What is the UAE's PDPL (Federal Decree-Law 45 of 2021) and who does it protect?

The UAE's main data protection law is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL), which sits alongside the law establishing the UAE Data Office as the federal supervisory authority. It creates a baseline framework for how personal data of individuals in the UAE is collected, processed, stored and shared. 'Personal data' means any information relating to an identified or identifiable natural person, and 'processing' covers almost any operation performed on that data. The PDPL gives individuals (data subjects) rights over their data and places obligations on the businesses (controllers) and service providers (processors) that handle it. It applies broadly to entities processing the personal data of people inside the UAE, with certain carve-outs and with the financial free zones (DIFC and ADGM) operating their own equivalent regimes. Much procedural detail sits in the Executive Regulations, so confirm current requirements with the UAE Data Office before relying on specifics. If you believe an organisation has mishandled your data, you can raise it with the UAE Data Office. You can also browse verified UAE legal professionals on LEXAI for privacy and compliance matters.