Does the UAE PDPL apply to my website?

It applies if your organisation is in the UAE and processes personal data, or if you are outside the UAE and process the personal data of people inside it, for example through analytics on your site. Companies established in the DIFC or ADGM follow those free zones’ own data protection laws instead.

The UAE PDPL is Federal Decree-Law No. 45 of 2021, in force since 2 January 2022. Personal data is any data relating to an identified or identifiable person, including online identifiers, which is why analytics and advertising cookies are in scope. The UAE Data Office is the supervisory authority.

Much of the detail is left to executive regulations, which had not been published on the UAE’s official legislation portal as of September 2026. The law sets no fine amounts: Article 26 leaves violations and administrative penalties to a Cabinet decision, and none had been published there as of September 2026.