Compliance guide · United Arab Emirates

UAE data and cyber rules, mapped.

The UAE has a federal data protection law, separate laws in the DIFC and ADGM financial free zones, and its own rules for government, health and banking. Here is which applies where, and what companies serving UAE clients should prepare.

Plan your UAE readiness Which rule applies?
Federal, DIFC and ADGM rules mappedServed remotely from BengaluruOn-site visits by arrangement
In plain words

Most UAE businesses fall under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), in effect since 2 January 2022. Companies in the DIFC and ADGM follow their own data protection laws instead, and health and banking data have their own rules. Government bodies and their suppliers may also need the UAE Information Assurance Standard, Dubai’s ISR, or Abu Dhabi’s ADHICS for healthcare. We serve UAE clients remotely from Bengaluru; on-site visits can be arranged.

Checked against official sources on . General information, not legal advice.

Federal law
Decree-Law 45 of 2021
In effect since
2 January 2022
Free zones
DIFC and ADGM have their own
We serve from
Bengaluru, mostly remote
Which rule applies where

One country, several data laws.

The first question for any UAE project is which law you are under. Where the business is registered, and what kind of data it holds, decide it.

Which UAE data law applies. Start with personal data about people in the UAE. If the business is in the DIFC, the DIFC Data Protection Law of 2020 applies, with rules for AI systems. If it is in ADGM, the ADGM Data Protection Regulations 2021 apply. Health data falls under the Federal Health Data Law of 2019 and emirate rules such as ADHICS in Abu Dhabi. Banking data falls under Central Bank of the UAE rules. Everything else falls under the federal Personal Data Protection Law, Decree-Law 45 of 2021, in effect since 2 January 2022. START HEREPersonal dataabout people in the UAEIN THE DIFC?DIFC Data Protection LawDIFC Law No. 5 of 2020, with rules for AI systemsIN ADGM?ADGM Data Protection Regulations 2021Abu Dhabi Global Market’s own data lawHEALTH DATA?Federal Health Data Law and emirate rulesDecree-Law 2 of 2019; ADHICS in Abu DhabiBANKING DATA?Central Bank of the UAE rulesConsumer protection and outsourcing rulesEVERYTHING ELSEFederal PDPLDecree-Law 45 of 2021, in effect since 2 January 2022
A simplified map. Government entities and their suppliers may also need to meet the UAE Information Assurance Standard or Dubai’s ISR, whatever data law applies.
The federal PDPL

What the PDPL asks of you.

  • A lawful reason

    Consent, or another basis the law allows, such as performing a contract or a legal duty.

  • Rights for people

    Access, correction, erasure, restriction, portability, and objecting to decisions made only by automated processing.

  • Security measures

    Protection that fits the risk, such as encryption and pseudonymisation.

  • Breach notification

    Tell the regulator about breaches that put privacy at risk, and tell the people affected.

  • Impact assessments

    A data protection impact assessment for high-risk processing, such as new technology or large amounts of sensitive data.

  • Transfers abroad

    Allowed to countries with adequate protection, or with safeguards such as contracts or consent.

The rulebooks

Six rulebooks worth knowing.

  • Federal PDPLDecree-Law 45 of 2021. Covers processing in the UAE and processing abroad of data about people in the UAE. Its implementing regulations, which set details such as penalty amounts, are still awaited.
  • DIFC Data Protection LawDIFC Law No. 5 of 2020, enforced by the DIFC Commissioner of Data Protection. Since 2023 it has specific rules for personal data processed by AI and other autonomous systems.
  • ADGM Data Protection Regulations 2021For businesses in Abu Dhabi Global Market, closely modelled on Europe’s GDPR.
  • UAE Information Assurance StandardSecurity controls for federal government entities and critical sectors.
  • Dubai ISRDubai’s information security regulation for government entities, from the Dubai Electronic Security Center.
  • ADHICSAbu Dhabi’s healthcare information and cyber security standard for licensed health providers.
AI in the UAE

No single AI law yet, but plenty of AI rules.

A new federal authority. In June 2026 the UAE announced the Federal Authority for Artificial Intelligence and Data, bringing together the UAE AI Office, the Emirates Data Office and parts of the telecoms regulator. It is expected to drive AI and data policy, and to take forward the PDPL’s implementing regulations.

Rules that already touch AI. The PDPL lets people object to decisions made only by automated processing. The DIFC has specific rules for AI systems that process personal data. Free-zone and sector regulators expect AI to meet the same security bar as any other system.

What to do now. Keep an inventory of AI systems that touch UAE personal data, run impact assessments for high-risk uses, and test chatbots and agents for data leaks before customers find them. Our LLM red teaming covers this.

Questions

UAE questions, answered.

Q01Does the UAE PDPL apply to an Indian company?
Yes, if you process personal data of people who live or do business in the UAE, even from outside the country. It does not apply where the DIFC or ADGM laws apply instead, or to data covered by its own health or banking laws.
Q02Is the PDPL being enforced?
The law has been in effect since 2 January 2022, but its implementing regulations, which set details such as penalty amounts, had not been issued as of our last check. The new Federal Authority for Artificial Intelligence and Data, announced in June 2026, is expected to take them forward. Customers and free-zone regulators already expect PDPL-level protection, so plan as if it applies in full.
Q03We are in the DIFC. Which law applies?
The DIFC Data Protection Law (DIFC Law No. 5 of 2020) and its regulations, enforced by the DIFC Commissioner of Data Protection, apply instead of the federal PDPL. The DIFC also has specific rules for AI systems that process personal data.
Q04Do you have an office in the UAE?
No. We serve UAE clients remotely from Bengaluru, which is only 90 minutes ahead of the UAE, so our working days overlap. If a project needs someone on site, tell us when you ask for a quote and we will plan it in. See how we work with UAE companies.
Q05Can you test systems hosted in the UAE?
Yes. We test remotely under a written authorisation, and plan the work so that client data stays where it is: we look at your systems, we do not copy your data out.
Q06What do UAE government suppliers need?
It depends on the entity: federal bodies follow the UAE Information Assurance Standard, Dubai government entities the Dubai ISR, and Abu Dhabi health providers ADHICS. Contracts often pass these duties on to suppliers, and ISO 27001 is a good foundation for all three. In Dubai, government, semi-government and critical-infrastructure entities must also buy penetration testing and incident response from companies certified under the Dubai Cyber Force programme, in force since 1 July 2024. We are not certified under it, so for those entities we help with readiness and policy work, not the testing itself.
Sources

Checked against the official text.

This guide is general information, not legal advice. Rules and dates change, so check the official text and ask your lawyer before making decisions for your company. We update this page when the rules change.

Next hops

Related guides and services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings