UAE PDPL in 2026: what applies to your business now, and what is still pending

The UAE's Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 (the PDPL), came into force on 2 January 2022. Nearly five years later, many businesses still treat it as something that will start later. That is half right, and the half that is wrong is the expensive one.

What is already in force

The law itself. Its obligations are written in the decree-law and apply today: processing only with consent or under one of the exceptions in Article 4, transparency towards individuals, data subject rights (Articles 13 to 18), security measures (Article 20), breach notification to the UAE Data Office (Article 9), impact assessments for high-risk processing (Article 21), and restrictions on transfers outside the UAE (Articles 22 and 23).

What is still pending

The Executive Regulations, which fill in the detail: exact deadlines for breach notification and for answering requests, the procedure for cross-border transfers, and the specifics of DPO appointment. At the time of writing they have not been published on the UAE legislation portal.

Penalties. Article 26 leaves the list of violations and administrative fines to a Cabinet decision, which has not been issued either. Figures you may see quoted online, such as specific deadlines in 2027 or fines of several million dirhams, do not come from any published legal text.

Why waiting is still a bad plan

• The adjustment window is short. Article 29 gives organisations a limited period to comply after the Executive Regulations are issued. Building a record of processing, policies and procedures from nothing takes most small businesses longer than that.
• Your clients are not waiting. Enterprises, banks and government entities already include PDPL questions in supplier onboarding. A missing privacy notice or breach procedure can stall a contract today, regardless of enforcement.
• The work does not change much. The Regulations will add detail, not new principles. A record of processing, a correct privacy notice, vendor contracts and a breach plan are needed under any version of the rules.

Who it applies to

The PDPL applies to the processing of personal data of anyone residing or doing business in the UAE, by controllers and processors inside the UAE and by those abroad who process such data. It does not apply to entities in free zones with their own data protection law, notably DIFC and ADGM, nor to certain government data, and it defers to specific legislation for health and banking data.

A practical starting point

Start by finding out where you stand. Our free assessment takes about ten minutes, scores twelve areas of the law, and tells you how many gaps you have and how serious they are, before you spend anything.