---
title: "United Arab Emirates — Data Subject Rights | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/united-arab-emirates/data-subject-rights/
source_html: /jurisdictions/united-arab-emirates/data-subject-rights/index.html
description: "United Arab Emirates — Data Subject Rights: data_subject_rights Data Subject Rights 5 sub-modules 3 claims Amber ▾ # Rights exist in principle across federal, DIFC and ADGM instruments, but response-window specificity at federal"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 41953726cc3f0e35d9d37f1ec9df44fc6a841419cd369a4fcf57d1de592d587b
generator: "fe-fleet/md-twin@1.0"
---
# United Arab Emirates — Data Subject Rights | Data Protection Monitor

### D3Data Subject Rights5 sub-modules3 claimsAmber▾#

Rights exist in principle across federal, DIFC and ADGM instruments, but response-window specificity at federal level is unconfirmed.

Primary framework UAE Federal Decree-Law No. 45 of 2021 (PDPL); ADGM Data Protection Regulations 2021

Supervisory authority UAE Data Office (Emirates Data Office)

Traffic-light rationale — Amber Rights exist in principle across federal, DIFC and ADGM instruments, but response-window specificity at federal level is unconfirmed.

#### Sub-modules (5)

#### Access RightRed

General characterization of GDPR-comparable rights exists; specific access-right mechanics for the federal PDPL were not located in available sources.

Absence provenance: unavailable . Searched: UAE PDPL data subject rights right to access erasure objection cross border transfer adequacy list.

Claims (1):

- The PDPL is characterized as giving data subjects considerable control and rights over their personal data, comparable in intent to the EU GDPR.

#### Rectification And ErasureAmber

ADGM's right to erasure does not apply where processing is necessary for archiving/research and erasure would seriously impair those objectives.

Claims (1):

- Under ADGM Regulations, the right to erasure does not apply to the extent that processing is necessary for archiving or research purposes where erasure would render impossible or seriously impair those objectives, provided appropriate safeguards are taken.

#### Restriction And ObjectionRed

No AE-specific restriction/objection mechanics beyond general GDPR-alignment characterization were confirmed.

Absence provenance: unavailable . Searched: UAE PDPL executive regulations 2024 issued Cabinet Decision breach notification timeline fine.

#### Data PortabilityRed

No AE-specific portability provisions were confirmed in available sources.

Absence provenance: unavailable . Searched: UAE Federal Decree Law 45 2021 PDPL fines penalties DPO threshold data subject rights.

#### Deadlines And Response WindowsRed

Specific statutory response-time deadlines for federal PDPL data-subject requests were not confirmed; secondary commentary noted uncertainty over implementing details shortly after enactment.

Claims (1):

- Shortly after PDPL enactment it remained uncertain exactly how breach reporting timelines (and, by extension, other statutory response windows) would be specified pending executive regulations.

Category narrative 37 words

The PDPL is characterized as granting GDPR-style data subject rights, though specific statutory response deadlines for federal-law subject-access or erasure requests were not confirmed in available sources; ADGM provides a right to erasure subject to archiving/research exceptions.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Evidence 3

Sources and claims (3)
- Probable[IAPP](https://iapp.org/news/a/10-practical-steps-to-prepare-for-the-uaes-personal-data-protection-law) — The PDPL is characterized as giving data subjects considerable control and rights over their personal data, comparable in intent to the EU GDPR.observed 2026-07-29
- Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v._adgm.pdf) — Under ADGM Regulations, the right to erasure does not apply to the extent that processing is necessary for archiving or research purposes where erasure would render impossible or seriously impair those objectives, provided appropriate safeguards are taken.observed 2026-07-29
- Uncertain[IAPP](https://iapp.org/news/a/10-practical-steps-to-prepare-for-the-uaes-personal-data-protection-law) — Shortly after PDPL enactment it remained uncertain exactly how breach reporting timelines (and, by extension, other statutory response windows) would be specified pending executive regulations.observed 2026-07-29