What are the penalties for breaking the data protection law in the UAE?

Non-compliance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) can expose an organisation to enforcement action, but the specific monetary amounts are not something to assume — they are set out in the framework established under the law and its implementing decisions, and the UAE Data Office oversees enforcement. Rather than quoting a figure that may be inaccurate, it is safer to understand the types of consequence: administrative penalties for breaching obligations, orders to stop or correct unlawful processing, and the reputational and commercial damage that follows a publicised data incident or regulatory finding. Individuals who suffer harm may also pursue remedies. The exposure typically scales with the seriousness of the violation, whether it was repeated, and whether the business cooperated and took remedial steps. The practical takeaway is that the cost of a structured compliance programme — lawful-basis mapping, security measures, breach response, and honouring data-subject rights — is usually far lower than the cost of enforcement. For the current penalty schedule, rely on the UAE Data Office's official guidance, and for a compliance and risk review you can compare verified UAE legal professionals on LEXAI.