UAE PDPA Compliance Guide

The UAE Personal Data Protection Act (Federal Decree-Law No. 45 of 2021) is the UAE's first comprehensive federal data protection law, taking effect in January 2022 with an 18-month grace period for compliance. The law establishes requirements for the processing of personal data by both public and private entities operating within the UAE, with certain exemptions for free zone authorities that have their own data protection frameworks such as the DIFC and ADGM. The UAE Data Office, established under the law, serves as the supervisory authority responsible for enforcement and guidance. The PDPA defines personal data as any information that relates to an identified or identifiable natural person, including names, identification numbers, online identifiers, location data, and factors specific to physical, psychological, economic, or social identity. The law requires organizations to have a lawful basis for processing personal data, with consent being the primary basis. Consent must be clear, specific, informed, and unambiguous. Data subjects have rights including access to their data, rectification, erasure, restriction of processing, data portability, and the right to object to processing including automated decision-making and profiling. The PDPA imposes obligations on data controllers including maintaining records of processing activities, conducting data protection impact assessments for high-risk processing, implementing appropriate technical and organizational security measures, and notifying the UAE Data Office and affected individuals in the event of a personal data breach. Cross-border data transfers are permitted to countries with adequate data protection, or with appropriate safeguards such as standard contractual clauses. Penalties for non-compliance include administrative fines up to AED 10,000,000 and other sanctions determined by the UAE Data Office.