What is a lawful basis for processing personal data under the UAE PDPL?

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), an organisation cannot process personal data unless it has a valid lawful basis. Consent — a clear, specific, informed and freely given agreement from the individual — is one basis, but it is not the only one. The law recognises several other grounds where processing is permitted without consent, including where it is necessary to perform a contract to which the data subject is a party, to comply with a legal obligation on the controller, to protect the vital interests of the individual, to carry out functions in the public interest, or to serve legitimate interests of the controller that do not override the individual's rights. The right basis depends on the context: an employer processing payroll, a hospital handling patient records, and a shop running a loyalty programme may each rely on different grounds. Choosing and documenting the correct basis for each processing activity is a core compliance step, and you cannot simply default to consent for everything. Confirm the exact conditions in the law and its Executive Regulations. For help mapping your bases, you can compare verified UAE legal professionals on LEXAI.