The UAE's federal personal data law, Decree-Law 45 of 2021, came into force on 2 January 2022. Free zones such as DIFC and ADGM have their own regimes, and some sectors have localisation rules. Before launching in the UAE, confirm which regime applies, the current status of the federal executive regulations, and any sector rules.
The status details below come from sources dated before this review, including one dated January 2025. Rules in this area were still developing, so check the current position.
Federal PDPL basics
The official UAE portal describes the law as applying to processing wholly or partly through electronic systems, with requirements for cross border transfer and sharing. It names the UAE Data Office as the federal regulator. A law firm summary says the law applies to controllers and processors in the UAE and to those outside it who process data of individuals in the UAE.
Status of regulations
According to that summary, as of 6 January 2025 the executive regulations had not been published and the Data Office had not yet been established, with organisations getting six months after the regulations to comply. It also said the law sets no penalties itself, leaving those to a later Cabinet decision. I could not confirm whether this has changed.
Cross border transfers
The same summary says transfers out of the UAE are restricted and the Data Office is expected to approve territories with adequate protection, similar to EU adequacy, with other exceptions whose details were awaited. Treat this as a pending area and watch for the executive regulations.
Free zones
The summary says the federal law keeps the data protection laws of the financial free zones intact. If your entity or customer is in DIFC or ADGM, the regime of that zone applies in its territory, so check it separately.
Sector localisation rules
The summary lists these:
- Stored value facilities: customer data must be stored in the UAE, with limited access.
- Retail payments: personal and payment data stored in the UAE, with a backup in a separate location for five years.
- Health: health information generally cannot be stored, processed or transferred outside the UAE unless an authorised exception in Ministerial Decision 51 of 2021 applies.
- Telecoms: third parties receiving subscriber information must protect its confidentiality and security.
What teams should do
- Identify the sector of each UAE customer before choosing a region.
- Ask the customer whether sector rules bind them. Do not assume your cloud region choice satisfies it.
- Check whether backups, logs and support access are covered by the rule.
- Keep a regional design ready. See regional stack patterns.
- Re-verify the federal status before signing.
Quick check
Does UAE storage solve compliance?
Not alone. Access from abroad, backups and sector specifics also matter.
Sources
This is educational content, not legal advice.
Last reviewed: 19 October 2026.
