# UAE Jurisdiction Routing Map (the decision table)

| Where the organization sits | Privacy law | Cyber baseline | Sector overlays that still reach in |
|---|---|---|---|
| **Mainland UAE** (and non-financial free zones) | Federal PDPL (Decree-Law 45/2021 — exec regs pending) | UAE IA Regulation if government/CNI; else best practice | ICT Health Law (health data); CBUAE rules (if licensed); cybercrime law (Decree-Law 34/2021) |
| **DIFC** | DIFC DP Law No. 5 of 2020, as amended by Amendment Law No. 1 of 2025 | DFSA operational/cyber rules for regulated firms | ICT Health Law (health data); CBUAE only if CBUAE-licensed |
| **ADGM** | ADGM DP Regulations 2021 | FSRA rules for regulated firms | ICT Health Law (health data) |
| **Dubai Healthcare City** | DHCC Health Data Protection Regulation (2013), enforced by CPQ | — | ICT Health Law |
| **Dubai government / semi-government** | Federal PDPL posture + Dubai data law regime | **DESC ISR v3** | Sector rules as applicable |
| **Abu Dhabi government** | Federal PDPL posture | **ADDA Information Security Standard** | ADHICS for DoH-regulated health entities |
| **Federal government / CNI** | Government-data carve-out from PDPL | **UAE IA Regulation** (Cyber Security Council / SIA) | Sector rules |

## Worked examples
1. **DIFC-licensed fintech** → DIFC DP Law (2025 amendment: private right of action, adequacy assessments) + DFSA conduct/tech rules. NOT federal PDPL; NOT CBUAE (unless separately CBUAE-licensed).
2. **Mainland retailer** → Federal PDPL (build readiness now; exec regs pending) + cybercrime law exposure; no zone registration.
3. **Dubai hospital (mainland)** → ICT Health Law localization + DHA rules + federal PDPL for non-health personal data.
4. **ADGM asset manager** → ADGM DP Regs (annual notification, 72h breach) + FSRA.
5. **CBUAE-licensed bank** → CBUAE consumer-data residency + outsourcing approvals + federal PDPL readiness; DIFC branch privacy = DIFC DP Law.
6. **US SaaS with UAE customers, no entity** → carve-out-aware federal PDPL posture (extraterritorial reach; enforcement dormant pending regs); zone laws only if serving zone entities as processor (contractual flow-downs); health data → ICT Health Law localization blocks offshore hosting.

**Rule: if jurisdiction or license type is unknown, ask before advising.**