PDPL Impact on Law Firms in the UAE and Compliance

The UAE Personal Data Protection Law (PDPL) requires law firms to embed data-subject rights, breach-notification obligations and cross-border transfer restrictions into client intake, matter-management and IT systems, applying to all controllers and processors in the UAE mainland, free zones and the DIFC/ADGM where the PDPL governs.

Related Services: Explore our Data Protection Officer Service and Data Regulation & Compliance services for practical legal support in this area.

HOW DOES THE PDPL DEFINE CONTROLLER AND PROCESSOR RESPONSIBILITIES FOR LAW FIRMS?

Under the PDPL, a controller determines the purposes and means of processing personal data, while a processor acts only on the controller's instructions【https://www.twobirds.com/en/insights/2021/uae/how-does-the-new-uae-federal-decree-law-on-personal-data-protection-compare-against-the-gdpr】. Law firms that decide why and how client data is collected, stored or shared are controllers; when they merely host data or run software on behalf of a client they act as processors. Controllers must implement appropriate technical and organisational measures, maintain records of processing activities, conduct data-protection impact assessments for high-risk processing, and notify the UAE Data Office of breaches within 72 hours where feasible【https://www.twobirds.com/en/insights/2021/uae/how-does-the-new-uae-federal-decree-law-on-personal-data-protection-compare-against-the-gdpr】. Processors are obliged to follow the controller's documented instructions, ensure confidentiality, assist with data-subject rights requests, delete or return data at the end of services, and keep processing records. Both parties must embed these duties in engagement letters, data-processing agreements and internal policies; failure to do so can result in administrative fines up to AED 5 million or, in cases of wilful negligence, imprisonment under the UAE Penal Code.

Developing this further, the PDPL requires controllers to appoint a Data Protection Officer (DPO) when processing is large-scale, involves special categories of data, or is carried out by a public authority【https://www.twobirds.com/en/insights/2021/uae/how-does-the-new-uae-federal-decree-law-on-personal-data-protection-compare-against-the-gdpr】. For law firms handling sensitive client information-such as health, financial or criminal-justice data-a DPO may be mandatory. The DPO's tasks include monitoring compliance, advising on impact assessments, cooperating with the Data Office, and serving as the point of contact for data subjects. Processors, while not required to appoint a DPO, must still ensure that any sub-processor they engage provides sufficient guarantees of compliance and that the controller has authorised such engagement. The law also obliges controllers to conduct a data-protection impact assessment (DPIA) before embarking on high-risk activities, such as using new technologies for large-scale profiling or processing biometric data. The assessment must describe the processing, assess necessity and proportionality, identify risks, and outline mitigation measures. Although the PDPL does not prescribe a fixed fee for DPIA preparation, firms typically allocate internal legal-tech resources or engage external consultants at market rates.

Cross-border transfers add another layer of obligation. Controllers may transfer personal data outside the UAE only if the recipient country appears on the Data Office adequacy list, the data subject gives explicit consent, the transfer is necessary for contract performance, or another statutory exception applies【https://www.twobirds.com/en/insights/2021/uae/how-does-the-new-uae-federal-decree-law-on-personal-data-protection-compare-against-the-gdpr】. Health-related data cannot be transferred at all under Federal Law No. 2 of 2019 on ICT in Health. Processors must verify that any transfer they carry out on behalf of a controller complies with one of these bases and must retain evidence of the legal justification. Non-compliance can trigger the same fines and criminal sanctions noted above, reinforcing the need for law firms to map data flows, maintain transfer registers, and update client contracts with appropriate clauses.

WHAT STEPS MUST A LAW FIRM TAKE TO ACHIEVE PDPL COMPLIANCE IN CLIENT INTAKE AND MATTER MANAGEMENT?

First, firms should conduct a data-mapping exercise to identify all personal data collected during onboarding, matter opening, and ongoing representation【https://www.twobirds.com/en/insights/2021/uae/how-does-the-new-uae-federal-decree-law-on-personal-data-protection-compare-against-the-gdpr】. This map should record data categories, sources, purposes, legal bases, retention periods, and any third-party recipients. Second, firms must update engagement letters and retainers to include a PDPL-compliant data-processing clause that specifies controller/processor roles, processing only on instructions, security measures, sub-processor approval procedures, breach-notification timelines, assistance with data-subject rights, and deletion or return of data upon matter conclusion【https://www.twobirds.com/en/insights/2021/uae/how-does-the-new-uae-federal-decree-law-on-personal-data-protection-compare-against-the-gdpr】. Third, technical safeguards such as encryption at rest and in transit, role-based access controls, regular penetration testing, and ISO 27001 or SOC 2 certification should be implemented where the firm processes high-risk data【https://www.twobirds.com/en/insights/2021/uae/how-does-the-new-uae-federal-decree-law-on-personal-data-protection-compare-against-the-gdpr】. Fourth, firms must establish a breach-response plan that enables detection, containment, assessment, notification to the Data Office within 72 hours, and communication to affected data subjects without undue delay【https://www.twobirds.com/en/insights/2021/uae/how-does-the-new-uae-federal-decree-law-on-personal-data-protection-compare-against-the-gdpr】. Fifth, staff training programmes should cover PDPL principles, data-subject rights, and internal reporting procedures, with refresher sessions at least annually. Finally, firms should retain records of all processing activities, DPAs, DPIAs, and breach logs for a minimum of five years to demonstrate compliance upon audit.

Developing these steps further, the data-mapping exercise often reveals that law firms collect special categories of data such as ethnic origin, religious beliefs, or genetic information when handling employment, family, or personal-injury matters. For such data, the PDPL requires explicit consent or another limited legal basis, and firms must keep separate records to demonstrate that the processing is necessary and proportionate. The engagement-letter clause should also address cross-border transfers when counsel collaborates with foreign experts or uses cloud-based services hosted outside the UAE; firms must either obtain explicit client consent for each transfer or rely on contractual necessity if the transfer is essential to performing the retainer. Security measures must be proportionate to the risk; for example, storing health-related case files on an on-premise server with encrypted backups may satisfy the requirement, whereas using a public cloud without encryption would not. Breach-response plans should designate a senior partner as the breach-response lead, outline escalation paths to IT and senior management, and include template notices to the Data Office and data subjects. Training can be delivered via e-learning modules that track completion rates, and firms should retain attendance logs as part of their compliance evidence. Record-keeping obligations extend to processor-assistance logs when a firm helps a client controller with a DPIA; these logs must show the scope of assistance, dates, and any recommendations made.

How does the PDPL affect law-firm IT systems and technology procurement?
The PDPL treats any system that stores, accesses, or transmits personal data as a processing activity, meaning IT platforms must be vetted for compliance before deployment【https://www.twobirds.com/en/insights/2021/uae/how-does-the-new-uae-federal-decree-law-on-personal-data-protection-compare-against-the-gdpr】. When procuring cloud services, law firms must confirm that the provider offers a data-processing agreement that mirrors PDPL obligations, including instructions-only processing, security standards, sub-processor approval, breach-notification cooperation, and deletion or return of data at contract end. If the provider hosts data outside the UAE, the firm must rely on an adequacy decision, explicit client consent, or contractual necessity as a transfer basis; otherwise the transfer is prohibited. Firms should also verify that the provider's certifications (ISO 27001, SOC 2, PCI-DSS) cover the specific services used and that audit reports are available for review.

Beyond procurement, internal IT systems must enforce data-minimisation and purpose limitation. Access controls should ensure that only lawyers and staff directly involved in a matter can view the associated client data, and logs must capture who accessed what and when. Encryption should protect data at rest (e.g., using AES-256 on databases and file stores) and in transit (TLS 1.2 or higher for web applications and API calls). Regular vulnerability scanning and annual penetration tests are advisable to detect weaknesses that could lead to a breach. Firms must also implement retention schedules that automatically delete or anonymise data once the statutory or contractual retention period expires, reducing the risk of holding unnecessary personal data.

When developing bespoke applications-such as client portals or matter-management software-firms should embed privacy-by-design principles: conduct a DPIA during the design phase, limit data fields to those strictly necessary, provide clear consent mechanisms for any optional data collection, and enable data-subject rights requests through self-service portals. Documentation of design decisions, risk assessments, and testing results must be retained to demonstrate compliance if the Data Office requests evidence. Finally, any incident involving the IT environment-whether a ransomware attack, mis-configured storage bucket, or insider misuse-must be handled under the breach-response plan, with timely notification to the Data Office and affected clients.

FREQUENTLY ASKED QUESTIONS

What is the legal basis for the PDPL's cross-border transfer restrictions?
The PDPL permits transfers outside the UAE only to countries on the Data Office adequacy list, with the data subject's explicit consent, where necessary for contract performance, or under another statutory exception such as legal claims or important public interest reasons【https://www.twobirds.com/en/insights/2021/uae/how-does-the-new-uae-federal-decree-law-on-personal-data-protection-compare-against-the-gdpr】. Health-related data cannot be transferred at all under Federal Law No. 2 of 2019 on ICT in Health.

Must a law firm appoint a Data Protection Officer under the PDPL?
A DPO is required when the firm's processing is large-scale, involves special categories of data, or is carried out by a public authority【https://www.twobirds.com/en/insights/2021/uae/how-does-the-new-uae-federal-decree-law-on-personal-data-protection-compare-against-the-gdpr】. For most private law firms handling typical civil or commercial matters, a DPO is optional but advisable as a practice measure to monitor compliance and serve as the point of contact for the Data Office and data subjects.

What are the penalties for non-compliance with the PDPL?
Violations can attract administrative fines of up to AED 5 million【https://www.twobirds.com/en/insights/2021/uae/how-does-the-new-uae-federal-decree-law-on-personal-data-protection-compare-against-the-gdpr】. In cases of wilful negligence or intentional misconduct, the UAE Penal Code may impose imprisonment of up to two years and/or fines, depending on the offence.

How long must a law firm retain records of processing activities under the PDPL?
The PDPL does not prescribe a specific retention period for processing-activity logs; however, firms should keep them for at least five years to align with general civil-evidence rules and to be ready for any audit or investigation by the Data Office【https://www.twobirds.com/en/insights/2021/uae/how-does-the-new-uae-federal-decree-law-on-personal-data-protection-compare-against-the-gdpr】.

Can a law firm rely on client consent alone to transfer data abroad?
Explicit, informed consent from the data subject is a valid basis for cross-border transfer, but the consent must be freely given, specific, and revocable【https://www.twobirds.com/en/insights/2021/uae/how-does-the-new-uae-federal-decree-law-on-personal-data-protection-compare-against-the-gdpr】. Firms must keep a record of the consent and ensure that the transfer does not exceed the scope of what the client authorised.

What security measures does the PDPL consider sufficient for protecting personal data?
The PDPL requires appropriate technical and organisational measures taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of processing【https://www.twobirds.com/en/insights/2021/uae/how-does-the-new-uae-federal-decree-law-on-personal-data-protection-compare-against-the-gdpr】. Recognised standards such as ISO 27001, SOC 2, encryption at rest and in transit, regular penetration testing, and role-based access controls are commonly accepted as meeting this requirement.

Book a consultation to discuss your legal needs with our experienced team.

If your matter involves pdpl in the United Arab Emirates, you are welcome to request a consultation with Nour Attorneys. Our team can assess your position under the law currently in force and outline the options available to you. Request a consultation

This article is provided for general informational purposes only and does not constitute legal advice. Reading this article or contacting Nour Attorneys through this website does not create an attorney-client relationship; such a relationship arises only after a conflicts-of-interest check and a signed engagement agreement. Do not send confidential information through this website; information submitted before engagement is not protected by legal privilege. Past results do not guarantee future outcomes. The firm's lawyers practice in the jurisdictions stated in their individual profiles; this article addresses the law of the United Arab Emirates only.