UAE Data Protection in 2026: What a Company Holding Customer Data Must Do Under the PDPL

In the DIFC, failing to answer a customer's request to see their data carries a maximum fine of USD 100,000, and failing to report a breach to the Commissioner carries USD 50,000.¹ In ADGM the breach clock is fixed at 72 hours from the moment you become aware of it.² Onshore, the federal law reaches processing carried out inside or outside the country, so an offshore server does not put the data beyond its reach.³

Which of those numbers is yours is decided by one thing: where the entity holding the data is registered. Outside the financial free zones, the governing statute is Federal Decree-Law No. 45 of 2021, the UAE Personal Data Protection Law, in force since 2 January 2022.³ A company incorporated in the DIFC answers to DIFC Law No. 5 of 2020 instead, wherever the processing physically happens.⁴ ADGM runs a third regime with its own regulator and its own deadlines.²

For a company holding customer data, the practical work is short and specific. Establish which regime governs the entity. Fix the lawful basis for what you already collect. Register and keep records where that is required. Appoint a Data Protection Officer if your processing triggers it. Know your breach clock before you need it. Everything below is that list, with the source for each obligation.

Which data protection law applies to your company in Dubai?

Start here, because every deadline below changes with the answer.

Onshore, the federal PDPL governs. It applies to the processing of personal data, whether in full or in part through electronic systems, inside or outside the country.³ Consent is the default position: the law prohibits processing personal data without the consent of its owner, except in limited cases where processing is necessary to protect a public interest or to carry out legal procedures and rights.³ The federal regulator is the UAE Data Office, established by Federal Decree-Law No. 44 of 2021 alongside the PDPL itself.³

Inside the DIFC, a different statute applies. DIFC Law No. 5 of 2020, in its consolidated March 2022 version as amended by DIFC Law No. 2 of 2022, commenced on 1 July 2020 and replaced the older DIFC data protection law of 2007.⁴ Its reach follows incorporation, not geography: the law applies to processing by a controller or processor incorporated in the DIFC, regardless of whether the processing takes place in the DIFC or not.⁴

Dubai also has an emirate-level statute of its own, Law No. 26 of 2015 regulating data dissemination and exchange in Dubai, listed by the UAE Government among the emirate's cyber laws and separate from the federal PDPL.⁵

If your group holds a mainland company and a DIFC entity, you are running both columns at once, and a policy written for one does not transfer to the other. This is the point where a reading of the regimes against your actual corporate structure is worth more than a policy template.

What does the UAE PDPL require from a company holding personal data?

Three things are settled on the public record, and they are enough to start.

One. Scope is broad. The law covers processing carried out through electronic systems inside or outside the country.³ A UAE company that routes customer records to a group data centre abroad, or hands support tickets to an offshore team, is still processing under the statute.

Two. Consent is the default. Processing personal data without the consent of its owner is prohibited, save for cases where processing is necessary to protect a public interest or to carry out legal procedures and rights.³ For a business, that puts the burden on the collection points, the sign-up form, the CRM import, the marketing list inherited from an acquisition, rather than on the privacy policy that describes them.

Three. There is a federal regulator to deal with. The UAE Data Office was established by its own decree-law alongside the PDPL.³

There is also a hard line on minors. It is prohibited to collect or use the personal data of children under the age of 13 unless strict conditions are met, including parental consent, an easy way to withdraw it, clear disclosure of the purpose, and no targeted advertising.⁶ A consumer app with any under-13 users is dealing with a design requirement, not a disclosure.

Two things this article does not state, because no official source confirmed them for this draft: the PDPL penalty figures, and the exact triggers for appointing a Data Protection Officer under the federal law. Both are worth confirming with the Data Office guidance before anyone quotes a number in a board paper.

What a DIFC company has to file, and who it has to appoint

DIFC obligations are unusually specific, which makes them easy to audit and easy to miss.

1. 1

   Register with the Commissioner

   A controller or processor registers by filing a notification of processing operations, kept up to date through amended notifications.

2. 2

   Keep a written record

   A controller maintains a written record, which may be in electronic form, of the processing activities under its responsibility. A processor keeps a record of the processing it carries out for each controller.

3. 3

   Appoint a DPO where required

   Mandatory for DIFC Bodies and for controllers or processors performing High Risk Processing Activities on a systematic or regular basis. The DPO must reside in the UAE, save for the intra-Group exception.

4. 4

   Assess before high risk processing

   A data protection impact assessment is carried out before High Risk Processing Activities begin, not after the product ships.

The registration duty is the one companies discover late. A controller or processor shall register with the Commissioner by filing a notification of processing operations, and shall keep it up to date through amended notifications.⁷ There is no certificate to obtain and no certification body to pass. The notification, kept current, is the compliance artefact.

The record-keeping duty sits beside it. A controller maintains a written record of the processing activities under its responsibility.⁷ Failing to maintain it carries a maximum fine of USD 25,000, which is the cheapest of the DIFC bands and the easiest to avoid.¹

The DPO duty is narrower but stricter. A DPO shall be appointed by DIFC Bodies and by a controller or processor performing High Risk Processing Activities on a systematic or regular basis.⁸ And the appointment has a residence condition: the DPO must reside in the UAE, unless the individual is employed within the organisation's Group and performs a similar function for the Group on an international basis.⁸ For an international group, that exception is the difference between a local hire and a reporting line into an existing group function.

How fast does a data breach have to be reported?

This is where the two free zone regimes visibly diverge, and where a group operating in both is working to two standards on a single incident.

In the DIFC there is no fixed clock. Where a personal data breach compromises a data subject's confidentiality, security or privacy, the controller notifies the Commissioner as soon as practicable in the circumstances.⁹ Affected customers are told separately, and on their own trigger: when the breach is likely to result in a high risk to the security or rights of a data subject, the controller communicates it to that data subject as soon as practicable.⁹ Failing to report to the Commissioner carries a maximum fine of USD 50,000.¹

In ADGM the standard is numeric. Data controllers notify the Office of Data Protection without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach.²

"As soon as practicable" is not a softer version of 72 hours. It is a standard judged after the fact, on what you actually knew and when, which makes the incident log the document that answers it. Deciding who assesses a breach, and who signs the notification, is work to finish while nothing has happened.

How do you answer a customer who asks for their data?

In the DIFC the deadline is fixed. On request, a data subject has the right to obtain from a controller, without charge and within one month of the request, the information the law specifies.¹⁰ Where a request is particularly complex, or requests are numerous, the controller may give notice within that first month and extend the period for compliance by a further two months, citing the reasons for the delay.¹⁰

The access route itself is regulated too. A controller makes available a minimum of two methods, which must not be onerous, by which a data subject can contact it to exercise these rights, and where it operates a website, at least one free method has to be available there.¹⁰

Failing on these rights sits in the top DIFC fine band: a maximum of USD 100,000.¹ For a consumer-facing business, that combination, a fixed month, a mandatory contact route and the highest penalty band, is the strongest argument for having a named owner for these requests rather than a shared inbox.

What does getting it wrong cost?

The DIFC publishes maximum fines per failure. They are per contravention and they map directly onto the duties above.

ADGM adds a smaller, entirely mechanical cost. Registration is USD 300 and annual renewal is USD 300.¹¹ Miss the renewal within the one-month grace period following the anniversary of incorporation, under Section 24(2) of the Data Protection Regulations 2021, and a fixed monetary penalty of USD 450 is applied automatically.¹¹ Nobody assesses fault. It is a calendar entry that costs money when it is missed.

What changes if the parent company is in the UK, the EU, the US or India?

Most companies reading this are not deciding in isolation. There is a group somewhere else, and its counsel is asking whether the UAE entity is now a separate compliance problem.

Three points hold on the UAE side, whatever the parent's home law says.

• The PDPL follows the processing, not the office. It applies to processing inside or outside the country, so a European or Indian group function handling UAE customer records is inside the statute's scope.³
• DIFC law follows incorporation. A DIFC-incorporated subsidiary is caught by DIFC Law No. 5 of 2020 regardless of where the processing takes place, including on the parent's infrastructure abroad.⁴
• The DPO residence rule is a group question. The DIFC DPO must reside in the UAE unless the individual sits within the organisation's Group and performs a similar function for the Group internationally.⁸ Whether your existing group DPO satisfies that exception is worth confirming before you rely on it.

What this article deliberately does not do is state what the law of the parent's country requires. Whether European or UK data protection law reaches your UAE entity is decided by that law, on the entity's own EU-facing or UK-facing activity, and the same applies to US federal and state obligations and to Indian requirements. Those questions are confirmed with an adviser qualified in that jurisdiction. What is settled is that a favourable answer there removes nothing here: the UAE obligations run in parallel, not in the alternative.

The mistakes that turn a compliance gap into a filing

None of these is exotic. Each is avoidable with a map of your entities and a calendar.

• Assuming one policy covers the group. A mainland company and a DIFC entity sit under different statutes with different regulators, and DIFC law follows the place of incorporation rather than the place of processing.⁴ One policy applied to both leaves one of them uncovered.
• Treating offshore processing as out of scope. The PDPL covers processing inside or outside the country.³ Moving the workload does not move the obligation.
• Skipping the DIFC notification. Registration with the Commissioner is a filing obligation that has to be kept current through amended notifications.⁷ It is not triggered by a complaint, and it is not satisfied by a privacy policy.
• Reading the DPO rule as optional. It is mandatory for High Risk Processing Activities carried out on a systematic or regular basis, the residence condition is real, and the maximum fine for getting it wrong is USD 50,000.⁸¹
• Discovering the breach process during the breach. DIFC asks for notification as soon as practicable, ADGM within 72 hours, and both are judged on what you did from the moment you knew.⁹²
• Letting an ADGM renewal lapse. The USD 450 penalty is applied automatically after the one-month grace period.¹¹ It is the only item on this list that requires no legal judgment at all, and it is still missed.

Where LawyersDubai fits

The obligations above are public, and they reward the company that maps its entities before an incident forces the exercise. Which regime governs each entity. What each one has to file. Who owns a customer request and who signs a breach notification. Those four answers are the compliance programme in practice.

That is where LawyersDubai fits. It is a law consultancy firm, a single confidential point of contact that coordinates access to licensed UAE professionals across the mainland, the DIFC and ADGM, from a first read of which regime applies to a data mapping exercise, to specialist legal advisory when an incident is live. Where the same customer files also carry anti-money laundering and customer due diligence duties, those obligations are read together rather than in separate projects. It does not provide legal advice, and it is not a law firm. It connects you to the professional who does.