---
title: "United Arab Emirates Data Protection & Privacy Regulation | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/united-arab-emirates/
source_html: /jurisdictions/united-arab-emirates/index.html
description: "United Arab Emirates data protection and privacy regulation: 10 categories, 177 claims, updated 2026-11-04."
generated_at: 2026-11-07T14:58:19Z
content_sha256: 653f3eee6fe8859abe3957f8ab6627702f77a3f0522c41b3fe5f67a790b3ee82
generator: "fe-fleet/md-twin@1.0"
---
# United Arab Emirates Data Protection & Privacy Regulation | Data Protection Monitor

Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.

# United Arab Emirates Data Protection & Privacy Regulation

schema gdpri-v2
trajectory: not yet assessed hybrid regime overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/united-arab-emirates/), [World Payments](https://payments.gi/jurisdictions/united-arab-emirates/), artificial-intelligence

Last updated 2026-11-04 · 10 categories · 177
claims · 88 sources in the cumulative register

Download report (PDF) Expand all

The United Arab Emirates has established a Federal Authority for Artificial Intelligence and Data, effective 14 June 2026, consolidating the UAE Artificial Intelligence Office, the Telecommunications and Digital Government Regulatory Authority's Information and Digital Government Sector, and the UAE/Emirates Data Office under a single Cabinet-reporting structure.

Data collected 2026-11-04 · Data published 2026-11-04

AI-assembled from cited sources

Not fully checked this cycle: AdTech & Commercial Privacy, Enforcement & Redress (3 open gaps).

Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

[Open in Co-Pilot ↗](/reports/?type=copilot&j=UNITED-ARAB-EMIRATES)[Build Report](/reports/?j=UNITED-ARAB-EMIRATES)[Compare](/compare/?j=UNITED-ARAB-EMIRATES)

Framework posture Hybrid regime 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified

Lead supervisory authority UAE Data Office (Emirates Data Office) Primary statutory & supervisory perimeter

Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record

Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain

10 Categories

2 Red categories 57 Sub-modules

177 Claims

1 Tier-1 sources

Traffic-light mix 8 amber 2 red
(sums to 10 rendered categories; click to filter)

2 categories flagged red

## Jurisdiction brief

Jurisdiction lead brief 1,293 Full executive summary 241 Jurisdiction sub-brief 2 166

###### Latest update · 3 November 2026

#### Lead Signal

The UAE's data-protection institutional architecture consolidated with the establishment of the Federal Authority for Artificial Intelligence and Data, effective 14 June 2026. The new Cabinet-reporting body absorbs the Office of Artificial Intelligence, the Information and Digital Government Sector of the Telecommunications and Digital Government Regulatory Authority, and the UAE Data Office into a single institution. The UAE Data Office never became fully operational prior to this absorption, meaning the new Authority effectively represents the UAE's first operationally consolidated federal regulator with a clear data-protection mandate, now paired structurally with the AI-policy function in a single body.

Alongside this institutional consolidation, a genuine dispute persists across sources regarding whether the Personal Data Protection Law's Executive Regulations have actually been issued. Multiple commercial-compliance sites assert the Executive Regulations have been issued, citing varying Cabinet Decision numbers, while the most rigorous primary-source check available, against the UAE Legislation portal as checked 11 August 2026, found no corresponding entry. This is a disputed claim across sources of comparable commercial standing, and no primary-source resolution has been located; it is reported here as disputed rather than resolved in either direction.

#### Other Developments

The new Federal Authority's mandate spans both AI policy and data protection , a structural pairing with direct relevance to algorithmic governance in the UAE. The 2024 UAE Charter for Artificial Intelligence remains, as far as the research has established, the only AI-specific instrument in the jurisdiction, and it is non-binding. The consolidation of the AI-policy function and the data-protection function into one Cabinet-reporting authority is, at probable confidence, a material institutional development, since it places algorithmic and biometric governance questions within the same regulatory body that administers the Personal Data Protection Law, rather than splitting the two mandates across separate agencies as was previously the case.

#### Cross-Monitor Connections

The new Federal Authority for Artificial Intelligence and Data's dual mandate is relevant to any monitor tracking artificial-intelligence governance developments in the UAE, since the same body that now administers data protection also inherits the AI-policy function previously housed in the Office of Artificial Intelligence. The link out to the artificial-intelligence monitor is structural rather than substantive: this brief does not re-analyse AI-specific regulatory content, only the institutional consolidation that brings the two mandates under one roof.

#### Outlook

The UAE's data-protection regime now has a single, consolidated institutional home in the Federal Authority for Artificial Intelligence and Data, but the underlying legal uncertainty over whether the Personal Data Protection Law's Executive Regulations have been issued remains unresolved as. Clarification of that status, whether through a confirmed UAE Legislation portal entry or an authoritative statement from the new Federal Authority itself, would be the most consequential near-term development for the UAE's data-protection regime, since it bears directly on the degree to which the law's operative provisions, including breach-notification timelines and administrative penalties, can be treated as settled rather than practitioner-inferred.

2 earlier updates not shown here.

###### Standing brief · as of 17 August 2026

Written before the update above. Where they differ, the update is the more recent position.

#### Lead Signal

The United Arab Emirates has established a Federal Authority for Artificial Intelligence and Data, effective 14 June 2026, consolidating the UAE Artificial Intelligence Office, the Telecommunications and Digital Government Regulatory Authority's Information and Digital Government Sector, and the UAE/Emirates Data Office under a single Cabinet-reporting structure. The new authority now centralises national AI-strategy oversight alongside data-governance regulation, folding the two previously separate policy tracks into one institutional home. The move lands against a backdrop in which the federal Personal Data Protection Law's Implementing Regulations remain unpublished more than four years after the law entered force, leaving the operative detail of the PDPL's obligations still dependent on secondary guidance and practice rather than binding implementing text. The consolidation reads as a deliberate policy fusion of AI governance and data-protection oversight, pointing toward a more AI-centric supervisory posture than has so far been visible among peer Gulf jurisdictions.

#### Other Developments

In the Dubai International Financial Centre, the free-zone data protection regime has continued to diverge from the federal PDPL baseline. DIFC Amendment Law No. 1 of 2025, effective 15 July 2025, now requires organisations to document a formal adequacy assessment before relying on cross-border transfer mechanisms, and gives the DIFC Commissioner power to review and withdraw adequacy decisions. The same amendment law introduced a private right of action allowing individuals to bring claims directly in the DIFC Courts over data mishandling, removing the prior dependence on regulator-led enforcement. On 18 June 2026 the DIFC opened a further consultation, Consultation Paper No. 3 of 2026, running to 18 July 2026, proposing to embed AI-system safety requirements into the data protection regulations and to clarify certification obligations and the role of the Autonomous Systems Officer.

At the federal level, the PDPL's own cross-border transfer regime remains structurally incomplete: as of mid-2026 the UAE Data Office has not published a federal adequacy list or official Standard Contractual Clauses, leaving controllers to rely on the PDPL's Article 23 mechanisms — binding contracts imposing PDPL-equivalent protections, express consent, court necessity, contract performance, judicial cooperation, or public-interest grounds — without a standardised federal instrument. Separately, Federal Decree-Law No. 26 of 2025 on Child Digital Safety has established a dedicated federal framework for children's digital protection that sits alongside the general PDPL regime.

The federal PDPL's core architecture remains otherwise unchanged this cycle. Article 2(1)(c) continues to give the law extraterritorial reach, applying to any controller or processor located outside the UAE that processes the personal data of data subjects located within the State. The law obliges a controller to appoint a Data Protection Officer where it is involved in the systematic processing and overall assessment of special categories of personal data. On breach response, the Data Office is understood to generally interpret the PDPL's requirement of immediate notification as within 72 hours of discovery, aligning UAE practice with international norms, though this is a practice-based interpretation rather than a fixed statutory deadline. Sector-specific overlays continue to sit outside the PDPL's general scope: credit-reporting data is governed separately under Federal Law No. 6 of 2010, and health-sector data processing is subject to its own overlay under Federal Law No. 2 of 2019 on ICT in health fields. On enforcement, the PDPL itself specifies no administrative fine; Article 26 leaves the penalty schedule to a Cabinet decision that has still not been published.

Taken together, DIFC's private right of action and its new documentation requirements for adequacy assessments now materially outpace the federal PDPL regime, which still lacks both Implementing Regulations and a published penalty schedule more than four years after enactment, widening the practical enforcement gap between the DIFC free zone and onshore UAE.

#### Cross-Monitor Connections

The credit-information regime under Federal Law No. 6 of 2010, which keeps AECB credit reporting outside the PDPL, intersects with financial-sector customer-data handling — a dimension for the financial-integrity monitor to track rather than one this brief will analyse further. Separately, the new Federal Authority for Artificial Intelligence and Data and the DIFC's AI-safety consultation are substantially AI-governance developments with a data-protection dimension; readers tracking algorithmic oversight should follow the artificial-intelligence monitor for the primary analysis of that authority's mandate and the DIFC's proposed certification regime.

#### Outlook

The DIFC Consultation Paper No. 3 of 2026 closes for comment on 18 July 2026; its outcome will determine whether AI-system safety requirements and Autonomous Systems Officer certification obligations are formally embedded into DIFC's data protection regulations. At the federal level, the PDPL Implementing Regulations and the Article 26 penalty schedule remain outstanding more than four years after enactment. The consolidation of AI and data-governance functions under thenew Federal Authority is likely to shape how PDPL supervision and AI oversight are exercised together going forward.

Read full brief · 1293 words

Standing brief, as of 17 August 2026.

#### Regulatory Status

The UAE's federal data-governance architecture underwent its most significant institutional change since the Personal Data Protection Law's enactment, with the Federal Authority for Artificial Intelligence and Data established on 14 June 2026 to consolidate the UAE Artificial Intelligence Office, the Telecommunications and Digital Government Regulatory Authority's Information and Digital Government Sector, and the UAE/Emirates Data Office under a single Cabinet-reporting structure. The same authority now centralises national AI-strategy oversight alongside data-governance regulation. Despite this consolidation, the PDPL's Implementing Regulations remain unpublished more than four years after the law entered force, and Article 26's administrative-fine schedule likewise awaits a Cabinet decision that has not been published. The PDPL's transfer regime remains structurally incomplete at federal level: the UAE Data Office has not published a federal adequacy list or official Standard Contractual Clauses, leaving controllers to rely on Article 23's case-by-case mechanisms — binding contracts imposing PDPL-equivalent protections, express consent, court necessity, contract performance, judicial cooperation, or public-interest grounds. On children's data, Federal Decree-Law No. 26 of 2025 on Child Digital Safety establishes a dedicated federal framework for children's digital protection alongside the general PDPL regime, though its operative detail was not fully retrievable this cycle.

#### Outlook

The newly consolidated Federal Authority's early priorities — particularly whether it accelerates the outstanding Implementing Regulations and the Article 26 penalty schedule — will be a key marker of the federal regime's trajectory in the coming cycles.

Read full brief · 241 words

Standing brief, as of 17 August 2026.

#### Regulatory Status

DIFC Amendment Law No. 1 of 2025, effective 15 July 2025, requires organisations to document a formal adequacy assessment before relying on cross-border transfer mechanisms, and gives the DIFC Commissioner power to review and withdraw adequacy decisions. The same amendment law introduced a private right of action allowing individuals to bring claims directly in the DIFC Courts over data mishandling, removing the prior dependence on regulator-led enforcement. On 18 June 2026 the DIFC opened Consultation Paper No. 3 of 2026, running to 18 July 2026, proposing to embed AI-system safety requirements into the data protection regulations and to clarify certification obligations and the role of the Autonomous Systems Officer.

#### Outlook

The DIFC consultation closes for comment on 18 July 2026. Its outcome, together with the now-active private right of action, will determine whether the DIFC's data protection regime continues to diverge further from the federal PDPL baseline, which still lacks Implementing Regulations and a published penalty schedule.

Read full brief · 166 words

Key regulatory facts for United Arab Emirates Regulatory Dimension United Arab Emirates Standing Position

Jurisdiction United Arab Emirates (AE)

Regulatory Scope Data Protection & Privacy Regulation (10 modules, 177 sourced findings)

Regulator & Framework A comprehensive federal statute is in force, but implementing/executive regulation detail (fines, breach timelines) remained unconfirmed in available secondary sources, and the regime is fragmented across federal,...

Lawful Processing & Special Data Free-zone (DIFC/ADGM) lawful-basis and special-category rules are well-documented and GDPR-aligned; federal PDPL detail on lawful bases beyond consent-plus-exceptions was not confirmed in available sources.

Data Subject Rights Rights exist in principle across federal, DIFC and ADGM instruments, but response-window specificity at federal level is unconfirmed.

Controller/Processor Duties Free-zone (DIFC/ADGM) controller duties are well documented and GDPR-aligned; federal PDPL implementing detail (fine schedules, precise breach timelines) is not confirmed.

Primary Instruments Cited IAPP, OneTrust DataGuidance, OneTrust DataGuidance, DataGuidance, Dubai International Financial Centre (DIFC)

Last Confirmed / Updated 2026-11-04 (88 sources in cumulative register)

10 of 10 categories

Signal
Red
Amber
Green

Density
Comfortable
Compact

Expand all sources
Reset all

Selections OR within a group, AND across groups. Press / to search.

### United Arab Emirates: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾

A comprehensive federal statute is in force, but implementing/executive regulation detail (fines, breach timelines) remained unconfirmed in available secondary sources, and the regime is fragmented across federal, DIFC and ADGM authorities.

Primary framework UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)

Supervisory authority UAE Data Office (Emirates Data Office)

Traffic-light rationale — Amber A comprehensive federal statute is in force, but implementing/executive regulation detail (fines, breach timelines) remained unconfirmed in available secondary sources, and the regime is fragmented across federal, DIFC and ADGM authorities.

#### Sub-modules (5)

#### Regulator And AuthorityAmber

Federal enforcement sits with the Emirates Data Office; DIFC and ADGM each maintain their own Commissioner/Office of Data Protection for their free zones.

Claims (11):

- The UAE enacted Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data as part of a sweeping package of legal reforms marking the UAE's 50th anniversary.
- The PDPL decrees established the Emirates Data Office to monitor and enforce the UAE Personal Data Protection Law countrywide.
- UAE Data Office — Established under Federal Decree-Law No. 44 of 2021 as the federal data regulator to regulate application of the PDPL
- Federal Authority for Artificial Intelligence and Data — Established 14 June 2026, consolidating AI Office, TDRA digital-government sector and UAE Data Office
- On 14 June 2026 the UAE Cabinet approved establishment of the Federal Authority for Artificial Intelligence and Data, absorbing the UAE Data Office (the PDPL's nominal supervisory body), the Office of Artificial Intelligence, and TDRA's Digital Government Sector.
- UAE Data Office — Described by a separate 2026 secondary source as now fully operational and issuing guidance
- Federal Authority for Artificial Intelligence and Data — Established 14 June 2026, consolidating the UAE Artificial Intelligence Office, the TDRA's Information and Digital Government Sector, and the UAE/Emirates Data Office under a single Cabinet-reporting structure.
- The DIFC Data Protection Law requires a DPIA before High Risk Processing Activities within DIFC.
- The ADGM Data Protection Regulations 2021 establish a Commissioner of Data Protection responsible for monitoring and enforcement.
- Artificial Intelligence and Data Authority (announced) — On 14 June 2026 the UAE Cabinet announced merging the federal AI Office, TDRA's Digital Government Sector and the UAE Data Office into the Artificial Intelligence and Data Authority, mandated to propose AI legislation; no establishing instrument had been published as of the source-check date.
- Federal Authority for Artificial Intelligence and Data — Cabinet approved establishment on 14 June 2026, consolidating the AI Office, TDRA's Digital Government Sector and the Emirates Data Office

#### Act And InstrumentsAmber

Federal Decree-Law No. 45 of 2021 (PDPL) is the primary federal instrument; DIFC Law No. 5 of 2020 and ADGM Data Protection Regulations 2021 are independent free-zone instruments.

Claims (11):

- The UAE enacted Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data as part of a sweeping package of legal reforms marking the UAE's 50th anniversary.
- The DIFC and ADGM financial free zones operate independent data protection regimes (DIFC Law No. 5 of 2020; ADGM Data Protection Regulations 2021) outside the federal PDPL's civil and commercial jurisdiction.
- Personal Data Protection Law — Federal Decree-Law No. 45 of 2021, in force 2 January 2022, establishing the controller/processor compliance regime under the UAE Data Office
- DIFC Data Protection Law — DIFC Law No. 5 of 2020, in force 1 July 2020 (last amended 1 January 2025), with a Commissioner of Data Protection responsible for supervision and enforcement
- ADGM Data Protection Regulations 2021 — In force 14 February 2021, establishing a Commissioner of Data Protection responsible for monitoring and enforcing the Regulations, with controller/processor registration duties
- PDPL Implementing Regulations — Not published as of mid-2026, more than four years after the PDPL entered force.
- Sources are in direct conflict on the PDPL Executive Regulations' status: some state formal Executive Regulations had not been published in the Official Gazette as a discrete instrument as of mid-2026, while others cite Cabinet Decision No. 33 of 2024 as the in-force Executive Regulation.
- Federal Decree-Law No. 45 of 2021 (PDPL) — The PDPL required Executive Regulations within six months of promulgation; these have not yet been issued as of this cycle.
- PDPL Executive Regulations / Cabinet penalty decision — not_stated
- Federal Decree-Law No. 45 of 2021 (PDPL) — Independent 2026 UAE compliance sources report that federal PDPL Executive Regulations have not yet been issued, leaving the statutory grace-period trigger pending.
- Federal Decree-Law No. 45 of 2021 (PDPL) — While the PDPL's Executive Regulations are pending, limiting their enforceability, the CDS Federal Law provides immediate privacy protections

#### Material ScopeAmber

The PDPL is described as GDPR-influenced, granting data subjects considerable rights and control over personal data.

Claims (3):

- Like the EU GDPR, the PDPL gives considerable control and rights to data subjects over their personal data.
- Federal Decree-Law No. 45 of 2021 (PDPL) — Excludes from scope: government data held for security/judicial purposes, personal banking and credit data held by designated credit bodies, health data covered by separate legislation, and processing by an individual for purely personal/household purposes
- Federal Decree-Law No. 45 of 2021 (PDPL) — Does not apply to public entities, DIFC/ADGM free zones with their own DP legislation, or health/credit data governed by existing sectoral legislation

#### Territorial ScopeAmber

The PDPL is reported to apply to virtually all organizations across the seven emirates and to entities elsewhere processing UAE residents' data; DIFC/ADGM regimes apply only within their respective free zones.

Claims (6):

- Virtually all organizations across all seven emirates that collect or process personal data, and organizations elsewhere processing personal data belonging to UAE residents, fall within the PDPL's compliance scope.
- The PDPL decrees established the Emirates Data Office to monitor and enforce the UAE Personal Data Protection Law countrywide.
- Federal Decree-Law No. 45 of 2021 (PDPL) — Applies to processing of personal data, wholly or partly, through automated electronic systems or otherwise, by any controller/processor located in the UAE processing data of subjects residing/working inside or outside the UAE, and by controllers/processors outside the UAE processing data of subjects located inside the UAE
- PDPL Article 2(1)(c) — Applies to any controller or processor residing outside the UAE that carries out processing activities on the personal data of data subjects located within the State.
- Federal Decree-Law No. 45 of 2021 (PDPL) — Covers processing of personal data of data subjects within the UAE regardless of controller/processor location
- The PDPL applies to processing of personal data by UAE-based controllers/processors and, extraterritorially, to foreign controllers/processors processing data of subjects located in the UAE.

#### Regulator Registration And FilingAmber

ADGM requires controller registration and processing notification (fee-bearing, exempt for sub-5-employee entities absent high-risk processing); DIFC requires notification within 14 days via its client portal with initial/renewal fees. No federal PDPL-specific registration mechanism was confirmed in available sources.

Claims (4):

- ADGM requires registration of data controllers and notification of processing activities with the Commissioner of Data Protection, together with data protection fees and renewal fees, except for establishments with fewer than five employees unless they carry out high-risk processing.
- DIFC entities must notify the Commissioner of processing operations as soon as possible and in any event within 14 days, paying a $1,250 registration fee and $500 annual renewal fee.
- Federal Decree-Law No. 45 of 2021 (PDPL) — No general licensing, registration, notification or fee duty to the UAE Data Office; controllers/processors must keep an internal processing record producible to the Data Office on request
- The PDPL imposes no general registration or notification duty; record-of-processing must instead be produced to the UAE Data Office on request.

The UAE federal regime rests on Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), enforced by the newly established Emirates Data Office (UAE Data Office). Layered on top of the federal statute are two independent financial free-zone regimes — the DIFC Data Protection Law No. 5 of 2020 (Commissioner of Data Protection) and the ADGM Data Protection Regulations 2021 (Office of Data Protection) — each with its own registration, fee, and enforcement architecture, plus sector-specific instruments (health, telecoms) that operate alongside the general regime.

Periodic update · new data 2026-11-04

#### Regulator & Framework

The institutional map for data protection oversight in the United Arab Emirates has shifted. On 14 June 2026 the Cabinet established the Federal Authority for Artificial Intelligence and Data, consolidating what had been the AI Office, the digital-government function previously sitting inside the Telecommunications and Digital Government Regulatory Authority, and the UAE Data Office, under a single body reporting directly to Cabinet. The UAE Data Office had been the body named in Federal Decree-Law No. 45 of 2021 (the Personal Data Protection Law, or PDPL) as the supervisory authority for personal data processing at the federal level, separate from the sector-specific regimes that continue to apply inside the Dubai International Financial Centre and Abu Dhabi Global Market. No legal instrument has yet been located that formally and explicitly transfers the Data Office's PDPL supervisory powers to the new Authority, so the practical reporting line for complaints, guidance and any future enforcement action sits in a state of institutional transition rather than settled reassignment. Readers should treat the identity of the body that will exercise PDPL supervisory powers going forward as unresolved until a instrument naming that transfer is published.

This consolidation lands on top of a framework that was already incomplete in its implementing detail. The PDPL took effect on 2 January 2022 and required Executive Regulations to be issued within six months of its promulgation. Those Executive Regulations have still not been issued. Their absence is not a minor drafting delay: the PDPL text itself defers the operative detail of lawful-basis thresholds, breach-notification timing, cross-border transfer mechanics and the penalty schedule to those regulations, so the statute remains, in material respects, a framework law awaiting its own machinery. The combination of an unfinished implementing instrument and a newly reorganised supervisory authority means the architecture of UAE data protection enforcement is less settled now than it was before the June reorganisation, even though the underlying statutory text is unchanged.

#### Outlook

Two threads bear watching together. First, whether a Cabinet decision or ministerial instrument surfaces formally confirming the Federal Authority for Artificial Intelligence and Data's assumption of PDPL supervisory functions — until it does, guidance, complaint-handling and any enforcement posture attributed to "the UAE Data Office" should be read as provisional. Second, whether the long-outstanding PDPL Executive Regulations are finally issued; their absence has persisted well past the statute's own six-month target and continues to leave core compliance thresholds, transfer mechanisms and penalties without settled operative content. A move on either front — a formal transfer instrument or the long-delayed regulations — would be the clearest signal that the federal regime is consolidating rather than continuing to operate on inherited, partially-specified statutory text.

3 earlier distinct update(s) Periodic update · new data 2026-11-03

#### Regulator & Framework

The UAE's data-protection institutional landscape consolidated materially with the establishment of the Federal Authority for Artificial Intelligence and Data, effective 14 June 2026. This new Cabinet-reporting body absorbs three previously separate functions: the Office of Artificial Intelligence, the Information and Digital Government Sector of the Telecommunications and Digital Government Regulatory Authority, and the UAE Data Office. Notably, the UAE Data Office never became fully operational before this absorption took place, meaning the practical effect of this consolidation is that the UAE now has, for the first time, a single operationally active federal body carrying a clear data-protection mandate, where previously that mandate sat with a data office that had not been meaningfully stood up. This is assessed at probable confidence based on secondary legal commentary; the underlying Cabinet decision establishing the Authority was not independently retrieved in primary-source form.

Running alongside this institutional development is a genuinely disputed question regarding the Personal Data Protection Law's Executive Regulations. A number of commercial-compliance sites assert that these Executive Regulations have already been issued, though they cite varying and inconsistent Cabinet Decision numbers in doing so. Against this, the most rigorous primary-source check identified, a check of the UAE Legislation portal conducted 11 August 2026, found no corresponding entry for any such Executive Regulations. This is not a case where one source is simply more authoritative than another in an obvious way; rather, it is a genuine dispute across sources of comparable commercial standing, and it is reported here as disputed, at the Disputed tier of the confidence ladder, precisely because no primary-source resolution has been located. This matters because the Executive Regulations, if and when confirmed to exist, would be expected to resolve a number of currently uncertain operative details under the Personal Data Protection Law, including the practical breach-notification deadline and the administrative-penalty schedule.

#### Outlook

The most consequential near-term question for the UAE's data-protection framework and-authority structure is whether the dispute over the Executive Regulations' issuance status resolves, either through a confirmed entry appearing on the UAE Legislation portal or through an authoritative statement from the newly established Federal Authority for Artificial Intelligence and Data. Given that the new Authority now holds a consolidated mandate spanning both AI policy and data protection, it is plausible that further institutional clarity, including clarification of the Executive Regulations' status, could follow from the Authority itself as it becomes operationally active, though this remains a matter for future cycles to confirm rather than something that can be asserted now.

Periodic update · new data 2026-10-11

#### Regulator & Framework

The UAE's data-protection institutional landscape consolidated materially this cycle with the establishment of the Federal Authority for Artificial Intelligence and Data, effective 14 June 2026. This new Cabinet-reporting body absorbs three previously separate functions: the Office of Artificial Intelligence, the Information and Digital Government Sector of the Telecommunications and Digital Government Regulatory Authority, and the UAE Data Office. Notably, the UAE Data Office never became fully operational before this absorption took place, meaning the practical effect of this consolidation is that the UAE now has, for the first time, a single operationally active federal body carrying a clear data-protection mandate, where previously that mandate sat with a data office that had not been meaningfully stood up. This is assessed at probable confidence based on secondary legal commentary; the underlying Cabinet decision establishing the Authority was not independently retrieved in primary-source form this cycle.

Running alongside this institutional development is a genuinely disputed question regarding the Personal Data Protection Law's Executive Regulations. A number of commercial-compliance sites assert that these Executive Regulations have already been issued, though they cite varying and inconsistent Cabinet Decision numbers in doing so. Against this, the most rigorous primary-source check identified this cycle, a check of the UAE Legislation portal conducted 11 August 2026, found no corresponding entry for any such Executive Regulations. This is not a case where one source is simply more authoritative than another in an obvious way; rather, it is a genuine dispute across sources of comparable commercial standing, and it is reported here as disputed, at the Disputed tier of the confidence ladder, precisely because no primary-source resolution has been located. This matters because the Executive Regulations, if and when confirmed to exist, would be expected to resolve a number of currently uncertain operative details under the Personal Data Protection Law, including the practical breach-notification deadline and the administrative-penalty schedule.

#### Outlook

The most consequential near-term question for the UAE's data-protection framework and-authority structure is whether the dispute over the Executive Regulations' issuance status resolves, either through a confirmed entry appearing on the UAE Legislation portal or through an authoritative statement from the newly established Federal Authority for Artificial Intelligence and Data. Given that the new Authority now holds a consolidated mandate spanning both AI policy and data protection, it is plausible that further institutional clarity, including clarification of the Executive Regulations' status, could follow from the Authority itself as it becomes operationally active, though this remains a matter for future cycles to confirm rather than something that can be asserted now.

Periodic update · new data 2026-09-28

#### Regulator & Framework

The UAE's federal omnibus data-protection instrument is Federal Decree-Law No. 45 of 2021, the Personal Data Protection Law, in effect since 2 January 2022. Its scope is bounded in specific and material ways: the PDPL does not apply to public entities, to the DIFC and ADGM free zones, each of which maintains its own separate data-protection legislation, or to health and credit data, which remain governed by existing sectoral legislation. Territorially, the PDPL covers the processing of personal data of data subjects located within the UAE regardless of where the controller or processor is itself located, an effects-based rather than establishment-based territorial trigger.

The most material development this cycle concerns the operational status of the UAE Data Office, the PDPL's designated supervisory authority. A 2026 Chambers and Partners practice guide describes the Data Office as not yet fully operational. A separate 2026 secondary source, by contrast, describes the Data Office as now fully operational and issuing guidance. These two accounts are directly contradictory, and neither is corroborated by a directly retrieved primary statement from the Data Office itself this cycle. The honest position is that this is a genuinely disputed fact, not a fact this cycle's evidence resolves, and it is recorded as such rather than averaged or silently resolved in favour of either source.

This disputed operational status matters beyond a bureaucratic technicality: the practical reach of every other PDPL obligation, from data subject rights to controller duties to enforcement powers, depends in part on whether a functioning supervisory authority exists to receive complaints, issue guidance, and take enforcement action. Until the dispute is resolved by a primary Data Office statement, the operational reality of the entire PDPL framework carries this same uncertainty.

#### Outlook

A direct primary statement from the UAE Data Office, whether a website update, published guidance, or an enforcement action bearing its name, would resolve the current dispute in either direction. Until such a statement is retrieved, the safest reading is that the law is unambiguously in force while its supervisory machinery's operational status remains open.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and claims (34)
- [IAPP](https://iapp.org/news/a/10-practical-steps-to-prepare-for-the-uaes-personal-data-protection-law) — The UAE enacted Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data as part of a sweeping package of legal reforms marking the UAE's 50th anniversary.
- [IAPP](https://iapp.org/news/a/10-practical-steps-to-prepare-for-the-uaes-personal-data-protection-law) — The PDPL decrees established the Emirates Data Office to monitor and enforce the UAE Personal Data Protection Law countrywide.
- [IAPP](https://iapp.org/news/a/10-practical-steps-to-prepare-for-the-uaes-personal-data-protection-law) — The PDPL took effect on January 2, 2022, with enforcement of its provisions beginning in September 2022.
- [IAPP](https://iapp.org/news/a/10-practical-steps-to-prepare-for-the-uaes-personal-data-protection-law) — Like the EU GDPR, the PDPL gives considerable control and rights to data subjects over their personal data.
- [IAPP](https://iapp.org/news/a/10-practical-steps-to-prepare-for-the-uaes-personal-data-protection-law) — Virtually all organizations across all seven emirates that collect or process personal data, and organizations elsewhere processing personal data belonging to UAE residents, fall within the PDPL's compliance scope.
- [OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v._adgm.pdf) — The DIFC and ADGM financial free zones operate independent data protection regimes (DIFC Law No. 5 of 2020; ADGM Data Protection Regulations 2021) outside the federal PDPL's civil and commercial jurisdiction.
- [OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v._adgm.pdf) — ADGM requires registration of data controllers and notification of processing activities with the Commissioner of Data Protection, together with data protection fees and renewal fees, except for establishments with fewer than five employees unless they carry out high-risk processing.
- [OneTrust DataGuidance](https://legacy.dataguidance.com/opinion/difc-round-guidance-difcs-data-protection-law-and-0) — DIFC entities must notify the Commissioner of processing operations as soon as possible and in any event within 14 days, paying a $1,250 registration fee and $500 annual renewal fee.
- [DataGuidance](https://www.dataguidance.com/jurisdictions/united-arab-emirates-federal) — Personal Data Protection Law — Federal Decree-Law No. 45 of 2021, in force 2 January 2022, establishing the controller/processor compliance regime under the UAE Data Office
- [DataGuidance](https://www.dataguidance.com/jurisdictions/united-arab-emirates-federal) — UAE Data Office — Established under Federal Decree-Law No. 44 of 2021 as the federal data regulator to regulate application of the PDPL
- [Dubai International Financial Centre (DIFC)](https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection) — DIFC Data Protection Law — DIFC Law No. 5 of 2020, in force 1 July 2020 (last amended 1 January 2025), with a Commissioner of Data Protection responsible for supervision and enforcement
- [ADGM / Thomson Reuters Rulebook](https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER97921.pdf) — ADGM Data Protection Regulations 2021 — In force 14 February 2021, establishing a Commissioner of Data Protection responsible for monitoring and enforcing the Regulations, with controller/processor registration duties
- [UAE Ministry of Justice – UAE Legislation Portal](https://uaelegislation.gov.ae/en/legislations/1972/download) — Federal Decree-Law No. 45 of 2021 (PDPL) — Applies to processing of personal data, wholly or partly, through automated electronic systems or otherwise, by any controller/processor located in the UAE processing data of subjects residing/working inside or outside the UAE, and by controllers/processors outside the UAE processing data of subjects located inside the UAE
- [UAE Ministry of Justice – UAE Legislation Portal](https://uaelegislation.gov.ae/en/legislations/1972/download) — Federal Decree-Law No. 45 of 2021 (PDPL) — Excludes from scope: government data held for security/judicial purposes, personal banking and credit data held by designated credit bodies, health data covered by separate legislation, and processing by an individual for purely personal/household purposes
- [Baker McKenzie](https://resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/uae/topics/dpos-and-notification-requirements) — Federal Decree-Law No. 45 of 2021 (PDPL) — No general licensing, registration, notification or fee duty to the UAE Data Office; controllers/processors must keep an internal processing record producible to the Data Office on request
- [Al Tamimi & Company](https://www.tamimi.com/law_update_articles/uae-establishes-new-federal-authority-for-ai-and-data-a-significant-step-in-the-evolution-of-digital-regulation/) — Federal Authority for Artificial Intelligence and Data — Established 14 June 2026, consolidating AI Office, TDRA digital-government sector and UAE Data Office
- [Eversheds Sutherland](https://www.eversheds-sutherland.com/en/global/insights/uae-establishesthe-federal-artificial-intelligence-and-data-authority-june-2026) — On 14 June 2026 the UAE Cabinet approved establishment of the Federal Authority for Artificial Intelligence and Data, absorbing the UAE Data Office (the PDPL's nominal supervisory body), the Office of Artificial Intelligence, and TDRA's Digital Government Sector.
- [https://bshsoft.com/uae-data-protection-law-for-businesses](https://bshsoft.com/uae-data-protection-law-for-businesses) — UAE Data Office — Described by a separate 2026 secondary source as now fully operational and issuing guidance
- [Lexology](https://www.lexology.com/library/detail.aspx?g=1e65518e-464d-400f-951a-7e4a7b67319a) — Federal Authority for Artificial Intelligence and Data — Established 14 June 2026, consolidating the UAE Artificial Intelligence Office, the TDRA's Information and Digital Government Sector, and the UAE/Emirates Data Office under a single Cabinet-reporting structure.
- [Recording Law](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/uae-data-privacy-laws/) — PDPL Implementing Regulations — Not published as of mid-2026, more than four years after the PDPL entered force.
- [https://www.uaeexperthub.com/uae-data-protection-law-pdpl/](https://www.uaeexperthub.com/uae-data-protection-law-pdpl/) — PDPL Article 2(1)(c) — Applies to any controller or processor residing outside the UAE that carries out processing activities on the personal data of data subjects located within the State.
- [https://www.recordinglaw.com/world-laws/world-data-privacy-laws/uae-data-privacy-laws/](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/uae-data-privacy-laws/) — Sources are in direct conflict on the PDPL Executive Regulations' status: some state formal Executive Regulations had not been published in the Official Gazette as a discrete instrument as of mid-2026, while others cite Cabinet Decision No. 33 of 2024 as the in-force Executive Regulation.
- [iConnect IT Business Solutions](https://www.iconnectitbs.com/data-residency-in-the-uae/) — Federal Decree-Law No. 45 of 2021 (PDPL) — Does not apply to public entities, DIFC/ADGM free zones with their own DP legislation, or health/credit data governed by existing sectoral legislation
- [OBGulf](https://obgulf.com/insights/uae-ai-law-business-guide) — Federal Decree-Law No. 45 of 2021 (PDPL) — Covers processing of personal data of data subjects within the UAE regardless of controller/processor location
- [ABS Partners](https://abspartners.ae/uae-data-office-pdpl-compliance/) — Federal Decree-Law No. 45 of 2021 (PDPL) — The PDPL required Executive Regulations within six months of promulgation; these have not yet been issued as of this cycle.
- [UAE Ministry of Justice – UAE Legislation Portal](https://uaelegislation.gov.ae/en/legislations/1972/download) — The PDPL applies to processing of personal data by UAE-based controllers/processors and, extraterritorially, to foreign controllers/processors processing data of subjects located in the UAE.
- [Baker McKenzie](https://resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/uae/topics/dpos-and-notification-requirements) — The PDPL imposes no general registration or notification duty; record-of-processing must instead be produced to the UAE Data Office on request.
- [Dubai International Financial Centre (DIFC)](https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection) — The DIFC Data Protection Law requires a DPIA before High Risk Processing Activities within DIFC.
- [ADGM / Thomson Reuters Rulebook](https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER97921.pdf) — The ADGM Data Protection Regulations 2021 establish a Commissioner of Data Protection responsible for monitoring and enforcement.
- [Business CISO](https://business-ciso.com/blog/uae-pdpl-executive-regulations-status) — PDPL Executive Regulations / Cabinet penalty decision — not_stated
- [Lexnova](https://lexnova-uae.com/legal-guides/ai-and-the-law-in-the-uae) — Artificial Intelligence and Data Authority (announced) — On 14 June 2026 the UAE Cabinet announced merging the federal AI Office, TDRA's Digital Government Sector and the UAE Data Office into the Artificial Intelligence and Data Authority, mandated to propose AI legislation; no establishing instrument had been published as of the source-check date.
- [Lexology](https://www.lexology.com/library/detail.aspx?g=1e65518e-464d-400f-951a-7e4a7b67319a) — Federal Authority for Artificial Intelligence and Data — Cabinet approved establishment on 14 June 2026, consolidating the AI Office, TDRA's Digital Government Sector and the Emirates Data Office
- [https://www.businessdubai.ae/blogs/uae-pdpl-data-protection](https://www.businessdubai.ae/blogs/uae-pdpl-data-protection) — Federal Decree-Law No. 45 of 2021 (PDPL) — Independent 2026 UAE compliance sources report that federal PDPL Executive Regulations have not yet been issued, leaving the statutory grace-period trigger pending.
- [Latham & Watkins](https://www.lw.com/en/insights/uaes-child-digital-safety-law-what-every-digital-platform-and-isp-should-know) — Federal Decree-Law No. 45 of 2021 (PDPL) — While the PDPL's Executive Regulations are pending, limiting their enforceability, the CDS Federal Law provides immediate privacy protections

### United Arab Emirates: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Free-zone (DIFC/ADGM) lawful-basis and special-category rules are well-documented and GDPR-aligned; federal PDPL detail on lawful bases beyond consent-plus-exceptions was not confirmed in available sources.

Primary framework UAE Federal Decree-Law No. 45 of 2021 (PDPL); DIFC Law No. 5 of 2020; ADGM Data Protection Regulations 2021

Supervisory authority UAE Data Office (Emirates Data Office)

Traffic-light rationale — Amber Free-zone (DIFC/ADGM) lawful-basis and special-category rules are well-documented and GDPR-aligned; federal PDPL detail on lawful bases beyond consent-plus-exceptions was not confirmed in available sources.

D2 · Lawful Processing — Full Module Record 4 sub-modules · 43 words · 16 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### United Arab Emirates: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Rights exist in principle across federal, DIFC and ADGM instruments, but response-window specificity at federal level is unconfirmed.

Primary framework UAE Federal Decree-Law No. 45 of 2021 (PDPL); ADGM Data Protection Regulations 2021

Supervisory authority UAE Data Office (Emirates Data Office)

Traffic-light rationale — Amber Rights exist in principle across federal, DIFC and ADGM instruments, but response-window specificity at federal level is unconfirmed.

#### Sub-modules (5)

#### Access RightRed

General characterization of GDPR-comparable rights exists; specific access-right mechanics for the federal PDPL were not located in available sources.

Claims (1):

- The PDPL is characterized as giving data subjects considerable control and rights over their personal data, comparable in intent to the EU GDPR.

#### Rectification And ErasureAmber

ADGM's right to erasure does not apply where processing is necessary for archiving/research and erasure would seriously impair those objectives.

Claims (3):

- Under ADGM Regulations, the right to erasure does not apply to the extent that processing is necessary for archiving or research purposes where erasure would render impossible or seriously impair those objectives, provided appropriate safeguards are taken.
- Federal Decree-Law No. 45 of 2021 (PDPL) — Art 15(2) gives the data subject a right to request erasure where the data is no longer necessary, consent is withdrawn, the subject objects with no legitimate grounds to continue, or processing violates the Decree-Law; Art 15(3) carves out public-health, investigation/legal-claims and other-legislation-conflict cases from the erasure right
- Data subjects have an erasure right under Art 15(2), subject to the refusal grounds in Art 15(3).

#### Restriction And ObjectionRed

No AE-specific restriction/objection mechanics beyond general GDPR-alignment characterization were confirmed.

Claims (4):

- Federal Decree-Law No. 45 of 2021 (PDPL) — Art 16 lets the data subject require restriction of processing where accuracy is disputed, processing is objected to as contrary to agreed purposes, or processing is unlawful; the controller must notify the data subject when a restriction is lifted (Art 16(4))
- Federal Decree-Law No. 45 of 2021 (PDPL) — Art 17 gives an unqualified right to object to and stop direct-marketing processing (including related profiling); objection to statistical-survey processing may be overridden by public interest, and objection to processing violating Art 5 controls requires the controller to show compelling legitimate grounds
- Under Art 16 the data subject may require restriction of processing in disputed-accuracy or unlawful-processing cases, and must be notified when a restriction is lifted.
- Data subjects have an unqualified right to object to direct marketing (including profiling) under Art 17.

#### Data PortabilityRed

No AE-specific portability provisions were confirmed in available sources.

Claims (2):

- Federal Decree-Law No. 45 of 2021 (PDPL) — Art 14 gives the data subject a right to obtain personal data provided to the controller in a structured, machine-readable format, and to have it transferred to another controller where technically feasible, provided processing is consent-based or contract-necessary and carried out by automated means
- Data subjects have a data-portability right under Art 14 where processing is consent-based or contract-necessary and automated.

#### Deadlines And Response WindowsRed

Specific statutory response-time deadlines for federal PDPL data-subject requests were not confirmed; secondary commentary noted uncertainty over implementing details shortly after enactment.

Claims (3):

- Shortly after PDPL enactment it remained uncertain exactly how breach reporting timelines (and, by extension, other statutory response windows) would be specified pending executive regulations.
- Federal Decree-Law No. 45 of 2021 (PDPL) — The PDPL sets no numeric deadline for a controller to respond to a data-subject rights request or notify a breach; Articles 9 and 13-18 defer the applicable period to the Executive Regulations under Art 28, which remain unissued, so the operative standard is to act without undue delay
- Federal Decree-Law No. 45 of 2021 (PDPL) — deadline pending Executive Regulations

The PDPL is characterized as granting GDPR-style data subject rights, though specific statutory response deadlines for federal-law subject-access or erasure requests were not confirmed in available sources; ADGM provides a right to erasure subject to archiving/research exceptions.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and claims (13)
- [IAPP](https://iapp.org/news/a/10-practical-steps-to-prepare-for-the-uaes-personal-data-protection-law) — The PDPL is characterized as giving data subjects considerable control and rights over their personal data, comparable in intent to the EU GDPR.
- [OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v._adgm.pdf) — Under ADGM Regulations, the right to erasure does not apply to the extent that processing is necessary for archiving or research purposes where erasure would render impossible or seriously impair those objectives, provided appropriate safeguards are taken.
- [IAPP](https://iapp.org/news/a/10-practical-steps-to-prepare-for-the-uaes-personal-data-protection-law) — Shortly after PDPL enactment it remained uncertain exactly how breach reporting timelines (and, by extension, other statutory response windows) would be specified pending executive regulations.
- [Latham & Watkins](https://www.lw.com/en/insights/uaes-child-digital-safety-law-what-every-digital-platform-and-isp-should-know) — Federal Decree-Law No. 45 of 2021 (PDPL) — The PDPL sets no numeric deadline for a controller to respond to a data-subject rights request or notify a breach; Articles 9 and 13-18 defer the applicable period to the Executive Regulations under Art 28, which remain unissued, so the operative standard is to act without undue delay
- [UAE Ministry of Justice – UAE Legislation Portal](https://uaelegislation.gov.ae/en/legislations/1972/download) — Federal Decree-Law No. 45 of 2021 (PDPL) — Art 15(2) gives the data subject a right to request erasure where the data is no longer necessary, consent is withdrawn, the subject objects with no legitimate grounds to continue, or processing violates the Decree-Law; Art 15(3) carves out public-health, investigation/legal-claims and other-legislation-conflict cases from the erasure right
- [Modulos](https://docs.modulos.ai/frameworks/uae-pdpl/lawful-processing-and-data-subject-rights) — Federal Decree-Law No. 45 of 2021 (PDPL) — Art 16 lets the data subject require restriction of processing where accuracy is disputed, processing is objected to as contrary to agreed purposes, or processing is unlawful; the controller must notify the data subject when a restriction is lifted (Art 16(4))
- [Virtual Data Protection Officer (vdpo.org)](https://vdpo.org/pages/law.php?country_id=23&law_id=31) — Federal Decree-Law No. 45 of 2021 (PDPL) — Art 17 gives an unqualified right to object to and stop direct-marketing processing (including related profiling); objection to statistical-survey processing may be overridden by public interest, and objection to processing violating Art 5 controls requires the controller to show compelling legitimate grounds
- [DLA Piper](https://www.dlapiperdataprotection.com/countries/uae-general/collection-and-processing.html) — Federal Decree-Law No. 45 of 2021 (PDPL) — Art 14 gives the data subject a right to obtain personal data provided to the controller in a structured, machine-readable format, and to have it transferred to another controller where technically feasible, provided processing is consent-based or contract-necessary and carried out by automated means
- [Latham & Watkins](https://www.lw.com/en/insights/uaes-child-digital-safety-law-what-every-digital-platform-and-isp-should-know) — Federal Decree-Law No. 45 of 2021 (PDPL) — deadline pending Executive Regulations
- [UAE Ministry of Justice – UAE Legislation Portal](https://uaelegislation.gov.ae/en/legislations/1972/download) — Data subjects have an erasure right under Art 15(2), subject to the refusal grounds in Art 15(3).
- [Modulos](https://docs.modulos.ai/frameworks/uae-pdpl/lawful-processing-and-data-subject-rights) — Under Art 16 the data subject may require restriction of processing in disputed-accuracy or unlawful-processing cases, and must be notified when a restriction is lifted.
- [Virtual Data Protection Officer (vdpo.org)](https://vdpo.org/pages/law.php?country_id=23&law_id=31) — Data subjects have an unqualified right to object to direct marketing (including profiling) under Art 17.
- [DLA Piper](https://www.dlapiperdataprotection.com/countries/uae-general/collection-and-processing.html) — Data subjects have a data-portability right under Art 14 where processing is consent-based or contract-necessary and automated.

### United Arab Emirates: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Free-zone (DIFC/ADGM) controller duties are well documented and GDPR-aligned; federal PDPL implementing detail (fine schedules, precise breach timelines) is not confirmed.

Primary framework DIFC Law No. 5 of 2020; ADGM Data Protection Regulations 2021; UAE Federal Decree-Law No. 45 of 2021 (PDPL)

Supervisory authority DIFC Commissioner of Data Protection

Traffic-light rationale — Amber Free-zone (DIFC/ADGM) controller duties are well documented and GDPR-aligned; federal PDPL implementing detail (fine schedules, precise breach timelines) is not confirmed.

D4 · Controller & Processor — Full Module Record 7 sub-modules · 49 words · 24 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### United Arab Emirates: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Strong DIFC/ADGM evidence on transfer mechanisms and adequacy granted; federal PDPL transfer detail and adequacy received status are unconfirmed/pending.

Primary framework DIFC Law No. 5 of 2020; ADGM Data Protection Regulations 2021

Supervisory authority DIFC Commissioner of Data Protection

Traffic-light rationale — Amber Strong DIFC/ADGM evidence on transfer mechanisms and adequacy granted; federal PDPL transfer detail and adequacy received status are unconfirmed/pending.

D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 70 words · 19 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### United Arab Emirates: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Telecoms and health overlays are documented; financial-sector overlay evidence is limited to one regulation; credit, education and insurance sub-modules have no confirmed evidence.

Supervisory authority Telecommunications and Digital Government Regulatory Authority (TRA/TDRA)

Traffic-light rationale — Amber Telecoms and health overlays are documented; financial-sector overlay evidence is limited to one regulation; credit, education and insurance sub-modules have no confirmed evidence.

D6 · Sectoral Watch — Full Module Record 7 sub-modules · 78 words · 15 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### United Arab Emirates: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾

No comprehensive adtech-specific regime was confirmed for the UAE in available research; only the general PDPL consent framework applies.

Traffic-light rationale — Red No comprehensive adtech-specific regime was confirmed for the UAE in available research; only the general PDPL consent framework applies.

D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 27 words · 8 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### United Arab Emirates: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾

AI policy infrastructure and one DIFC-specific binding regulation are documented; federal biometric/genetic/surveillance-carveout specifics are unconfirmed.

Primary framework DIFC Regulation 10 on Processing Personal Data Through Autonomous and Semi-Autonomous Systems

Supervisory authority UAE AI Office / Council for AI and Blockchain

Traffic-light rationale — Amber AI policy infrastructure and one DIFC-specific binding regulation are documented; federal biometric/genetic/surveillance-carveout specifics are unconfirmed.

Periodic update · new data 2026-11-03

#### Algorithmic, Biometric & Surveillance Governance

The establishment of the Federal Authority for Artificial Intelligence and Data, effective 14 June 2026, is the material development for algorithmic governance in the UAE, not because it introduces new substantive AI rules but because of what it structurally consolidates. The new body absorbs the Office of Artificial Intelligence alongside the Information and Digital Government Sector of the Telecommunications and Digital Government Regulatory Authority and the previously non-operational UAE Data Office. The effect is that AI policy and data protection, two functions that in many jurisdictions sit in entirely separate regulatory bodies, are now administered by a single Cabinet-reporting authority in the UAE.

As far as the research has established, the 2024 UAE Charter for Artificial Intelligence remains the sole AI-specific instrument in the jurisdiction, and it is non-binding in character. No new binding AI-specific statute, nor any AE-specific rule on automated decision-making, profiling, or biometric processing, was located to supplement or formalise the Charter's non-binding principles. The consolidation of AI policy and data-protection functions into one authority is therefore, at this stage, a structural rather than a substantive development: it changes who administers both mandates, but it has not yet, on the evidence available, produced new binding rules governing algorithmic or biometric processing specifically.

This structural pairing is nonetheless significant for how algorithmic governance is likely to evolve in the UAE going forward, since any future binding AI-specific rulemaking would now emerge from the same body that administers the Personal Data Protection Law, creating a natural institutional path for data-protection and AI-governance requirements to be developed in a more integrated fashion than would be possible under separate agencies.

#### Outlook

Whether the Federal Authority for Artificial Intelligence and Data uses its newly consolidated mandate to move the 2024 UAE Charter for Artificial Intelligence toward binding status, or to issue new rules specifically addressing algorithmic decision-making or biometric processing, is the key open question for this domain going forward. The institutional consolidation itself is a necessary precondition for more integrated rulemaking, but it is not, on its own, evidence that such rulemaking is imminent, and no dated commitment to issue binding AI-specific rules was located.

Periodic update · new data 2026-10-11

#### Algorithmic, Biometric & Surveillance Governance

The establishment of the Federal Authority for Artificial Intelligence and Data, effective 14 June 2026, is the material development for algorithmic governance in the UAE this cycle, not because it introduces new substantive AI rules but because of what it structurally consolidates. The new body absorbs the Office of Artificial Intelligence alongside the Information and Digital Government Sector of the Telecommunications and Digital Government Regulatory Authority and the previously non-operational UAE Data Office. The effect is that AI policy and data protection, two functions that in many jurisdictions sit in entirely separate regulatory bodies, are now administered by a single Cabinet-reporting authority in the UAE.

As far as this cycle's research has established, the 2024 UAE Charter for Artificial Intelligence remains the sole AI-specific instrument in the jurisdiction, and it is non-binding in character. No new binding AI-specific statute, nor any AE-specific rule on automated decision-making, profiling, or biometric processing, was located this cycle to supplement or formalise the Charter's non-binding principles. The consolidation of AI policy and data-protection functions into one authority is therefore, at this stage, a structural rather than a substantive development: it changes who administers both mandates, but it has not yet, on the evidence available this cycle, produced new binding rules governing algorithmic or biometric processing specifically.

This structural pairing is nonetheless significant for how algorithmic governance is likely to evolve in the UAE going forward, since any future binding AI-specific rulemaking would now emerge from the same body that administers the Personal Data Protection Law, creating a natural institutional path for data-protection and AI-governance requirements to be developed in a more integrated fashion than would be possible under separate agencies.

#### Outlook

Whether the Federal Authority for Artificial Intelligence and Data uses its newly consolidated mandate to move the 2024 UAE Charter for Artificial Intelligence toward binding status, or to issue new rules specifically addressing algorithmic decision-making or biometric processing, is the key open question for this domain going forward. The institutional consolidation itself is a necessary precondition for more integrated rulemaking, but it is not, on its own, evidence that such rulemaking is imminent, and no dated commitment to issue binding AI-specific rules was located this cycle.

D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 50 words · 12 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### United Arab Emirates: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾

Coverage of children's/vulnerable-groups' data is thin and inconsistent across the UAE's fragmented regime; no dedicated federal children's-data regime was confirmed.

Traffic-light rationale — Red Coverage of children's/vulnerable-groups' data is thin and inconsistent across the UAE's fragmented regime; no dedicated federal children's-data regime was confirmed.

D9 · Children's Privacy — Full Module Record 5 sub-modules · 59 words · 13 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### United Arab Emirates: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾

DIFC enforcement track record and powers are well documented; federal PDPL-specific enforcement activity, funding, and any collective-redress mechanism remain unconfirmed, and no confirmed developments within the last 180 days were located.

Primary framework DIFC Law No. 5 of 2020

Supervisory authority DIFC Commissioner of Data Protection

Traffic-light rationale — Amber DIFC enforcement track record and powers are well documented; federal PDPL-specific enforcement activity, funding, and any collective-redress mechanism remain unconfirmed, and no confirmed developments within the last 180 days were located.

Periodic update · new data 2026-09-28

#### Enforcement & Redress

Enforcement intensity under the PDPL is contested across this cycle's sources in a way that mirrors the broader Data Office operational-status dispute. A 2026 secondary source cites administrative fines of up to AED 5 million for processing sensitive personal data without lawful basis or explicit consent, describing these fines as applied in enforcement actions from 2025 onward. This figure is not corroborated by a directly retrieved Data Office enforcement record or primary penalty schedule this cycle, so it should be read as a reported penalty ceiling rather than a confirmed, currently-enforced figure.

A separate 2026 Chambers and Partners practice guide takes a different tack, describing the practical effect of the PDPL's incomplete operationalisation as limited enforcement activity to date, with organisations largely driving compliance internally rather than in response to active regulatory pressure. This account is in tension with the first: one source implies enforcement actions are already occurring at meaningful penalty levels, the other implies enforcement activity has been limited in practice. Both accounts are retained rather than reconciled, consistent with the disputed-state doctrine applied elsewhere in this cycle's UAE record, because averaging or silently preferring one account over the other would manufacture a certainty the evidence does not support.

The practical takeaway for this cycle is that the PDPL's enforcement reality is genuinely unsettled: the statutory penalty architecture may exist on paper, per the AED 5 million figure, while actual enforcement practice may remain limited, per the Chambers account, and both can be true simultaneously without contradiction if the cited fines represent maximum exposure rather than typical outcomes.

#### Outlook

A directly retrieved Data Office enforcement record, or a confirmed enforcement action naming a specific penalty amount, would meaningfully sharpen this picture in either direction. Until then, the enforcement-and-redress picture should be read as unsettled rather than as either aggressively enforced or dormant.

D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 61 words · 23 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

## GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (20 mapped).

Show article map GDPR article to category mapping Article Category Sub-module

Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases

Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds

Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories

Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right

Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection

Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure

Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability

Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection

Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency

Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements

Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements

Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 13-14 [Data Subject Rights](#sec-cat-data_subject_rights) access right

Art. 16-17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure

Art. 32-34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures

Art. 37-39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements

Art. 44-49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms

Art. 77-84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties