy Regulation (10 modules, 177 sourced findings)
Regulator & FrameworkA comprehensive federal statute is in force, but implementing/executive regulation detail (fines, breach timelines) remained unconfirmed in available secondary sources, and the regime is fragmented across federal,...
Lawful Processing & Special DataFree-zone (DIFC/ADGM) lawful-basis and special-category rules are well-documented and GDPR-aligned; federal PDPL detail on lawful bases beyond consent-plus-exceptions was not confirmed in available sources.
Data Subject RightsRights exist in principle across federal, DIFC and ADGM instruments, but response-window specificity at federal level is unconfirmed.
Controller/Processor DutiesFree-zone (DIFC/ADGM) controller duties are well documented and GDPR-aligned; federal PDPL implementing detail (fine schedules, precise breach timelines) is not confirmed.
Primary Instruments CitedIAPP, OneTrust DataGuidance, OneTrust DataGuidance, DataGuidance, Dubai International Financial Centre (DIFC)
Last Confirmed / Updated2026-11-04 (88 sources in cumulative register)

#

A comprehensive federal statute is in force, but implementing/executive regulation detail (fines, breach timelines) remained unconfirmed in available secondary sources, and the regime is fragmented across federal, DIFC and ADGM authorities.

Primary frameworkUAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)
Supervisory authorityUAE Data Office (Emirates Data Office)
Traffic-light rationale — AmberA comprehensive federal statute is in force, but implementing/executive regulation detail (fines, breach timelines) remained unconfirmed in available secondary sources, and the regime is fragmented across federal, DIFC and ADGM authorities.

Sub-modules (5)

Regulator And AuthorityAmber

Federal enforcement sits with the Emirates Data Office; DIFC and ADGM each maintain their own Commissioner/Office of Data Protection for their free zones.

Claims (11):

  • The UAE enacted Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data as part of a sweeping package of legal reforms marking the UAE's 50th anniversary.
  • The PDPL decrees established the Emirates Data Office to monitor and enforce the UAE Personal Data Protection Law countrywide.
  • UAE Data Office — Established under Federal Decree-Law No. 44 of 2021 as the federal data regulator to regulate application of the PDPL
  • Federal Authority for Artificial Intelligence and Data — Established 14 June 2026, consolidating AI Office, TDRA digital-government sector and UAE Data Office
  • On 14 June 2026 the UAE Cabinet approved establishment of the Federal Authority for Artificial Intelligence and Data, absorbing the UAE Data Office (the PDPL's nominal supervisory body), the Office of Artificial Intelligence, and TDRA's Digital Government Sector.
  • UAE Data Office — Described by a separate 2026 secondary source as now fully operational and issuing guidance
  • Federal Authority for Artificial Intelligence and Data — Established 14 June 2026, consolidating the UAE Artificial Intelligence Office, the TDRA's Information and Digital Government Sector, and the UAE/Emirates Data Office under a single Cabinet-reporting structure.
  • The DIFC Data Protection Law requires a DPIA before High Risk Processing Activities within DIFC.
  • The ADGM Data Protection Regulations 2021 establish a Commissioner of Data Protection responsible for monitoring and enforcement.
  • Artificial Intelligence and Data Authority (announced) — On 14 June 2026 the UAE Cabinet announced merging the federal AI Office, TDRA's Digital Government Sector and the UAE Data Office into the Artificial Intelligence and Data Authority, mandated to propose AI legislation; no establishing instrument had been published as of the source-check date.
  • Federal Authority for Artificial Intelligence and Data — Cabinet approved establishment on 14 June 2026, consolidating the AI Office, TDRA's Digital Government Sector and the Emirates Data Office

Act And InstrumentsAmber

Federal Decree-Law No. 45 of 2021 (PDPL) is the primary federal instrument; DIFC Law No. 5 of 2020 and ADGM Data Protection Regulations 2021 are independent free-zone instruments.

Claims (11):

  • The UAE enacted Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data as part of a sweeping package of legal reforms marking the UAE's 50th anniversary.
  • The DIFC and ADGM financial free zones operate independent data protection regimes (DIFC Law No. 5 of 2020; ADGM Data Protection Regulations 2021) outside the federal PDPL's civil and commercial jurisdiction.
  • Personal Data Protection Law — Federal Decree-Law No. 45 of 2021, in force 2 January 2022, establishing the controller/processor compliance regime under the UAE Data Office
  • DIFC Data Protection Law — DIFC Law No. 5 of 2020, in force 1 July 2020 (last amended 1 January 2025), with a Commissioner of Data Protection responsible for supervision and enforcement
  • ADGM Data Protection Regulations 2021 — In force 14 February 2021, establishing a Commissioner of Data Protection responsible for monitoring and enforcing the Regulations, with controller/processor registration duties
  • PDPL Implementing Regulations — Not published as of mid-2026, more than four years after the PDPL entered force.
  • Sources are in direct conflict on the PDPL Executive Regulations' status: some state formal Executive Regulations had not been published in the Official Gazette as a discrete instrument as of mid-2026, while others cite Cabinet Decision No. 33 of 2024 as the in-force Executive Regulation.
  • Federal Decree-Law No. 45 of 2021 (PDPL) — The PDPL required Executive Regulations within six months of promulgation; these have not yet been issued as of this cycle.
  • PDPL Executive Regulations / Cabinet penalty decision — not_stated
  • Federal Decree-Law No. 45 of 2021 (PDPL) — Independent 2026 UAE compliance sources report that federal PDPL Executive Regulations have not yet been issued, leaving the statutory grace-period trigger pending.
  • Federal Decree-Law No. 45 of 2021 (PDPL) — While the PDPL's Executive Regulations are pending, limiting their enforceability, the CDS Federal Law provides immediate privacy protections

Material ScopeAmber

The PDPL is described as GDPR-influenced, granting data subjects considerable rights and control over personal data.

Claims (3):

  • Like the EU GDPR, the PDPL gives considerable control and rights to data subjects over their personal data.
  • Federal Decree-Law No. 45 of 2021 (PDPL) — Excludes from scope: government data held for security/judicial purposes, personal banking and credit data held by designated credit bodies, health data covered by separate legislation, and processing by an individual for purely personal/household purposes
  • Federal Decree-Law No. 45 of 2021 (PDPL) — Does not apply to public entities, DIFC/ADGM free zones with their own DP legislation, or health/credit data governed by existing sectoral legislation

Territorial ScopeAmber

The PDPL is reported to apply to virtually all organizations across the seven emirates and to entities elsewhere processing UAE residents' data; DIFC/ADGM regimes apply only within their respective free zones.

Claims (6):

  • Virtually all organizations across all seven emirates that collect or process personal data, and organizations elsewhere processing personal data belonging to UAE residents, fall within the PDPL's compliance scope.
  • The PDPL decrees established the Emirates Data Office to monitor and enforce the UAE Personal Data Protection Law countrywide.
  • Federal Decree-Law No. 45 of 2021 (PDPL) — Applies to processing of personal data, wholly or partly, through automated electronic systems or otherwise, by any controller/processor located in the UAE processing data of subjects residing/working inside or outside the UAE, and by controllers/processors outside the UAE processing data of subjects located inside the UAE
  • PDPL Article 2(1)(c) — Applies to any controller or processor residing outside the UAE that carries out processing activities on the personal data of data subjects located within the State.
  • Federal Decree-Law No. 45 of 2021 (PDPL) — Covers processing of personal data of data subjects within the UAE regardless of controller/processor location
  • The PDPL applies to processing of personal data by UAE-based controllers/processors and, extraterritorially, to foreign controllers/processors processing data of subjects located in the UAE.

Regulator Registration And FilingAmber

ADGM requires controller registration and processing notification (fee-bearing, exempt for sub-5-employee entities absent high-risk processing); DIFC requires notification within 14 days via its client portal with initial/renewal fees. No federal PDPL-specific registration mechanism was confirmed in available sources.

Claims (4):

  • ADGM requires registration of data controllers and notification of processing activities with the Commissioner of Data Protection, together with data protection fees and renewal fees, except for establishments with fewer than five employees unless they carry out high-risk processing.
  • DIFC entities must notify the Commissioner of processing operations as soon as possible and in any event within 14 days, paying a $1,250 registration fee and $500 annual renewal fee.
  • Federal Decree-Law No. 45 of 2021 (PDPL) — No general licensing, registration, notification or fee duty to the UAE Data Office; controllers/processors must keep an internal processing record producible to the Data Office on request
  • The PDPL imposes no general registration or notification duty; record-of-processing must instead be produced to the UAE Data Office on request.
Category narrative 89 words

The UAE federal regime rests on Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), enforced by the newly established Emirates Data Office (UAE Data Office). Layered on top of the federal statute are two independent financial free-zone regimes — the DIFC Data Protection Law No. 5 of 2020 (Commissioner of Data Protection) and the ADGM Data Protection Regulations 2021 (Office of Data Protection) — each with its own registration, fee, and enforcement architecture, plus sector-specific instruments (health, telecoms) that operate alongside the general regime.

Periodic update · new data 2026-11-04

Regulator & Framework

The institutional map for data protection oversight in the United Arab Emirates has shifted. On 14 June 2026 the Cabinet established the Federal Authority for Artificial Intelligence and Data, consolidating what had been the AI Office, the digital-government function previously sitting inside the Telecommunications and Digital Government Regulatory Authority, and the UAE Data Office, under a single body reporting directly to Cabinet. The UAE Data Office had been the body named in Federal Decree-Law No. 45 of 2021 (the Personal Data Protection Law, or PDPL) as the supervisory authority for personal data processing at the federal level, separate from the sector-specific regimes that continue to apply inside the Dubai International Financial Centre and Abu Dhabi Global Market. No legal instrument has yet been located that formally and explicitly transfers the Data Office's PDPL supervisory powers to the new Authority, so the practical reporting line for complaints, guidance and any future enforcement action sits in a state of institutional transition rather than settled reassignment. Readers should treat the identity of the body that will exercise PDPL supervisory powers going forward as unresolved until a instrument naming that transfer is published.

This consolidation lands on top of a framework that was already incomplete in its implementing detail. The PDPL took effect on 2 January 2022 and required Executive Regulations to be issued within six months of its promulgation. Those Executive Regulations have still not been issued. Their absence is not a minor drafting delay: the PDPL text itself defers the operative detail of lawful-basis thresholds, breach-notification timing, cross-border transfer mechanics and the penalty schedule to those regulations, so the statute remains, in material respects, a framework law awaiting its own machinery. The combination of an unfinished implementing instrument and a newly reorganised supervisory authority means the architecture of UAE data protection enforcement is less settled now than it was before the June reorganisation, even though the underlying statutory text is unchanged.

Outlook

Two threads bear watching together. First, whether a Cabinet decision or ministerial instrument surfaces formally confirming the Federal Authority for Artificial Intelligence and Data's assumption of PDPL supervisory functions — until it does, guidance, complaint-handling and any enforcement posture attributed to "the UAE Data Office" should be read as provisional. Second, whether the long-outstanding PDPL Executive Regulations are finally issued; their absence has persisted well past the statute's own six-month target and continues to leave core compliance thresholds, transfer mechanisms and penalties without settled operative content. A move on either front — a formal transfer instrument or the long-delayed regulations — would be the clearest signal that the federal regime is consolidating rather than continuing to operate on inherited, partially-specified statutory text.

3 earlier distinct update(s)
Periodic update · new data 2026-11-03

Regulator & Framework

The UAE's data-protection institutional landscape consolidated materially with the establishment of the Federal Authority for Artificial Intelligence and Data, effective 14 June 2026. This new Cabinet-reporting body absorbs three previously separate functions: the Office of Artificial Intelligence, the Information and Digital Government Sector of the Telecommunications and Digital Government Regulatory Authority, and the UAE Data Office. Notably, the UAE Data Office never became fully operational before this absorption took place, meaning the practical effect of this consolidation is that the UAE now has, for the first time, a single operationally active federal body carrying a clear data-protection mandate, where previously that mandate sat with a data office that had not been meaningfully stood up. This is assessed at probable confidence based on secondary legal commentary; the underlying Cabinet decision establishing the Authority was not independently retrieved in primary-source form.

Running alongside this institutional development is a genuinely disputed question regarding the Personal Data Protection Law's Executive Regulations. A number of commercial-compliance sites assert that these Executive Regulations have already been issued, though they cite varying and inconsistent Cabinet Decision numbers in doing so. Against this, the most rigorous primary-source check identified, a check of the UAE Legislation portal conducted 11 August 2026, found no corresponding entry for any such Executive Regulations. This is not a case where one source is simply more authoritative than another in an obvious way; rather, it is a genuine dispute across sources of comparable commercial standing, and it is reported here as disputed, at the Disputed tier of the confidence ladder, precisely because no primary-source resolution has been located. This matters because the Executive Regulations, if and when confirmed to exist, would be expected to resolve a number of currently uncertain operative details under the Personal Data Protection Law, including the practical breach-notification deadline and the administrative-penalty schedule.

Outlook

The most consequential near-term question for the UAE's data-protection framework and-authority structure is whether the dispute over the Executive Regulations' issuance status resolves, either through a confirmed entry appearing on the UAE Legislation portal or through an authoritative statement from the newly established Federal Authority for Artificial Intelligence and Data. Given that the new Authority now holds a consolidated mandate spanning both AI policy and data protection, it is plausible that further institutional clarity, including clarification of the Executive Regulations' status, could follow from the Authority itself as it becomes operationally active, though this remains a matter for future cycles to confirm rather than something that can be asserted now.

Periodic update · new data 2026-10-11

Regulator & Framework

The UAE's data-protection institutional landscape consolidated materially this cycle with the establishment of the Federal Authority for Artificial Intelligence and Data, effective 14 June 2026. This new Cabinet-reporting body absorbs three previously separate functions: the Office of Artificial Intelligence, the Information and Digital Government Sector of the Telecommunications and Digital Government Regulatory Authority, and the UAE Data Office. Notably, the UAE Data Office never became fully operational before this absorption took place, meaning the practical effect of this consolidation is that the UAE now has, for the first time, a single operationally active federal body carrying a clear data-protection mandate, where previously that mandate sat with a data office that had not been meaningfully stood up. This is assessed at probable confidence based on secondary legal commentary; the underlying Cabinet decision establishing the Authority was not independently retrieved in primary-source form this cycle.

Running alongside this institutional development is a genuinely disputed question regarding the Personal Data Protection Law's Executive Regulations. A number of commercial-compliance sites assert that these Executive Regulations have already been issued, though they cite varying and inconsistent Cabinet Decision numbers in doing so. Against this, the most rigorous primary-source check identified this cycle, a check of the UAE Legislation portal conducted 11 August 2026, found no corresponding entry for any such Executive Regulations. This is not a case where one source is simply more authoritative than another in an obvious way; rather, it is a genuine dispute across sources of comparable commercial standing, and it is reported here as disputed, at the Disputed tier of the confidence ladder, precisely because no primary-source resolution has been located. This matters because the Executive Regulations, if and when confirmed to exist, would be expected to resolve a number of currently uncertain operative details under the Personal Data Protection Law, including the practical breach-notification deadline and the administrative-penalty schedule.

Outlook

The most consequential near-term question for the UAE's data-protection framework and-authority structure is whether the dispute over the Executive Regulations' issuance status resolves, either through a confirmed entry appearing on the UAE Legislation portal or through an authoritative statement from the newly established Federal Authority for Artificial Intelligence and Data. Given that the new Authority now holds a consolidated mandate spanning both AI policy and data protection, it is plausible that further institutional clarity, including clarification of the Executive Regulations' status, could follow from the Authority itself as it becomes operationally active, though this remains a matter for future cycles to confirm rather than something that can be asserted now.

Periodic update · new data 2026-09-28

Regulator & Framework

The UAE's federal omnibus data-protection instrument is Federal Decree-Law No. 45 of 2021, the Personal Data Protection Law, in effect since 2 January 2022. Its scope is bounded in specific and material ways: the PDPL does not apply to public entities, to the DIFC and ADGM free zones, each of which maintains its own separate data-protection legislation, or to health and credit data, which remain governed by existing sectoral legislation. Territorially, the PDPL covers the processing of personal data of data subjects located within the UAE regardless of where the controller or processor is itself located, an effects-based rather than establishment-based territorial trigger.

The most material development this cycle concerns the operational status of the UAE Data Office, the PDPL's designated supervisory authority. A 2026 Chambers and Partners practice guide describes the Data Office as not yet fully operational. A separate 2026 secondary source, by contrast, describes the Data Office as now fully operational and issuing guidance. These two accounts are directly contradictory, and neither is corroborated by a directly retrieved primary statement from the Data Office itself this cycle. The honest position is that this is a genuinely disputed fact, not a fact this cycle's evidence resolves, and it is recorded as such rather than averaged or silently resolved in favour of either source.

This disputed operational status matters beyond a bureaucratic technicality: the practical reach of every other PDPL obligation, from data subject rights to controller duties to enforcement powers, depends in part on whether a functioning supervisory authority exists to receive complaints, issue guidance, and take enforcement action. Until the dispute is resolved by a primary Data Office statement, the operational reality of the entire PDPL framework carries this same uncertainty.

Outlook

A direct primary statement from the UAE Data Office, whether a website update, published guidance, or an enforcement action bearing its name, would resolve the current dispute in either direction. Until such a statement is retrieved, the safest reading is that the law is unambiguously in force while its supervisory machinery's operational status remains open.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and claims (34)
  1. Probable IAPP — The UAE enacted Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data as part of a sweeping package of legal reforms marking the UAE's 50th anniversary. observed
  2. Probable IAPP — The PDPL decrees established the Emirates Data Office to monitor and enforce the UAE Personal Data Protection Law countrywide. observed
  3. Probable IAPP — The PDPL took effect on January 2, 2022, with enforcement of its provisions beginning in September 2022. observed
  4. Probable IAPP — Like the EU GDPR, the PDPL gives considerable control and rights to data subjects over their personal data. observed
  5. Probable IAPP — Virtually all organizations across all seven emirates that collect or process personal data, and organizations elsewhere processing personal data belonging to UAE residents, fall within the PDPL's compliance scope. observed
  6. Probable OneTrust DataGuidance — The DIFC and ADGM financial free zones operate independent data protection regimes (DIFC Law No. 5 of 2020; ADGM Data Protection Regulations 2021) outside the federal PDPL's civil and commercial jurisdiction. observed
  7. Probable OneTrust DataGuidance — ADGM requires registration of data controllers and notification of processing activities with the Commissioner of Data Protection, together with data protection fees and renewal fees, except for establishments with fewer than five employees unless they carry out high-risk processing. observed
  8. Probable OneTrust DataGuidance — DIFC entities must notify the Commissioner of processing operations as soon as possible and in any event within 14 days, paying a $1,250 registration fee and $500 annual renewal fee. observed
  9. Probable DataGuidance — Personal Data Protection Law — Federal Decree-Law No. 45 of 2021, in force 2 January 2022, establishing the controller/processor compliance regime under the UAE Data Office
  10. Probable DataGuidance — UAE Data Office — Established under Federal Decree-Law No. 44 of 2021 as the federal data regulator to regulate application of the PDPL
  11. Probable Dubai International Financial Centre (DIFC) — DIFC Data Protection Law — DIFC Law No. 5 of 2020, in force 1 July 2020 (last amended 1 January 2025), with a Commissioner of Data Protection responsible for supervision and enforcement observed
  12. Probable ADGM / Thomson Reuters Rulebook — ADGM Data Protection Regulations 2021 — In force 14 February 2021, establishing a Commissioner of Data Protection responsible for monitoring and enforcing the Regulations, with controller/processor registration duties observed
  13. Probable UAE Ministry of Justice – UAE Legislation Portal — Federal Decree-Law No. 45 of 2021 (PDPL) — Applies to processing of personal data, wholly or partly, through automated electronic systems or otherwise, by any controller/processor located in the UAE processing data of subjects residing/working inside or outside the UAE, and by controllers/processors outside the UAE processing data of subjects located inside the UAE observed
  14. Probable UAE Ministry of Justice – UAE Legislation Portal — Federal Decree-Law No. 45 of 2021 (PDPL) — Excludes from scope: government data held for security/judicial purposes, personal banking and credit data held by designated credit bodies, health data covered by separate legislation, and processing by an individual for purely personal/household purposes observed
  15. Probable Baker McKenzie — Federal Decree-Law No. 45 of 2021 (PDPL) — No general licensing, registration, notification or fee duty to the UAE Data Office; controllers/processors must keep an internal processing record producible to the Data Office on request observed
  16. Probable Al Tamimi & Company — Federal Authority for Artificial Intelligence and Data — Established 14 June 2026, consolidating AI Office, TDRA digital-government sector and UAE Data Office observed
  17. Probable Eversheds Sutherland — On 14 June 2026 the UAE Cabinet approved establishment of the Federal Authority for Artificial Intelligence and Data, absorbing the UAE Data Office (the PDPL's nominal supervisory body), the Office of Artificial Intelligence, and TDRA's Digital Government Sector. observed
  18. Disputed https://bshsoft.com/uae-data-protection-law-for-businesses — UAE Data Office — Described by a separate 2026 secondary source as now fully operational and issuing guidance
  19. High Lexology — Federal Authority for Artificial Intelligence and Data — Established 14 June 2026, consolidating the UAE Artificial Intelligence Office, the TDRA's Information and Digital Government Sector, and the UAE/Emirates Data Office under a single Cabinet-reporting structure. observed
  20. High Recording Law — PDPL Implementing Regulations — Not published as of mid-2026, more than four years after the PDPL entered force. observed
  21. High https://www.uaeexperthub.com/uae-data-protection-law-pdpl/ — PDPL Article 2(1)(c) — Applies to any controller or processor residing outside the UAE that carries out processing activities on the personal data of data subjects located within the State.
  22. Disputed https://www.recordinglaw.com/world-laws/world-data-privacy-laws/uae-data-privacy-laws/ — Sources are in direct conflict on the PDPL Executive Regulations' status: some state formal Executive Regulations had not been published in the Official Gazette as a discrete instrument as of mid-2026, while others cite Cabinet Decision No. 33 of 2024 as the in-force Executive Regulation.
  23. Probable iConnect IT Business Solutions — Federal Decree-Law No. 45 of 2021 (PDPL) — Does not apply to public entities, DIFC/ADGM free zones with their own DP legislation, or health/credit data governed by existing sectoral legislation observed
  24. Probable OBGulf — Federal Decree-Law No. 45 of 2021 (PDPL) — Covers processing of personal data of data subjects within the UAE regardless of controller/processor location observed
  25. Probable ABS Partners — Federal Decree-Law No. 45 of 2021 (PDPL) — The PDPL required Executive Regulations within six months of promulgation; these have not yet been issued as of this cycle. observed
  26. Probable UAE Ministry of Justice – UAE Legislation Portal — The PDPL applies to processing of personal data by UAE-based controllers/processors and, extraterritorially, to foreign controllers/processors processing data of subjects located in the UAE. observed
  27. Probable Baker McKenzie — The PDPL imposes no general registration or notification duty; record-of-processing must instead be produced to the UAE Data Office on request. observed
  28. Probable Dubai International Financial Centre (DIFC) — The DIFC Data Protection Law requires a DPIA before High Risk Processing Activities within DIFC. observed
  29. Probable ADGM / Thomson Reuters Rulebook — The ADGM Data Protection Regulations 2021 establish a Commissioner of Data Protection responsible for monitoring and enforcement. observed
  30. Disputed Business CISO — PDPL Executive Regulations / Cabinet penalty decision — not_stated observed
  31. Probable Lexnova — Artificial Intelligence and Data Authority (announced) — On 14 June 2026 the UAE Cabinet announced merging the federal AI Office, TDRA's Digital Government Sector and the UAE Data Office into the Artificial Intelligence and Data Authority, mandated to propose AI legislation; no establishing instrument had been published as of the source-check date. observed
  32. Probable Lexology — Federal Authority for Artificial Intelligence and Data — Cabinet approved establishment on 14 June 2026, consolidating the AI Office, TDRA's Digital Government Sector and the Emirates Data Office observed
  33. Disputed https://www.businessdubai.ae/blogs/uae-pdpl-data-protection — Federal Decree-Law No. 45 of 2021 (PDPL) — Independent 2026 UAE compliance sources report that federal PDPL Executive Regulations have not yet been issued, leaving the statutory grace-period trigger pending.
  34. Disputed Latham & Watkins — Federal Decree-Law No. 45 of 2021 (PDPL) — While the PDPL's Executive Regulations are pending, limiting their enforceability, the CDS Federal Law provides immediate privacy protections observed

#

Free-zone (DIFC/ADGM) lawful-basis and special-category rules are well-documented and GDPR-aligned; federal PDPL detail on lawful bases beyond consent-plus-exceptions was not confirmed in available sources.

Primary frameworkUAE Federal Decree-Law No. 45 of 2021 (PDPL); DIFC Law No. 5 of 2020; ADGM Data Protection Regulations 2021
Supervisory authorityUAE Data Office (Emirates Data Office)
Traffic-light rationale — AmberFree-zone (DIFC/ADGM) lawful-basis and special-category rules are well-documented and GDPR-aligned; federal PDPL detail on lawful bases beyond consent-plus-exceptions was not confirmed in available sources.
D2 · Lawful Processing — Full Module Record4 sub-modules · 43 words · 16 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

Rights exist in principle across federal, DIFC and ADGM instruments, but response-window specificity at federal level is unconfirmed.

Primary frameworkUAE Federal Decree-Law No. 45 of 2021 (PDPL); ADGM Data Protection Regulations 2021
Supervisory authorityUAE Data Office (Emirates Data Office)
Traffic-light rationale — AmberRights exist in principle across federal, DIFC and ADGM instruments, but response-window specificity at federal level is unconfirmed.

Sub-modules (5)

Access RightRed

General characterization of GDPR-comparable rights exists; specific access-right mechanics for the federal PDPL were not located in available sources.

Claims (1):

  • The PDPL is characterized as giving data subjects considerable control and rights over their personal data, comparable in intent to the EU GDPR.

Rectification And ErasureAmber

ADGM's right to erasure does not apply where processing is necessary for archiving/research and erasure would seriously impair those objectives.

Claims (3):

  • Under ADGM Regulations, the right to erasure does not apply to the extent that processing is necessary for archiving or research purposes where erasure would render impossible or seriously impair those objectives, provided appropriate safeguards are taken.
  • Federal Decree-Law No. 45 of 2021 (PDPL) — Art 15(2) gives the data subject a right to request erasure where the data is no longer necessary, consent is withdrawn, the subject objects with no legitimate grounds to continue, or processing violates the Decree-Law; Art 15(3) carves out public-health, investigation/legal-claims and other-legislation-conflict cases from the erasure right
  • Data subjects have an erasure right under Art 15(2), subject to the refusal grounds in Art 15(3).

Restriction And ObjectionRed

No AE-specific restriction/objection mechanics beyond general GDPR-alignment characterization were confirmed.

Claims (4):

  • Federal Decree-Law No. 45 of 2021 (PDPL) — Art 16 lets the data subject require restriction of processing where accuracy is disputed, processing is objected to as contrary to agreed purposes, or processing is unlawful; the controller must notify the data subject when a restriction is lifted (Art 16(4))
  • Federal Decree-Law No. 45 of 2021 (PDPL) — Art 17 gives an unqualified right to object to and stop direct-marketing processing (including related profiling); objection to statistical-survey processing may be overridden by public interest, and objection to processing violating Art 5 controls requires the controller to show compelling legitimate grounds
  • Under Art 16 the data subject may require restriction of processing in disputed-accuracy or unlawful-processing cases, and must be notified when a restriction is lifted.
  • Data subjects have an unqualified right to object to direct marketing (including profiling) under Art 17.

Data PortabilityRed

No AE-specific portability provisions were confirmed in available sources.

Claims (2):

  • Federal Decree-Law No. 45 of 2021 (PDPL) — Art 14 gives the data subject a right to obtain personal data provided to the controller in a structured, machine-readable format, and to have it transferred to another controller where technically feasible, provided processing is consent-based or contract-necessary and carried out by automated means
  • Data subjects have a data-portability right under Art 14 where processing is consent-based or contract-necessary and automated.

Deadlines And Response WindowsRed

Specific statutory response-time deadlines for federal PDPL data-subject requests were not confirmed; secondary commentary noted uncertainty over implementing details shortly after enactment.

Claims (3):

  • Shortly after PDPL enactment it remained uncertain exactly how breach reporting timelines (and, by extension, other statutory response windows) would be specified pending executive regulations.
  • Federal Decree-Law No. 45 of 2021 (PDPL) — The PDPL sets no numeric deadline for a controller to respond to a data-subject rights request or notify a breach; Articles 9 and 13-18 defer the applicable period to the Executive Regulations under Art 28, which remain unissued, so the operative standard is to act without undue delay
  • Federal Decree-Law No. 45 of 2021 (PDPL) — deadline pending Executive Regulations
Category narrative 37 words

The PDPL is characterized as granting GDPR-style data subject rights, though specific statutory response deadlines for federal-law subject-access or erasure requests were not confirmed in available sources; ADGM provides a right to erasure subject to archiving/research exceptions.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and claims (13)
  1. Probable IAPP — The PDPL is characterized as giving data subjects considerable control and rights over their personal data, comparable in intent to the EU GDPR. observed
  2. Probable OneTrust DataGuidance — Under ADGM Regulations, the right to erasure does not apply to the extent that processing is necessary for archiving or research purposes where erasure would render impossible or seriously impair those objectives, provided appropriate safeguards are taken. observed
  3. Uncertain IAPP — Shortly after PDPL enactment it remained uncertain exactly how breach reporting timelines (and, by extension, other statutory response windows) would be specified pending executive regulations. observed
  4. Probable Latham & Watkins — Federal Decree-Law No. 45 of 2021 (PDPL) — The PDPL sets no numeric deadline for a controller to respond to a data-subject rights request or notify a breach; Articles 9 and 13-18 defer the applicable period to the Executive Regulations under Art 28, which remain unissued, so the operative standard is to act without undue delay observed
  5. Probable UAE Ministry of Justice – UAE Legislation Portal — Federal Decree-Law No. 45 of 2021 (PDPL) — Art 15(2) gives the data subject a right to request erasure where the data is no longer necessary, consent is withdrawn, the subject objects with no legitimate grounds to continue, or processing violates the Decree-Law; Art 15(3) carves out public-health, investigation/legal-claims and other-legislation-conflict cases from the erasure right observed
  6. Probable Modulos — Federal Decree-Law No. 45 of 2021 (PDPL) — Art 16 lets the data subject require restriction of processing where accuracy is disputed, processing is objected to as contrary to agreed purposes, or processing is unlawful; the controller must notify the data subject when a restriction is lifted (Art 16(4)) observed
  7. Probable Virtual Data Protection Officer (vdpo.org) — Federal Decree-Law No. 45 of 2021 (PDPL) — Art 17 gives an unqualified right to object to and stop direct-marketing processing (including related profiling); objection to statistical-survey processing may be overridden by public interest, and objection to processing violating Art 5 controls requires the controller to show compelling legitimate grounds observed
  8. Probable DLA Piper — Federal Decree-Law No. 45 of 2021 (PDPL) — Art 14 gives the data subject a right to obtain personal data provided to the controller in a structured, machine-readable format, and to have it transferred to another controller where technically feasible, provided processing is consent-based or contract-necessary and carried out by automated means observed
  9. Probable Latham & Watkins — Federal Decree-Law No. 45 of 2021 (PDPL) — deadline pending Executive Regulations observed
  10. Probable UAE Ministry of Justice – UAE Legislation Portal — Data subjects have an erasure right under Art 15(2), subject to the refusal grounds in Art 15(3). observed
  11. Probable Modulos — Under Art 16 the data subject may require restriction of processing in disputed-accuracy or unlawful-processing cases, and must be notified when a restriction is lifted. observed
  12. Probable Virtual Data Protection Officer (vdpo.org) — Data subjects have an unqualified right to object to direct marketing (including profiling) under Art 17. observed
  13. Probable DLA Piper — Data subjects have a data-portability right under Art 14 where processing is consent-based or contract-necessary and automated. observed

#

Free-zone (DIFC/ADGM) controller duties are well documented and GDPR-aligned; federal PDPL implementing detail (fine schedules, precise breach timelines) is not confirmed.

Primary frameworkDIFC Law No. 5 of 2020; ADGM Data Protection Regulations 2021; UAE Federal Decree-Law No. 45 of 2021 (PDPL)
Supervisory authorityDIFC Commissioner of Data Protection
Traffic-light rationale — AmberFree-zone (DIFC/ADGM) controller duties are well documented and GDPR-aligned; federal PDPL implementing detail (fine schedules, precise breach timelines) is not confirmed.
D4 · Controller & Processor — Full Module Record7 sub-modules · 49 words · 24 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Strong DIFC/ADGM evidence on transfer mechanisms and adequacy granted; federal PDPL transfer detail and adequacy received status are unconfirmed/pending.

Primary frameworkDIFC Law No. 5 of 2020; ADGM Data Protection Regulations 2021
Supervisory authorityDIFC Commissioner of Data Protection
Traffic-light rationale — AmberStrong DIFC/ADGM evidence on transfer mechanisms and adequacy granted; federal PDPL transfer detail and adequacy received status are unconfirmed/pending.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 70 words · 19 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Telecoms and health overlays are documented; financial-sector overlay evidence is limited to one regulation; credit, education and insurance sub-modules have no confirmed evidence.

Supervisory authorityTelecommunications and Digital Government Regulatory Authority (TRA/TDRA)
Traffic-light rationale — AmberTelecoms and health overlays are documented; financial-sector overlay evidence is limited to one regulation; credit, education and insurance sub-modules have no confirmed evidence.
D6 · Sectoral Watch — Full Module Record7 sub-modules · 78 words · 15 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

No comprehensive adtech-specific regime was confirmed for the UAE in available research; only the general PDPL consent framework applies.

Traffic-light rationale — RedNo comprehensive adtech-specific regime was confirmed for the UAE in available research; only the general PDPL consent framework applies.
D7 · AdTech & Marketing — Full Module Record6 sub-modules · 27 words · 8 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

AI policy infrastructure and one DIFC-specific binding regulation are documented; federal biometric/genetic/surveillance-carveout specifics are unconfirmed.

Primary frameworkDIFC Regulation 10 on Processing Personal Data Through Autonomous and Semi-Autonomous Systems
Supervisory authorityUAE AI Office / Council for AI and Blockchain
Traffic-light rationale — AmberAI policy infrastructure and one DIFC-specific binding regulation are documented; federal biometric/genetic/surveillance-carveout specifics are unconfirmed.
Periodic update · new data 2026-11-03

Algorithmic, Biometric & Surveillance Governance

The establishment of the Federal Authority for Artificial Intelligence and Data, effective 14 June 2026, is the material development for algorithmic governance in the UAE, not because it introduces new substantive AI rules but because of what it structurally consolidates. The new body absorbs the Office of Artificial Intelligence alongside the Information and Digital Government Sector of the Telecommunications and Digital Government Regulatory Authority and the previously non-operational UAE Data Office. The effect is that AI policy and data protection, two functions that in many jurisdictions sit in entirely separate regulatory bodies, are now administered by a single Cabinet-reporting authority in the UAE.

As far as the research has established, the 2024 UAE Charter for Artificial Intelligence remains the sole AI-specific instrument in the jurisdiction, and it is non-binding in character. No new binding AI-specific statute, nor any AE-specific rule on automated decision-making, profiling, or biometric processing, was located to supplement or formalise the Charter's non-binding principles. The consolidation of AI policy and data-protection functions into one authority is therefore, at this stage, a structural rather than a substantive development: it changes who administers both mandates, but it has not yet, on the evidence available, produced new binding rules governing algorithmic or biometric processing specifically.

This structural pairing is nonetheless significant for how algorithmic governance is likely to evolve in the UAE going forward, since any future binding AI-specific rulemaking would now emerge from the same body that administers the Personal Data Protection Law, creating a natural institutional path for data-protection and AI-governance requirements to be developed in a more integrated fashion than would be possible under separate agencies.

Outlook

Whether the Federal Authority for Artificial Intelligence and Data uses its newly consolidated mandate to move the 2024 UAE Charter for Artificial Intelligence toward binding status, or to issue new rules specifically addressing algorithmic decision-making or biometric processing, is the key open question for this domain going forward. The institutional consolidation itself is a necessary precondition for more integrated rulemaking, but it is not, on its own, evidence that such rulemaking is imminent, and no dated commitment to issue binding AI-specific rules was located.

Periodic update · new data 2026-10-11

Algorithmic, Biometric & Surveillance Governance

The establishment of the Federal Authority for Artificial Intelligence and Data, effective 14 June 2026, is the material development for algorithmic governance in the UAE this cycle, not because it introduces new substantive AI rules but because of what it structurally consolidates. The new body absorbs the Office of Artificial Intelligence alongside the Information and Digital Government Sector of the Telecommunications and Digital Government Regulatory Authority and the previously non-operational UAE Data Office. The effect is that AI policy and data protection, two functions that in many jurisdictions sit in entirely separate regulatory bodies, are now administered by a single Cabinet-reporting authority in the UAE.

As far as this cycle's research has established, the 2024 UAE Charter for Artificial Intelligence remains the sole AI-specific instrument in the jurisdiction, and it is non-binding in character. No new binding AI-specific statute, nor any AE-specific rule on automated decision-making, profiling, or biometric processing, was located this cycle to supplement or formalise the Charter's non-binding principles. The consolidation of AI policy and data-protection functions into one authority is therefore, at this stage, a structural rather than a substantive development: it changes who administers both mandates, but it has not yet, on the evidence available this cycle, produced new binding rules governing algorithmic or biometric processing specifically.

This structural pairing is nonetheless significant for how algorithmic governance is likely to evolve in the UAE going forward, since any future binding AI-specific rulemaking would now emerge from the same body that administers the Personal Data Protection Law, creating a natural institutional path for data-protection and AI-governance requirements to be developed in a more integrated fashion than would be possible under separate agencies.

Outlook

Whether the Federal Authority for Artificial Intelligence and Data uses its newly consolidated mandate to move the 2024 UAE Charter for Artificial Intelligence toward binding status, or to issue new rules specifically addressing algorithmic decision-making or biometric processing, is the key open question for this domain going forward. The institutional consolidation itself is a necessary precondition for more integrated rulemaking, but it is not, on its own, evidence that such rulemaking is imminent, and no dated commitment to issue binding AI-specific rules was located this cycle.

D8 · AI, Biometrics & Automated — Full Module Record6 sub-modules · 50 words · 12 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Coverage of children's/vulnerable-groups' data is thin and inconsistent across the UAE's fragmented regime; no dedicated federal children's-data regime was confirmed.

Traffic-light rationale — RedCoverage of children's/vulnerable-groups' data is thin and inconsistent across the UAE's fragmented regime; no dedicated federal children's-data regime was confirmed.
D9 · Children's Privacy — Full Module Record5 sub-modules · 59 words · 13 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

DIFC enforcement track record and powers are well documented; federal PDPL-specific enforcement activity, funding, and any collective-redress mechanism remain unconfirmed, and no confirmed developments within the last 180 days were located.

Primary frameworkDIFC Law No. 5 of 2020
Supervisory authorityDIFC Commissioner of Data Protection
Traffic-light rationale — AmberDIFC enforcement track record and powers are well documented; federal PDPL-specific enforcement activity, funding, and any collective-redress mechanism remain unconfirmed, and no confirmed developments within the last 180 days were located.
Periodic update · new data 2026-09-28

Enforcement & Redress

Enforcement intensity under the PDPL is contested across this cycle's sources in a way that mirrors the broader Data Office operational-status dispute. A 2026 secondary source cites administrative fines of up to AED 5 million for processing sensitive personal data without lawful basis or explicit consent, describing these fines as applied in enforcement actions from 2025 onward. This figure is not corroborated by a directly retrieved Data Office enforcement record or primary penalty schedule this cycle, so it should be read as a reported penalty ceiling rather than a confirmed, currently-enforced figure.

A separate 2026 Chambers and Partners practice guide takes a different tack, describing the practical effect of the PDPL's incomplete operationalisation as limited enforcement activity to date, with organisations largely driving compliance internally rather than in response to active regulatory pressure. This account is in tension with the first: one source implies enforcement actions are already occurring at meaningful penalty levels, the other implies enforcement activity has been limited in practice. Both accounts are retained rather than reconciled, consistent with the disputed-state doctrine applied elsewhere in this cycle's UAE record, because averaging or silently preferring one account over the other would manufacture a certainty the evidence does not support.

The practical takeaway for this cycle is that the PDPL's enforcement reality is genuinely unsettled: the statutory penalty architecture may exist on paper, per the AED 5 million figure, while actual enforcement practice may remain limited, per the Chambers account, and both can be true simultaneously without contradiction if the cited fines represent maximum exposure rather than typical outcomes.

Outlook

A directly retrieved Data Office enforcement record, or a confirmed enforcement action naming a specific penalty amount, would meaningfully sharpen this picture in either direction. Until then, the enforcement-and-redress picture should be read as unsettled rather than as either aggressively enforced or dormant.

D10 · Enforcement & Redress — Full Module Record6 sub-modules · 61 words · 23 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)
No categories match.

Filters combine as OR inside a group and AND across groups.

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score. Not shown on this page.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 177 claim(s) (177 category placement(s)), 88 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 3 Nov 2026: not upheld (26 confirmed against the cited source; 2 contradicted by the cited source; 10 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (20 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 15Data Subject Rightsaccess right
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrectification and erasure
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 13-14Data Subject Rightsaccess right
Art. 16-17Data Subject Rightsrectification and erasure
Art. 32-34Controller/Processor Dutiessecurity measures
Art. 37-39Controller/Processor Dutiesdpo requirements
Art. 44-49Cross-Border & Adequacytransfer mechanisms
Art. 77-84Enforcement & Redressregulator powers and penalties