Can a UAE company transfer my personal data outside the country legally?

Yes, but cross-border transfers of personal data out of the UAE are regulated under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). The general principle is that data may be transferred to another country or international organisation where an adequate level of protection exists — for example, where the destination has data protection laws and oversight comparable to the UAE's, or where there is a binding instrument that provides appropriate safeguards. Where adequacy is not established, the law sets out alternative conditions that can permit a transfer, such as the data subject's explicit consent, the necessity of the transfer to perform a contract, to protect vital interests, or other grounds recognised in the law. Controllers remain responsible for ensuring the data stays protected after it leaves the UAE. The detailed mechanisms and any list of approved jurisdictions are governed by the law's Executive Regulations and guidance from the UAE Data Office, so confirm current requirements there. If you believe your data was transferred improperly, you can raise it with the Data Office. For cross-border compliance advice, you can compare verified UAE legal professionals on LEXAI.