# Regulatory Standards — UAE Personal Data Protection Law

## Primary Legislation

### Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
- Issued 20 September 2021; effective 2 January 2022
- **Article 1**: Definitions — personal data, sensitive personal data, controller, processor, data subject
- **Article 2**: Scope — applies to controllers and processors in the UAE processing personal data; extraterritorial application to controllers outside the UAE offering goods/services to UAE data subjects
- **Article 3**: Exemptions — government security, judicial entities, personal/family use, media
- **Article 5**: Lawful bases for processing — consent, contract, legal obligation, vital interests, public interest, legitimate interests, and other specified bases
- **Article 7**: Sensitive personal data — enhanced protections for racial/ethnic origin, political opinions, religious beliefs, criminal records, biometric, health, genetic data
- **Articles 13-18**: Data subject rights — information, access, rectification, erasure, restriction, portability, objection, automated decision-making
- **Article 8**: Records of processing activities
- **Article 9**: Data Protection Impact Assessment for high-risk processing
- **Article 10**: Data Protection Officer appointment requirements
- **Article 11**: Technical and organisational security measures
- **Article 12**: Breach notification to UAE Data Office and data subjects
- **Article 22**: Cross-border transfer conditions — adequacy, appropriate safeguards, or derogations

### Cabinet Decision No. 111 of 2023 — Executive Regulations
- Published in Official Gazette 23 October 2023
- Compliance deadline: 1 January 2025
- Specifies detailed requirements for:
  - Consent mechanisms and valid consent criteria
  - Data Protection Impact Assessment methodology
  - DPO qualification and responsibilities
  - Breach notification timeframes and procedures
  - Cross-border transfer adequacy criteria and standard contractual clauses
  - Records of processing activities format
  - Technical security measure standards

## UAE Data Office

- Established under Article 23 of the UAE PDP Law
- Functions include: issuing guidance, investigating complaints, imposing administrative sanctions, approving cross-border transfer mechanisms, maintaining the register of DPOs
- Authorised to issue binding decisions and impose corrective measures

## Free Zone Data Protection Regimes

### DIFC Data Protection Law No. 5 of 2020
- **Article 7**: Principles of processing — lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, accountability
- **Article 10**: Conditions for processing — consent, contractual necessity, legal obligation, vital interests, public interest, legitimate interests
- **Article 12**: Special categories of personal data
- **Articles 17-26**: Data subject rights
- **Article 27**: International transfers
- Enforced by the DIFC Commissioner of Data Protection

### ADGM Data Protection Regulations 2021
- **Section 5**: Principles relating to processing
- **Section 6**: Lawfulness of processing
- **Section 7**: Sensitive personal data
- **Sections 10-18**: Data subject rights
- **Section 24**: Transfer of personal data outside ADGM
- Enforced by the ADGM Office of Data Protection

## International Standards and Frameworks

### ISO/IEC 27701:2019 — Privacy Information Management System
- Extends ISO 27001/27002 for privacy management
- Referenced in the Executive Regulations as a recognised framework for demonstrating adequate technical measures

### NIST Privacy Framework 1.0 (2020)
- Risk-based approach to managing privacy risk
- Complementary framework for UAE PDP Law compliance programmes

### Council of Europe Convention 108+
- UAE is not a party to Convention 108 but the UAE PDP Law incorporates principles aligned with international data protection standards
- Convention 108+ principles inform interpretation of adequacy for cross-border transfers

## GCC Data Protection Developments

### Saudi Arabia Personal Data Protection Law (PDPL)
- Royal Decree M/19, 9 September 2021; amendments March 2023
- Effective September 2023 with two-year transition period
- Similar structure to UAE PDP Law; cross-reference for regional harmonisation

### Bahrain Personal Data Protection Law (Law No. 30 of 2018)
- First comprehensive GCC data protection law
- Administered by the Ministry of Industry, Commerce and Tourism
- Provides regional precedent for UAE PDP Law interpretation

### Qatar Law No. 13 of 2016 on Personal Data Privacy
- Applies within Qatar and the Qatar Financial Centre
- Cross-border transfer restrictions aligned with international standards