Which data protection law applies in UAE free zones?

It depends on the zone. Entities established in the DIFC follow the DIFC Data Protection Law No. 5 of 2020, and those in the ADGM follow the ADGM Data Protection Regulations 2021, each with its own regulator. Free zones without their own data protection law fall under the federal UAE PDPL, Federal Decree-Law No. 45 of 2021.

The DIFC law is closely modelled on the GDPR and has its own Commissioner of Data Protection. In the ADGM, the regulator is ADGM’s Office of Data Protection. The federal law is supervised by the UAE Data Office.

A business selling into the UAE from abroad should start from the federal law, which also reaches organisations outside the UAE that process personal data of people inside it.