Are companies required to protect children's personal data under UAE law?

The UAE's data protection framework treats children's personal data as deserving particular care, consistent with the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and the country's broader child-protection laws. Because children may not fully understand the consequences of sharing their information, organisations processing their data are expected to apply heightened caution: being especially clear and transparent, limiting collection to what is genuinely necessary, applying strong security, and, where consent is the basis for processing a minor's data, obtaining it from a parent or legal guardian as required. Services aimed at or likely to be used by children should design their data practices with the child's best interests in mind and avoid using a minor's data in ways that could harm them. For businesses, this means age-appropriate notices, careful default settings, and a clear process for guardians to exercise rights on a child's behalf. The precise conditions and any age thresholds are governed by the law and its Executive Regulations, so confirm them with the UAE Data Office. For help designing compliant services for minors, you can browse verified UAE legal professionals on LEXAI.