Data Protection Monitor
Global Privacy & Data Protection Intelligence

United Arab Emirates (AE) · Module Detail

United Arab Emirates: Children & Vulnerable Groups

#

Coverage of children's/vulnerable-groups' data is thin and inconsistent across the UAE's fragmented regime; no dedicated federal children's-data regime was confirmed.

Traffic-light rationale — RedCoverage of children's/vulnerable-groups' data is thin and inconsistent across the UAE's fragmented regime; no dedicated federal children's-data regime was confirmed.

Sub-modules (5)

Age VerificationAmber

ADGM defines a child as a natural person under 18, but no age-verification mechanism was confirmed.

Claims (1):

  • ADGM Data Protection Regulations define a child as a natural person under the age of 18, in contrast to GDPR's default age of consent of 16 (adjustable by Member States to not younger than 13), but do not explicitly outline requirements for consent to process children's data.

Minor Profiling BansRed

No AE-specific minor-profiling ban was confirmed in available sources.

Absence provenance: unavailable. Searched: UAE Federal Data Protection Law 2021 PDPL UAE Data Office.

Education SettingsRed

No AE-specific education-sector children's-data rules were confirmed.

Absence provenance: unavailable. Searched: UAE TDRA telecommunications data protection consumer protection regulation cybercrime law personal data.

Dependent AdultsRed

No AE-specific dependent-adult data protections were confirmed in available sources.

Absence provenance: unavailable. Searched: UAE Federal Data Protection Law 2021 PDPL UAE Data Office.

Category narrative59 words

Free-zone instruments provide limited, inconsistent coverage of children's data: ADGM defines a child as under 18 (versus GDPR's 16, adjustable to 13) but does not set explicit parental-consent mechanics, while DIFC Law 2020, like its 2007 predecessor, does not generally address children's data at all. No federal PDPL-specific children's-data provisions, minor-profiling bans, education-setting rules, or dependent-adult protections were confirmed.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and claims (2)
  1. ProbableOneTrust DataGuidance — ADGM Data Protection Regulations define a child as a natural person under the age of 18, in contrast to GDPR's default age of consent of 16 (adjustable by Member States to not younger than 13), but do not explicitly outline requirements for consent to process children's data.observed
  2. ProbableOneTrust DataGuidance — DIFC Law 2020, consistent with its 2007 predecessor, does not generally refer to children's data or provide specific requirements for collecting personal data from children.observed