Does the UAE PDPL apply to companies in the DIFC or ADGM free zones?

Generally no — the financial free zones run their own data protection regimes. The federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) provides the UAE-wide baseline, but the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) each have their own standalone data protection laws and independent regulators (the DIFC operates under its Data Protection Law, and ADGM under its own data protection regulations). If your entity is established in and processes data within one of these free zones, that zone's law and its commissioner's office usually apply to you rather than the federal PDPL. The free-zone regimes are closely modelled on international standards and share many concepts — lawful basis, data-subject rights, breach notification and cross-border rules — but the precise obligations, timelines and registration requirements differ. The practical step is to confirm which regime governs each data flow, because a group operating across mainland and free zones may be subject to more than one. For a clear assessment of which law applies to your structure, you can compare verified UAE legal professionals on LEXAI who handle privacy and free-zone matters.