# UAE Federal PDPL — Decree-Law 45/2021

**Status (verified August 2026):** in force since 2 January 2022, **but the Executive Regulations have not been issued** — penalties (to be set by Cabinet decision) and operational detail await them, and organizations get a **6-month compliance grace period from issuance**. Enforcement by the UAE Data Office (established by Decree-Law 44/2021) is effectively dormant until then. Treat any claim that the regulations have been issued as unverified until confirmed on official channels.

## Scope & carve-outs
Applies to processing of personal data of UAE residents (with extraterritorial reach). Carved out: **government data and government entities; DIFC and ADGM** (their own DP laws apply); **health data** (ICT Health Law and health-sector rules prevail); **banking/credit data** (CBUAE sector rules); personal/household use.

## Obligations on the face of the law (readiness posture)
- Lawful basis (consent-centric, with contract/legal-obligation/public-interest alternatives)
- Privacy notices, purpose limitation, minimization, accuracy, security safeguards
- Records of processing; DPO for high-risk/large-scale processing
- Data subject rights: access, portability, correction, deletion, restriction, objection (incl. automated processing)
- Breach notification to the Data Office (and affected subjects where risk) — timelines to be fixed by the regulations
- Cross-border transfers: adequacy or safeguards model — operational lists await the regulations

## Practical advice pattern
Advise clients to build **GDPR-family readiness now** (the law is GDPR-shaped, and DIFC/ADGM practice shows the direction), monitor for the Executive Regulations, and plan a 6-month sprint from their issuance. Always date this status in answers and recommend confirming with official sources.