# UAE PDPL: UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021)

> The UAE’s federal data protection law for organisations processing personal data in or from the UAE.

URL: https://securei3.com/standards/uae-pdpl/
Category: GCC regulations: Law or regulation
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


Federal Decree-Law No. 45 of 2021 sets rules for processing personal data, individuals' rights, security, breach notification and cross-border transfers in the UAE. We confirm which regimes apply to each of your entities and build a privacy programme that satisfies them together.

## Who it is for

- Companies established in the UAE outside financial free zones
- Organisations processing personal data of people in the UAE from abroad
- Groups with entities in DIFC or ADGM as well as onshore

## Benefits

- Clarity on which UAE regime applies to each entity
- Privacy controls that also satisfy GDPR-aligned free-zone laws
- Stronger position with UAE enterprise and government clients

## How Secure iQube helps

1. **Applicability and scoping**: Confirm whether and how the law applies to you, entities, data, systems, roles and territories.
2. **Data and process mapping**: Build a record of processing or control inventory so obligations can be tied to real systems and owners.
3. **Gap assessment**: Measure current practice against each obligation and rank the gaps by legal and business risk.
4. **Remediation roadmap**: Policies, notices, contracts, technical controls and governance, sequenced so the highest risks close first.
5. **Evidence and ongoing monitoring**: A compliance calendar, metrics and periodic reviews so you can demonstrate compliance to a regulator or customer at any time.

## Frequently asked questions

### Does the UAE PDPL apply in DIFC and ADGM?

No. Financial free zones with their own data protection laws, such as DIFC and ADGM, are carved out, as are some sector-specific regimes like health data. Groups operating in several zones often need to comply with more than one law.

Related: https://securei3.com/standards/gdpr/, https://securei3.com/standards/iso-27701/, https://securei3.com/standards/ksa-pdpl/

Contact: https://securei3.com/contact/: info@securei3.com