Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Federal PDPL, the Cybersecurity Council's National Strategy 2025-2031, and why DIFC and ADGM run entirely separate regimes the federal law doesn't touch.
The UAE runs one of the more structured cybersecurity governance models in the region, but it's not one framework, it's several overlapping ones, and which applies to a given organization depends on where it's registered and what sector it's in. Understanding the actual structure matters more than memorizing any single regulation, because getting the scope wrong is the single most common mistake we see when a test gets framed around the wrong framework entirely.
In November 2020, the UAE Cabinet established the UAE Cybersecurity Council, tasked with developing a comprehensive national cybersecurity strategy and building resilient digital infrastructure. That strategy, the National Cybersecurity Strategy 2025–2031, was approved in February 2025 and formally published in September of the same year, built around five pillars and 60 initiatives spanning cybersecurity law and regulation, incident response planning, workforce development, and critical infrastructure protection. It's a genuinely ambitious, actively resourced strategy, not a document that sits unused, a meaningful contrast to markets in the region where a national strategy exists on paper but was never implemented.
Federal Decree-Law No. 45 of 2021 established the UAE's first federal, cross-sector Personal Data Protection Law (PDPL), in force since January 2022 and enforced by the UAE Data Office, established under a companion Federal Decree-Law No. 44 of 2021. The PDPL governs how entities operating on the UAE mainland collect, process, store, transfer, and delete personal data of UAE residents. One detail that trips up a lot of scoping conversations: the PDPL's administrative penalty amounts still aren't publicly confirmed, the law itself defers the actual fine schedule to a separate Cabinet Decision that multiple legal trackers describe as still pending. Any specific fine figure circulating in marketing material for the PDPL should be treated skeptically until independently verified.
This is the detail most likely to catch an organization off guard: the PDPL does not apply to entities registered in the Dubai International Financial Centre (DIFC) or the Abu Dhabi Global Market (ADGM). Both are financial free zones with their own, completely independent data protection laws, the DIFC Data Protection Law No. 5 of 2020, enforced by its own DIFC Commissioner of Data Protection, and the ADGM Data Protection Regulations 2021, enforced by the ADGM's own Office of Data Protection. An organization registered in DIFC is not subject to UAE federal PDPL at all, it answers to a different regulator, under different rules. Scoping a security review or compliance program against the wrong one of these three regimes is a real, avoidable mistake.
Financial institutions licensed by the UAE Central Bank carry additional obligations under Central Bank Consumer Protection Regulation, notifying the Central Bank of "significant breaches" and informing affected consumers "without undue delay," with card schemes specifically required to notify within 72 hours. Dubai government and DESC-regulated entities layer the Dubai Electronic Security Center's own Information Security Regulation and Cloud Service Provider Security Standard on top of whichever data protection regime already applies. For a full breakdown of the PDPL's specific breach-notification duties and penalty structure, see our UAE compliance page.
A UAE engagement scoped generically, "GDPR-style testing" applied without checking which of these regimes actually governs the client, routinely misses the mark. The right first question is jurisdictional: mainland PDPL, DIFC, ADGM, or a sector-specific overlay, and only then does the technical scope get built. This is exactly the reasoning behind how we approach our Middle East security services, and it's the same logic behind comparing data protection regimes across EMEA rather than assuming one template fits every jurisdiction. See our dedicated page on offensive security services in Dubai for what that looks like for a Dubai-based organization specifically.
Tell us about your environment and goals, we'll help you scope the right engagement.