#
A comprehensive federal statute is in force, but implementing/executive regulation detail (fines, breach timelines) remained unconfirmed in available secondary sources, and the regime is fragmented across federal, DIFC and ADGM authorities.
Sub-modules (5)
Regulator And AuthorityAmber
Federal enforcement sits with the Emirates Data Office; DIFC and ADGM each maintain their own Commissioner/Office of Data Protection for their free zones.
Claims (2):
- The UAE enacted Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data as part of a sweeping package of legal reforms marking the UAE's 50th anniversary.
- The PDPL decrees established the Emirates Data Office to monitor and enforce the UAE Personal Data Protection Law countrywide.
Act And InstrumentsAmber
Federal Decree-Law No. 45 of 2021 (PDPL) is the primary federal instrument; DIFC Law No. 5 of 2020 and ADGM Data Protection Regulations 2021 are independent free-zone instruments.
Claims (2):
- The UAE enacted Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data as part of a sweeping package of legal reforms marking the UAE's 50th anniversary.
- The DIFC and ADGM financial free zones operate independent data protection regimes (DIFC Law No. 5 of 2020; ADGM Data Protection Regulations 2021) outside the federal PDPL's civil and commercial jurisdiction.
Material ScopeAmber
The PDPL is described as GDPR-influenced, granting data subjects considerable rights and control over personal data.
Claims (1):
- Like the EU GDPR, the PDPL gives considerable control and rights to data subjects over their personal data.
Territorial ScopeAmber
The PDPL is reported to apply to virtually all organizations across the seven emirates and to entities elsewhere processing UAE residents' data; DIFC/ADGM regimes apply only within their respective free zones.
Claims (2):
- Virtually all organizations across all seven emirates that collect or process personal data, and organizations elsewhere processing personal data belonging to UAE residents, fall within the PDPL's compliance scope.
- The PDPL decrees established the Emirates Data Office to monitor and enforce the UAE Personal Data Protection Law countrywide.
Regulator Registration And FilingAmber
ADGM requires controller registration and processing notification (fee-bearing, exempt for sub-5-employee entities absent high-risk processing); DIFC requires notification within 14 days via its client portal with initial/renewal fees. No federal PDPL-specific registration mechanism was confirmed in available sources.
Claims (2):
- ADGM requires registration of data controllers and notification of processing activities with the Commissioner of Data Protection, together with data protection fees and renewal fees, except for establishments with fewer than five employees unless they carry out high-risk processing.
- DIFC entities must notify the Commissioner of processing operations as soon as possible and in any event within 14 days, paying a $1,250 registration fee and $500 annual renewal fee.
Regulator & Framework
The UAE's data-protection institutional landscape consolidated materially this cycle with the establishment of the Federal Authority for Artificial Intelligence and Data, effective 14 June 2026. This new Cabinet-reporting body absorbs three previously separate functions: the Office of Artificial Intelligence, the Information and Digital Government Sector of the Telecommunications and Digital Government Regulatory Authority, and the UAE Data Office. Notably, the UAE Data Office never became fully operational before this absorption took place, meaning the practical effect of this consolidation is that the UAE now has, for the first time, a single operationally active federal body carrying a clear data-protection mandate, where previously that mandate sat with a data office that had not been meaningfully stood up. This is assessed at probable confidence based on secondary legal commentary; the underlying Cabinet decision establishing the Authority was not independently retrieved in primary-source form this cycle.
Running alongside this institutional development is a genuinely disputed question regarding the Personal Data Protection Law's Executive Regulations. A number of commercial-compliance sites assert that these Executive Regulations have already been issued, though they cite varying and inconsistent Cabinet Decision numbers in doing so. Against this, the most rigorous primary-source check identified this cycle, a check of the UAE Legislation portal conducted 11 August 2026, found no corresponding entry for any such Executive Regulations. This is not a case where one source is simply more authoritative than another in an obvious way; rather, it is a genuine dispute across sources of comparable commercial standing, and it is reported here as disputed, at the Disputed tier of the confidence ladder, precisely because no primary-source resolution has been located. This matters because the Executive Regulations, if and when confirmed to exist, would be expected to resolve a number of currently uncertain operative details under the Personal Data Protection Law, including the practical breach-notification deadline and the administrative-penalty schedule.
Outlook
The most consequential near-term question for the UAE's data-protection framework and-authority structure is whether the dispute over the Executive Regulations' issuance status resolves, either through a confirmed entry appearing on the UAE Legislation portal or through an authoritative statement from the newly established Federal Authority for Artificial Intelligence and Data. Given that the new Authority now holds a consolidated mandate spanning both AI policy and data protection, it is plausible that further institutional clarity, including clarification of the Executive Regulations' status, could follow from the Authority itself as it becomes operationally active, though this remains a matter for future cycles to confirm rather than something that can be asserted now.
1 earlier distinct update(s)
Regulator & Framework
The UAE's federal omnibus data-protection instrument is Federal Decree-Law No. 45 of 2021, the Personal Data Protection Law, in effect since 2 January 2022. Its scope is bounded in specific and material ways: the PDPL does not apply to public entities, to the DIFC and ADGM free zones, each of which maintains its own separate data-protection legislation, or to health and credit data, which remain governed by existing sectoral legislation. Territorially, the PDPL covers the processing of personal data of data subjects located within the UAE regardless of where the controller or processor is itself located, an effects-based rather than establishment-based territorial trigger.
The most material development this cycle concerns the operational status of the UAE Data Office, the PDPL's designated supervisory authority. A 2026 Chambers and Partners practice guide describes the Data Office as not yet fully operational. A separate 2026 secondary source, by contrast, describes the Data Office as now fully operational and issuing guidance. These two accounts are directly contradictory, and neither is corroborated by a directly retrieved primary statement from the Data Office itself this cycle. The honest position is that this is a genuinely disputed fact, not a fact this cycle's evidence resolves, and it is recorded as such rather than averaged or silently resolved in favour of either source.
This disputed operational status matters beyond a bureaucratic technicality: the practical reach of every other PDPL obligation, from data subject rights to controller duties to enforcement powers, depends in part on whether a functioning supervisory authority exists to receive complaints, issue guidance, and take enforcement action. Until the dispute is resolved by a primary Data Office statement, the operational reality of the entire PDPL framework carries this same uncertainty.
Outlook
A direct primary statement from the UAE Data Office, whether a website update, published guidance, or an enforcement action bearing its name, would resolve the current dispute in either direction. Until such a statement is retrieved, the safest reading is that the law is unambiguously in force while its supervisory machinery's operational status remains open.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (8)
- ProbableIAPP — The UAE enacted Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data as part of a sweeping package of legal reforms marking the UAE's 50th anniversary.observed
- ProbableIAPP — The PDPL decrees established the Emirates Data Office to monitor and enforce the UAE Personal Data Protection Law countrywide.observed
- ProbableIAPP — The PDPL took effect on January 2, 2022, with enforcement of its provisions beginning in September 2022.observed
- ProbableIAPP — Like the EU GDPR, the PDPL gives considerable control and rights to data subjects over their personal data.observed
- ProbableIAPP — Virtually all organizations across all seven emirates that collect or process personal data, and organizations elsewhere processing personal data belonging to UAE residents, fall within the PDPL's compliance scope.observed
- ProbableOneTrust DataGuidance — The DIFC and ADGM financial free zones operate independent data protection regimes (DIFC Law No. 5 of 2020; ADGM Data Protection Regulations 2021) outside the federal PDPL's civil and commercial jurisdiction.observed
- ProbableOneTrust DataGuidance — ADGM requires registration of data controllers and notification of processing activities with the Commissioner of Data Protection, together with data protection fees and renewal fees, except for establishments with fewer than five employees unless they carry out high-risk processing.observed
- ProbableOneTrust DataGuidance — DIFC entities must notify the Commissioner of processing operations as soon as possible and in any event within 14 days, paying a $1,250 registration fee and $500 annual renewal fee.observed