The UAE Federal PDPL: what every start-up needs to know

Series

Start-up compliance series · 1 of 7

Law

Federal Decree Law No. 45 of 2021

Regulator

UAE Data Office

Applies to

Mainland UAE and free zones without their own privacy regime, subject to the law's scope and exclusions

Who is covered by the UAE Federal PDPL

The PDPL applies to controllers and processors in the UAE and can reach organisations outside the UAE that process personal data relating to people in the UAE. It preserves separate regimes in DIFC, ADGM and Dubai Healthcare City, alongside sector rules for areas including health, banking and telecommunications.

Start-ups on the mainland and in free zones without a standalone privacy regime will generally need to assess their activities against the federal law.

Core obligations for start-ups

• Lawful basis. Consent is central, with statutory exceptions including contract performance, legal obligations and specified public interest grounds.
• Individual rights. The law provides rights including access, portability, correction, erasure, restriction and objection to direct marketing and certain automated decisions.
• Data protection officer. A DPO may be required for higher risk processing, certain uses of new technologies or large volumes of sensitive personal data.
• Personal data breaches. The law requires notification to the Data Office in accordance with requirements that depend in part on the Executive Regulations.
• Localisation. Health data and payment records may be subject to separate localisation requirements.

The timing question

At the source review date, the Executive Regulations had not been issued. The law provides a six month alignment period after their issue, subject to any extension, while detailed administrative penalties are to be set separately.

Waiting carries commercial as well as legal risk. Enterprise customers and investors increasingly expect a clear account of data handling during procurement and due diligence.

Timing statement reviewed in September 2026. Confirm the current status of the Executive Regulations and related decisions through official UAE sources.

Five actions to take now

• Map personal data. Record what the business collects, why it is used and where it is stored and processed.
• Document lawful bases. Identify a lawful basis for each purpose and make consent specific and withdrawable where relied upon.
• Prepare user facing processes. Publish a clear privacy notice and establish a process for handling rights requests.
• Record accountability decisions. Document the DPO assessment and prepare a personal data breach response plan.
• Review vendors and hosting. Confirm where cloud providers and other vendors process data, with particular attention to health and payment data.

Sources and scope

Source briefing: DLA Piper, Data Protection Laws of the World, UAE; UAE legislation portal status check reported by itsecnow.com, September 2026.

This article provides general information for start-ups and does not constitute legal advice. Requirements should be checked against current official sources and assessed for the organisation's circumstances before reliance.