الصفحة الرئيسية › مكتبة القوانين › UAE PDPL
UAE PDPL
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
موثّق المصدر · 12/14 معلومات مؤكَّدة من مصدرين. آخر تحقق 10 أكتوبر 2026
موعد المراجعة الكاملة التالية: . نتابع أخبار الجهات الرقابية شهريًا، وتُسجَّل التغييرات في سجل التغييرات.
الاستشهاد بهذه الصفحة: GlanceDesk Jurisdiction, “UAE PDPL (United Arab Emirates (onshore; excludes DIFC and ADGM free zones))”, glancedeskjurisdiction.com/laws/ae-pdpl, last verified 10 October 2026.
United Arab Emirates (onshore; excludes DIFC and ADGM free zones) الخصوصية
- الحالة
- In force since 2 January 2022, but Executive Regulations still not issued as of July 2026, so many operational details are pending.✓
- على من ينطبق
- Processing of data of people living or doing business in the UAE; UAE-based controllers/processors whatever the data subject's location; and foreign controllers/processors handling data of people in the UAE (extraterritorial). Leaves DIFC and ADGM laws intact.✓
- حدود الحجم
- No size or volume threshold; applies to any covered organisation. DPO duty is triggered by high-risk or large-scale sensitive data processing.✓
- الجهة الرقابية
- UAE Data Office (nominal regulator, not fully operational); consolidated into the UAE Artificial Intelligence and Data Authority, established 14 June 2026.
- الإبلاغ عن الخروقات أو الحوادث
- Notify the Data Office immediately on becoming aware of a breach that harms privacy (Art. 9); exact deadline and procedure await the Executive Regulations.✓
- مهلة الرد على طلبات البيانات الشخصية
- No fixed deadline in the Decree-Law: requests are free and corrections must be made without undue delay. DLA Piper cites one calendar month, extendable by two months, but this is not in the statute and may come with the Executive Regulations.✓
- مسؤول حماية البيانات
- Required for high-risk processing using new technologies, systematic assessment/profiling of sensitive data, or large volumes of sensitive data (Art. 10). Can be staff or contractor; need not be UAE-based.✓
- الممثل المحلي
- No local representative requirement in the Decree-Law.✓
- نقل البيانات إلى الخارج
- Restricted. Allowed to jurisdictions approved as adequate by the Data Office or under listed exceptions (e.g., consent, contract); details await Executive Regulations.✓
- ملفات تعريف الارتباط والموافقة
- Consent is the default legal basis, with exceptions (contract, legal claims, public interest, health). No cookie-specific rules. People can object to direct marketing and related profiling (Art. 17).✓
- أقصى عقوبة
- PDPL itself sets no fines; a Cabinet decision on violations and penalties is pending. The Cybercrime Law (Decree-Law 34/2021) may apply: detention and/or AED 50,000–500,000.✓
المعلومات الموسومة بعبارة «قيد التحقق» لا تزال قيد التأكيد ولا تُقدَّم كإجابات.
ما يجب عليك فعله✓
- Map processing of UAE residents' data, including offshore processing of it.
- Get clear consent or document another permitted legal basis before processing.
- Appoint a DPO if you run high-risk or large-scale sensitive data processing.
- Set up a breach process to notify the Data Office immediately once a breach is known.
- Restrict transfers outside the UAE to approved countries or listed exceptions.
- Honour access, correction, erasure and objection requests, including opt-outs from direct marketing.
- Monitor for the Executive Regulations; a 6-month adjustment window is expected after they are issued.
التغييرات الأخيرة
Executive Regulations still pending (July 2026). UAE AI and Data Authority established 14 June 2026, absorbing the Data Office. New Child Digital Safety Law bans collecting under-13s' data without verified parental consent.
المصادر
- المصدر الأساسي: https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws
- المصدر الثاني: https://www.ashurstperkinscoie.com/en/insights/data-bytes-67-your-emea-data-privacy-update-for-july-2026/
- الجهة الرقابية: UAE Data Office (nominal regulator, not fully operational); consolidated into the UAE Artificial Intelligence and Data Authority, established 14 June 2026.
المصادر المستخدمة في التحقق المستقل (6)
- https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws
- https://www.tamimi.com/law_update_articles/uae-establishes-new-federal-authority-for-ai-and-data-a-significant-step-in-the-evolution-of-digital-regulation/
- https://www.morganlewis.com/pubs/2026/06/uae-establishes-federal-authority-for-artificial-intelligence-and-data
- https://uaelegislation.gov.ae/en/legislations/1972/download
- https://www.dlapiperdataprotection.com/index.html?t=law&c=AE
- https://gulfnews.com/uae/government/detention-fine-up-to-dh500000-for-illegal-possession-and-use-of-personal-data-uae-public-prosecution-warns-1.85290355
= مؤكَّد من مصدرين مستقلين، أحدهما على الأقل رسمي. كيف نتحقق
معلومات فقط، وليست استشارة قانونية. القوانين تتغير؛ تحقّق مع الجهة الرقابية أو محامٍ مؤهل قبل الاعتماد على هذه الصفحة. هل لاحظت خطأ؟ راسلنا على contact@