Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
The UAE's federal Personal Data Protection Law (PDPL) sets a baseline data protection regime enforced by the UAE Data Office, but it does NOT apply to entities registered in the DIFC or ADGM financial free zones, those operate two separate, independent data protection regimes not covered by this entry.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
The UAE's first federal, cross-sector personal data protection law. Issued 20 September 2021, entered into force 2 January 2022. Governs collection, processing, storage, transfer and deletion of personal data of UAE residents by entities operating on the UAE mainland.
SourceEstablishes the UAE Data Office as the federal body affiliated with the UAE Cabinet responsible for PDPL policy, standards, complaints handling and implementation guidance.
SourceA completely separate data protection regime that applies only to entities registered/licensed within the Dubai International Financial Centre free zone, with its own regulator (the DIFC Commissioner of Data Protection). Not covered by the figures in this entry.
SourceA second, entirely separate free-zone data protection regime applying only to entities registered within the Abu Dhabi Global Market, enforced by the ADGM Office of Data Protection, not the UAE Data Office. Not covered by the figures in this entry.
SourceNo fixed statutory hour limit
Article 9 of the PDPL requires controllers to notify the UAE Data Office 'immediately upon becoming aware' of a breach prejudicing privacy, confidentiality or security of personal data, with exact timing left to Executive Regulations. A 72-hour figure is commonly cited in market commentary, but sources materially disagree on whether an implementing regulation confirming that figure has been finalized, we could not independently verify a codified hour figure from primary legislative text, so no specific number is shown here. Confirm current status with the UAE Data Office or counsel before relying on a specific deadline.
Notify: UAE Data Office
SourcePublished legal maximums, not a personalized estimate, not legal advice.
PDPL administrative penalties
Not yet publicly confirmed, the PDPL itself sets no fine amounts
The PDPL text leaves the schedule of violations and administrative fines to a separate Cabinet Decision, which multiple sources describe as still pending/unpublished. Do not treat any specific figure circulating in marketing material as confirmed without independent legal verification.
SourceCybercrime Law (Federal Decree-Law No. 34 of 2021), separate statute, related exposure
AED 50,000–500,000 for unauthorized processing; AED 150,000–5,000,000 plus 6–12 months imprisonment for broader cybercrime offences
A distinct criminal statute (not the PDPL) that can also apply to unauthorized data processing/collection, creating separate criminal exposure alongside PDPL administrative liability.
SourceNot applicable , as of 2026-09-08
UAE Data Office(UDO)
Visit authority siteNo. Entities established in financial free zones with their own data protection laws, the DIFC and ADGM, are excluded from the federal PDPL and instead governed by the DIFC Data Protection Law No. 5 of 2020 or the ADGM Data Protection Regulations 2021, each enforced by its own free-zone regulator.
Article 9 requires notification 'immediately'/without undue delay, with exact timing left to Executive Regulations. A 72-hour figure is widely cited in market commentary, but we were unable to independently confirm this as a finalized, codified requirement, confirm current status with counsel before relying on a specific number.
The PDPL itself does not set fine amounts, it defers this to a separate Cabinet Decision on administrative penalties, which sources describe as not yet publicly finalized. Separately, the UAE Cybercrime Law can impose fines from AED 50,000 up to AED 5,000,000 (plus potential imprisonment) for related unauthorized data processing.
Talk to us about scoping an engagement around your specific regulatory context.
