Data protection compliance in Dubai under PDPL

Data protection compliance in Dubai means adhering to the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL), which sets out the obligations for controllers and processors handling personal data within the emirate. It mandates lawful basis, data subject rights, security measures, and breach notification, applying to all entities processing personal data in Dubai.

Related Services: Explore our Data Protection Officer Service and Data Regulation & Compliance services for practical legal support in this area.

WHAT ARE THE CORE DUTIES OF A DATA CONTROLLER AND A DATA PROCESSOR UNDER THE PDPL?

Controllers must determine the purposes and means of processing, ensure a lawful basis, provide transparent notices, and uphold data-subject rights. Processors must act only on documented instructions, implement appropriate security measures, provide breach notifications, and delete or return data upon service completion. These roles are defined in PDPL Articles 7-9, which require a clear allocation of responsibilities and accountability for any processing activity.

Controllers are obliged to maintain records of processing activities, conduct impact assessments where high-risk processing is involved, and appoint a Data Protection Officer when required. Processors must keep processing logs, ensure sub-processor agreements mirror their own obligations, and notify the controller without undue delay of any security breach. Both parties must cooperate with the UAE Data Office during investigations and provide evidence of compliance upon request. Failure to meet these duties can result in administrative fines and corrective orders, as the PDPL empowers the regulator to enforce compliance through audits and penalties.

WHAT SECURITY MEASURES DOES THE PDPL REQUIRE FOR PROTECTING PERSONAL DATA?

The PDPL mandates that controllers and processors implement technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, regular penetration testing, and adherence to recognised standards such as ISO 27001 or SOC 2. These requirements appear in PDPL Articles 7-9, which link security obligations to the controller's duty to protect data and the processor's duty to follow controller instructions.

Organisations must adopt access controls, monitor network activity, and ensure that staff receive regular data-protection training. Incident-response plans should be tested at least annually, and any identified vulnerabilities must be remediated within a timeframe set by the internal risk assessment. While the PDPL does not prescribe specific encryption algorithms, it expects measures that align with international best practices. Documentation of security controls, including policies, procedures, and audit reports, must be retained and made available to the regulator upon request.

HOW DOES THE PDPL REGULATE CROSS-BORDER TRANSFERS OF PERSONAL DATA?

Transfers of personal data outside the UAE are permitted only if the recipient country is on the Data Office's adequacy list, the data subject has given explicit consent, the transfer is necessary for the performance of a contract, or another statutory exception applies. These rules are set out in PDPL Articles 22-23, which also prohibit the transfer of health data outside the UAE under Federal Law No. 2 of 2019.

Before initiating a transfer, controllers must conduct a transfer impact assessment, retain evidence of the legal basis, and update their privacy notices to reflect the transfer. If relying on consent, the consent must be specific, informed, and freely given, with a clear option to withdraw. For contractual necessity, the transfer must be directly linked to the fulfilment of a contract with the data subject. The PDPL requires controllers to keep records of each transfer, including the legal basis relied upon, and to make these records available to the Data Office during audits.

WHAT RIGHTS DO DATA SUBJECTS HAVE UNDER THE PDPL, AND HOW CAN THEY EXERCISE THEM?

Data subjects enjoy the right to be informed, to access their data, to request correction, to request deletion, to restrict processing, to data portability, and to object to processing, as outlined in PDPL Articles 13-18. These rights can be exercised free of charge by submitting a request to the controller, who must respond within one month, extendable by two further months for complex cases.

Controllers must provide clear procedures for submitting requests, verify the identity of the requester, and keep a log of all requests and outcomes. If a request is denied, the controller must explain the reasons and inform the data subject of their right to lodge a complaint with the UAE Data Office or seek judicial redress. The PDPL also requires controllers to inform data subjects of any third-party recipients of their data and the purposes of such sharing.

WHAT ARE THE BREACH NOTIFICATION OBLIGATIONS AND TIMELINES UNDER THE PDPL?

In the event of a personal data breach likely to result in a risk to the rights and freedoms of data subjects, the controller must notify the UAE Data Office without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If the breach poses a high risk, the controller must also communicate the breach to the affected data subjects without undue delay. These timelines are stipulated in PDPL Article 9.

The notification to the Data Office must include a description of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to mitigate the adverse effects. When notifying data subjects, the controller must provide clear guidance on steps they can take to protect themselves, such as changing passwords or monitoring accounts. Documentation of the breach, the assessment performed, and the actions taken must be retained for at least five years and made available to the regulator upon request.

WHAT PENALTIES CAN BE IMPOSED FOR NON-COMPLIANCE WITH THE PDPL?

Violations of the PDPL may attract administrative fines of up to AED 5 million, depending on the gravity and duration of the infringement, as well as corrective orders such as mandatory audits, processing suspensions, or data deletion. The PDPL empowers the UAE Data Office to impose these sanctions following an investigation, and the decisions can be appealed before the competent courts. These penalty provisions are reflected in PDPL Articles 20-21, which link the fine amount to factors such as the nature of the breach, the number of data subjects affected, and any mitigating or aggravating circumstances.

In addition to fines, organisations may suffer reputational damage, loss of customer trust, and potential civil claims from data subjects seeking compensation for material or non-material damage. The PDPL also allows the Data Office to publish the names of non-compliant entities, further amplifying the impact of regulatory action.

FREQUENTLY ASKED QUESTIONS

What is the legal basis for data protection in Dubai?
The primary legal framework is the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL), which applies to all processing of personal data within the emirate, including free zones unless they follow their own regimes. The Arabic text of UAE legislation as published in the Official Gazette prevails over any translation.

Do DIFC and ADGM entities need to comply with the PDPL?
No. Entities operating in the Dubai International Financial Centre (DIFC) or Abu Dhabi Global Market (ADGM) are subject to their own data-protection laws-DIFC Data Protection Law No. 5 of 2020 and ADGM Data Protection Regulations 2021-rather than the UAE PDPL. However, if personal data is transferred from an onshore Dubai entity to a DIFC or ADGM entity, the transfer must satisfy the PDPL's cross-border rules.

How long must organisations retain records of processing activities?
The PDPL does not specify a fixed retention period for processing records, but it requires that such records be kept accurate and up to date. In practice, organisations retain these records for the duration of the processing activity plus a reasonable period after cessation, typically aligned with any applicable limitation periods for claims, which under UAE civil law can be up to fifteen years.

Can a company rely on consent as a basis for cross-border data transfer?
Yes. Under PDPL Article 23, explicit consent from the data subject is a valid legal basis for transferring personal data outside the UAE, provided the consent is specific, informed, and freely given, and the data subject can withdraw it at any time.

What steps should a company take after receiving a data-subject access request?
The company must verify the requester's identity, locate the requested data, provide a copy in a commonly used electronic format, and respond within one month, extendable by two further months for complex requests. If the request is refused, the company must explain the reasons and inform the requester of their right to complain to the UAE Data Office or seek judicial redress.

Are there sector-specific localisation rules that affect data handling in Dubai?
Yes. Health-related personal data must remain within the UAE under Federal Law No. 2 of 2019 on the Use of Information and Communication Technology in the Health Field. Government-related data is subject to Dubai Data Law No. 26 of 2015 and related ICT policies, which may impose additional localisation or hosting requirements. Companies processing such data must ensure compliance with both the PDPL and the relevant sector law.

If your matter involves compliance with data protection in Dubai in the United Arab Emirates, you are welcome to request a consultation with Nour Attorneys. Our team can assess your position under the law currently in force and outline the options available to you. Request a consultation

This article is provided for general informational purposes only and does not constitute legal advice. Reading this article or contacting Nour Attorneys through this website does not create an attorney-client relationship; such a relationship arises only after a conflicts-of-interest check and a signed engagement agreement. Do not send confidential information through this website; information submitted before engagement is not protected by legal privilege. Past results do not guarantee future outcomes. The firm's lawyers practice in the jurisdictions stated in their individual profiles; this article addresses the law of the United Arab Emirates only.