How long can a UAE company keep my personal data under the PDPL?

The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) does not set a single fixed retention period for all data; instead it applies a storage-limitation principle. A controller should keep personal data only for as long as is necessary to fulfil the purpose for which it was collected. Once that purpose is achieved and there is no other lawful ground to retain it, the data should be deleted or anonymised. In practice, retention periods vary by data type and context because other UAE laws — such as commercial, tax, labour or anti-money-laundering rules — may require certain records to be kept for set minimum periods, and those obligations can lawfully justify holding data longer. So there is no universal answer; a business should define and document a retention schedule mapped to each purpose and to any overriding legal requirement, and securely dispose of data when the period ends. As an individual, you can ask a controller why it still holds your data and request erasure where no valid basis remains. Confirm specific retention rules with the relevant authority. For tailored retention-policy advice, you can browse verified UAE legal professionals on LEXAI.