Federal Decree-Law No. (45) of 2021 on the Protection of Personal Datachapter by chapter

Article 2-3: Scope and Exemption

The PDPL applies to UAE controllers and processors handling personal data, and to foreign ones handling UAE subjects' data, excluding government, security, judicial, personal-use, health and banking data.

Article 4-5: Lawfulness and Processing Controls

Processing personal data without consent is prohibited unless a listed exception applies, and processing must be lawful, purpose-specific, minimised, accurate, secure and not kept beyond purpose unless anonymised.

Article 6: Consent

Where processing relies on consent, controllers must be able to prove it; consent must be clear and easily accessible, data subjects must be able to withdraw easily, and withdrawal does not affect prior lawful processing.

Article 7: Controller Obligations

Data controllers must implement security measures, maintain processing records, and appoint responsible processors.

Article 8: Processor Obligations

Processors must process personal data only on Controller instructions, erase it after processing, keep processing records for the Bureau, and use written agreements with co-processors or be jointly liable.

Article 9(1)-(3)Article 9: Reporting Personal Data Breach

Controllers must notify the Data Bureau and affected Data Subjects of personal data breaches, while Processors must promptly notify the Controller once they become aware of a breach.

Article 10-12: Data Protection Officer

Controllers and Processors must appoint a Data Protection Officer in high-risk or large-scale sensitive data processing, publish DPO contact details, notify the Bureau, and protect the DPO's independence.

Article 13-19: Data Subject Rights

Data Subjects have rights regarding their data, including obtaining information and requesting corrections, and Controllers must provide requisite details before processing begins.

Article 14-17: Data Subject Rights

Data controllers must honour data subject rights including portability, correction of inaccurate data, erasure, restriction of processing, and objection to direct marketing, profiling and surveys.

Article 18-19: Automated Processing and Contact

Data subjects may object to decisions based solely on automated processing or profiling that have legal or adverse effects, and controllers must allow human review on request and provide clear contact channels for rights requests.

Article 20: Personal Data Security

Controllers and processors must apply the highest suitable information security measures, including encryption, pseudonymisation, system resilience, timely access restoration after incidents, and regular testing of safeguards.

Article 21: Data Protection Impact Assessment

Controllers must conduct a data protection impact assessment before high-risk processing using modern technologies, covering purpose, necessity, privacy risks and mitigation, coordinated with the DPO and reviewed regularly.

Article 22-23: Cross-Border Transfers

Personal data may leave the UAE only to Bureau-approved adequate jurisdictions or under agreements, or otherwise under equivalent contracts, explicit data subject consent, legal claims, contract performance, or public interest grounds.

Article 24-26: Complaints and Penalties

Data subjects may complain to the Data Bureau, which imposes administrative penalties on controllers and processors; Bureau decisions may be grieved in writing within thirty days.

Article 29: Regularisation

Controllers and processors must regularise their status under the data protection law within six months of Executive Regulations issuance, extendable by Cabinet by six months.