Compliance guide · United Arab Emirates
UAE PDPL: a practical guide to the federal personal data protection law
The UAE's federal personal data protection law sets rules for processing personal data. This guide explains the basics and a practical route to compliance. It is not legal advice; read the law itself and take legal advice on your specific position.
What it is and who must comply
The law and the regulator
The law is Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data. It took effect on 2 January 2022. The UAE Data Office oversees it, including policy, standards and complaints.
Who it applies to
The law covers the processing of personal data, in whole or in part through electronic systems, inside or outside the UAE. Other UAE laws govern some data separately, including health data under Federal Law No. 2 of 2019 on the use of ICT in health fields, and some free zones have their own data protection regimes. Check the law's scope article, and any sector rules, for your situation.
Implementing regulations
Check the UAE Data Office for the current status of implementing regulations and guidance before you finalise your programme. We could not confirm their status from an official source when this guide was last verified, so this guide makes no statement about them.
How to comply
These steps are a practical data protection programme. Confirm each obligation, and any deadline, against the text of the law and any implementing regulations.
- Map your personal data: what you hold, why, where it is, and who receives it.
- Confirm which regime applies to each processing activity: the federal law, a free-zone law, or a sector law.
- Record a lawful basis for each processing activity, and manage consent where you rely on it.
- Set up data subject request handling: access, correction, restriction and the other rights the law provides.
- Assess high-risk processing before it starts.
- Apply security measures proportionate to the risk.
- Prepare breach handling, including notification.
- Control transfers of personal data outside the UAE.
- Manage processors through contracts and assessments.
Evidence checklist
- Record of processing activities
- Lawful basis register and consent records
- Privacy notices
- Data subject request log with response times
- Data protection impact assessments
- Security controls evidence
- Breach register and notification records
- Cross-border transfer assessments
- Processor contracts and due-diligence records
- Training records
How it maps to ISO/IEC 27001:2022
Domain-level only. This table is Pravitrust's interpretation for planning evidence reuse; it is not a mapping published by the regulator or by ISO.
| UAE PDPL | ISO/IEC 27001:2022 |
|---|---|
| Governance and accountability | ISO/IEC 27001 clauses 4-10; ISO/IEC 27701 privacy extension |
| Security of processing | ISO/IEC 27001 Annex A, especially A.5.34 (privacy and protection of PII), A.8.10 to A.8.12 |
| Breach handling | A.5.24 to A.5.28 (incident management) |
| Processors and transfers | A.5.19 to A.5.23 (supplier relationships), A.5.14 (information transfer) |
How to choose software for UAE PDPL
These criteria are neutral: they apply to any tool you evaluate, including Pravitrust.
- Regulator mapping you can trace. The tool should hold the framework's own identifiers and structure, and show which version it carries. Ask how it is updated when the regulator issues a revision.
- Licence-known content. Ask where the control content came from and on what terms. A vendor that cannot answer has a problem you will inherit.
- Evidence reuse. One piece of evidence should be attachable to every control it supports, across frameworks, without uploading it twice.
- Arabic support. Check the user interface, reports and exports separately; support in one does not imply the others.
- Hosting location. Ask where data and backups are stored, and match that against your own data-residency obligations and any sector rules.
- Honest status. A control with no test or evidence should never display as compliant.
- Exit. Confirm you can export everything, including history, in an open format.
- Privacy workflows. Look for a record of processing, data subject request tracking with due dates, and DPIA workflows, not only security controls.
Where Pravitrust stands today
- Adopt a framework pack into your control library at the scope that applies to you, with the pack version recorded so later assessments stay tied to the revision you assessed against.
- Attach evidence to each control, with an expiry date and reminders when evidence goes stale.
- Show a control with no test result as untested, never as healthy.
- Keep an append-only, hash-chained audit trail of changes.
- Export registers to CSV or Excel.
Moving from ServiceNow or Archer
Pravitrust does not import data from ServiceNow, Archer or any other GRC platform today. An import and migration feature is in design and is not available yet; this page will say so when it ships.
What you can do today:
- Export your current register from the existing tool so you hold a complete copy, including history, before you change anything.
- Adopt the framework pack in Pravitrust at your scope.
- Record control status and attach evidence against each control. Evidence you already hold for ISO/IEC 27001 can be attached to the controls it supports.
- Run both systems in parallel until your next assessment cycle closes, then retire the old one.
Frequently asked questions
What is the UAE PDPL?
Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data, the UAE's federal data protection law.
When did it take effect?
On 2 January 2022.
Who regulates it?
The UAE Data Office.
Does it apply in free zones?
Some free zones have their own data protection laws. Check which regime covers each processing activity.
Is health data covered?
Health data is also governed by Federal Law No. 2 of 2019 on the use of ICT in health fields. Check both, and any emirate-level health rules, for your situation.
Does ISO/IEC 27001 certification cover the PDPL?
No. ISO/IEC 27001 covers information security, which the law requires, but the law also has privacy obligations such as lawful basis, rights and transfers. ISO/IEC 27701 is closer, but it is still not the law.