Data Protection in the UAE

Data Protection in the UAE

The firm covers UAE matters in cooperation with an announced partner office in the United Arab Emirates. That partner office is not a branch owned by the firm, and the firm does not itself hold a UAE law practice license; local licensing and representation are assessed for each matter in the Emirates. The UAE's federal law is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, in force since 2 January 2022 and overseen by the UAE Data Office. It does not apply to free zones that have their own data protection legislation: the Dubai International Financial Centre (DIFC Data Protection Law No. 5 of 2020, Commissioner of Data Protection) and Abu Dhabi Global Market (ADGM Data Protection Regulations 2021, Office of Data Protection). So the first question is where the entity is established and where the processing takes place, and we work through it with our partner office.

The federal law: consent, rights and DPOs

Processing needs the individual's consent unless one of the cases listed in the law applies, such as a legal obligation, a public interest or the protection of legal claims. Individuals can ask for information about the processing, receive their data in a machine-readable format, have it corrected or erased, and restrict or object to processing. A controller or processor must appoint a data protection officer where processing carries a high risk through new technologies or data volume, involves systematic and comprehensive assessment of sensitive data including profiling, or covers a large volume of sensitive data. The Data Office may exempt establishments that do not process large volumes of personal data.

Breaches and transfers outside the UAE

A controller that becomes aware of a breach that would prejudice the privacy, confidentiality or security of data must notify the Data Office, with a description of the breach, its likely effects and the corrective measures taken, and must notify the individual where the breach prejudices their privacy or security. Personal data can leave the UAE to a country with adequate legislation or under a binding agreement, or, where there is no such protection, on grounds such as a contract with the recipient or the individual's explicit consent. Several timelines and criteria are left to the Executive Regulations, so we check their current status for each matter.

DIFC, ADGM and sector laws

A DIFC or ADGM entity follows its free zone's regime and regulator, not the federal law, and a group often sits under more than one regime. Sector rules add to this, for example Federal Law No. 2 of 2019 on ICT in health fields and Federal Law No. 15 of 2020 on consumer protection, which restricts suppliers' use of consumer data for marketing. To scope a UAE compliance file, see General Commercial & Corporate or contact our team.

MENA coordination

The firm was founded in Kuwait in 1986 and has a branch in Cairo. It covers MENA matters in cooperation with partner offices in Saudi Arabia, the UAE and Qatar, and partner offices in Turkey and the United States. Those partner offices are not branches owned by the firm; local licensing and advice are assessed in the relevant jurisdiction.

This page is general information, not advice for a particular entity or transaction.

Frequently asked questions

Which law governs personal data in the UAE?

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, in force since 2 January 2022 and overseen by the UAE Data Office. Free zones with their own legislation, notably DIFC and ADGM, follow their own regimes.

Does the federal law apply to companies in the DIFC or ADGM?

No for free zones with their own data protection legislation. The DIFC applies Data Protection Law No. 5 of 2020, and the ADGM applies its Data Protection Regulations 2021, each with its own regulator.

Who handles UAE data protection matters at the firm?

UAE matters are handled in cooperation with the firm's announced partner office in the UAE. The firm does not itself hold a UAE law practice license, and local licensing and representation are assessed for each matter.

Other markets

Corporate & Commercial Law in the UAE · Data Protection in Egypt · Data Protection in Saudi Arabia · Data Protection in Qatar · Data Protection in Oman · Data Protection in Bahrain