Almost every business holds personal data: customer records, employee files, supplier contacts, marketing lists. The UAE now regulates how that data is handled through a federal Personal Data Protection Law. It is easy to treat data protection as a technology matter and leave it to IT, but the obligations are legal and they sit with the business. Here is what the law asks of an ordinary UAE company, and where it does not apply.
Which law applies to you
The federal regime is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, overseen by the UAE Data Office. It governs the processing of personal data of individuals, with effect across the UAE. Two major financial free zones sit outside it: the DIFC and ADGM each run their own data protection laws and regulators. A business in one of those zones follows that zone's regime, not the federal law, so the first question is always which rulebook you are under.
| Where you operate | Which data protection law |
|---|---|
| UAE mainland and most free zones | Federal PDPL, under the UAE Data Office |
| DIFC | DIFC Data Protection Law, under the DIFC Commissioner |
| ADGM | ADGM Data Protection Regulations, under the ADGM regulator |
The core obligations
Under the federal law, a business that decides how and why personal data is processed carries duties that run through the whole data lifecycle.
| Duty | In practice |
|---|---|
| Lawful basis | Have a valid basis, such as consent, for each use of personal data |
| Individual rights | Let people access, correct, delete, and object to the use of their data |
| Security | Protect the data with appropriate measures and control who can reach it |
| Breach response | Notify the authority, and affected people where required, when data is breached |
| Cross-border transfers | Only move data abroad where the destination or the safeguards meet the standard |
Consent is not a one-time checkbox
Consent has to be a genuine, informed choice, and it can be withdrawn. Bundling it into terms nobody reads, or treating a single tick as permission for every future use, is exactly what the law is built to stop. Record what you collect, why, and on what basis, because being able to show your reasoning is as important as having it.
Data protection is a business obligation, not an IT setting. The duty to have a lawful basis and to honour people's rights sits with the company that decides how the data is used.
Where it meets your other duties
Data protection overlaps with work you already do. Know-your-customer files, employee records and accounting documents are all personal data held for a reason and for a period. Aligning retention and access across those obligations avoids holding data longer, or more widely, than any of them require.
What to do about it
Confirm which regime you are under first, because the DIFC and ADGM differ from the federal law. Then map the personal data you hold, fix a lawful basis for each use, build a simple process for people exercising their rights, and set retention and security rules you can evidence. Watch for the Executive Regulations and Data Office guidance, which fill in the detail. For the overlaps see KYC explained, AML record keeping, and keeping accounting records.
This article is general information and is not legal advice. It summarises rules that depend on your circumstances and may change, and should be confirmed against the current legislation and the guidance of the relevant regulator. We would be glad to help you work through what this means for your business.