Support Centre

UAE - Federal

Summary

Law: Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data (the Law)

Regulator: UAE Data Office (not yet operational)

Summary: On November 28, 2021, the UAE Cabinet announced that it had enacted Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data (PDPL), as issued on September 20, 2021. At the same time, Federal Decree-Law No. 44 of 2021 (Law No. 44/2021) was enacted to provide for the establishment of the UAE Data Office which will serve as the federal data regulator in the UAE, although it is not yet operational.

The PDPL covers the processing of personal data belonging to data subjects within the UAE, regardless of the location of the data controller or data processor. In addition, the PDPL outlines the conditions for consent, several data subject rights, and comprehensive requirements for controllers and processors, such as mandatory breach notification, the appointment of data protection officers, and the implementation of technical and organizational measures to support data security.

The PDPL entered into effect on January 2, 2022, and the Executive Regulations were expected to be issued within six months of the PDPL's date of issuance (March 20, 2022). However, they are yet to be published. Nonetheless, companies must comply with the PDPL within six months of the publication of the Executive Regulations. Notably, the PDPL does not apply to public entities or free zones in the UAE with their own data protection legislation (such as the DIFC and ADGM), nor does it apply to health or credit data governed by existing sectoral legislation. Furthermore, it repeals all laws which conflict with its provisions.

News

Insights

October 2024

UAE: Consent in action - aligning marketing practices with data protection and telecommunications laws

In the UAE, the landscape for marketing communications has become increasingly regulated, particularly in how businesses obtain consent from consumers before sending marketing messages. Ensuring that explicit consent is secured before any marketing communication is sent, whether via SMS, email, or other channels, is central to complying with the legal framework. The most relevant laws governing these practices include the Personal Data Protection Law (PDPL), the Telecommunications Law, the Regulations on Unsolicited Electronic Communications (RUEC), the Mobile Spam Policy, and the Consumer Protection Law.

These laws create a clear framework for businesses, mandating that individuals must actively opt-in to marketing communications, and businesses must maintain accurate records of this consent. Failure to comply with these laws can result in penalties, blocked messages, and reputational damage. Anne-Caroline Albrecht, Partner at Bonnard Lawson, provides a comprehensive overview of how businesses can obtain and manage consent effectively while ensuring compliance with these key regulations.

March 2024

UAE: An overview of direct marketing requirements

The term 'direct marketing' refers to business practices whereby businesses sell, promote, or advertise their products or services directly to members of the public through means such as SMS, telephone, or email. In the UAE, there is a range of spam and privacy legislation and regulations that specifically restrict direct marketing practices. The UAE has a multi-territorial, multi-jurisdictional legal system that encompasses the federal legislature as well as so-called 'free zones,' which are special economic zones with their own company and commercial laws specifically applicable for companies incorporated within the respective free zone. Nick O'Connell, Andrew Fawcett, and Darya Ghasemzadeh, from Al Tamimi & Company, provide an overview of the federal regulations, as well as specific legislation in some of the UAE's free zones.   

April 2022

UAE: What the new data protection law means for companies within the UAE - Part two

The Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data ('the Law') became effective on 2 January 2022, and it is the UAE's first federally applicable, General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') style data protection law. The Law follows key international data protection principles and best practices, such as those found within the GDPR, and marks a positive step towards greater data protection harmonisation with international standards that is a necessity in today's interconnected age, which is characterised by cross border data flows on an international level. In part two of this series on the Law, Andrew Fawcett and Darya Ghasemzadeh, from Al Tamimi & Company, discuss some of the data subject rights under the Law, as well as its provisions on the role of a data protection officer ('DPO') and cross-border data transfers.

April 2022

UAE: What the new data protection law means for companies within the UAE - Part one

The Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data ('the Law') became effective on 2 January 2022, and it is the UAE's first federally applicable, General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') style data protection law. The Law follows key international data protection principles and best practices, such as those found within the GDPR, and marks a positive step towards greater data protection harmonisation with international standards that is a necessity in today's interconnected age, which is characterised by cross border data flows on an international level. In part one of this two-part series on the Law, Andrew Fawcett and Darya Ghasemzadeh, from Al Tamimi & Company, provide an introduction to the provisions and scope of the Law, as well as the establishment of the UAE Data Office.

November 2021

UAE: New Federal Law on Protection of Personal Data - What you need to know

As part of the UAE's comprehensive 'Year of the 50th' legislative reform1, which either amends or enacts over 40 further laws with the aim of boosting the economic competitiveness of the UAE, the UAE Cabinet ('the Cabinet') issued, on 20 September 2021, its awaited Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data ('the Law'). Marked as one of the first projects of its legislative reform, the Law will come into effect and be published in the Official Gazette2 on 2 January 2022 as outlined in Article 31 of the Law, kicking off the transition period for organisations. This Insight article aims to provide a breakdown of the key obligations under the Law, with accompanying analysis on the impact of the Law for key stakeholders in the UAE from Dale Waterman, Managing Director for the Middle East and North Africa at Breakwater Solutions.

October 2021

UAE: Data protection requirements in the CBUAE Consumer Protection Regulations and Standards

The Central Bank of the United Arab Emirates ('CBUAE') announced1, on 1 February 2021, that it had issued the Consumer Protection Regulation ('CPR')2, as part of its Financial Consumer Protection Regulatory Framework and under its mandate to establish regulations for the protection of customers of all licensed financial institutions ('LFIs') under the Decretal Federal Law No. 14 of 2018 Regarding the Central Bank and Organisation of Financial Institutions and Activities. The CPR is supported by the Consumer Protection Standards3 ('the Standards') which define regulatory requirements to ensure consistent interpretation and implementation of the CPR principles.

This Insight will outline some of the data protection and privacy related requirements included within the CPR and the Standards which LFIs will need to comply with before 31 December 2021.

Company

Our Policies

Your Rights

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
© OneTrust, LLC. All Rights Reserved.
The materials herein are for informational purposes only and do not constitute legal advice.