Home › Compare laws side by side › UAE PDPL vs EU GDPR
UAE PDPL vs EU GDPR
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (United Arab Emirates (onshore; excludes DIFC and ADGM free zones)) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.
| Topic | UAE PDPL United Arab Emirates (onshore; excludes DIFC and ADGM free zones) 12/14 facts confirmed by two sources | EU GDPR European Union (EEA) ✓ Confirmed by two sources |
|---|---|---|
| Status | In force since 2 January 2022, but Executive Regulations still not issued as of July 2026, so many operational details are pending.✓ | In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓ |
| Who it applies to | Processing of data of people living or doing business in the UAE; UAE-based controllers/processors whatever the data subject's location; and foreign controllers/processors handling data of people in the UAE (extraterritorial). Leaves DIFC and ADGM laws intact.✓ | Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓ |
| Size thresholds | No size or volume threshold; applies to any covered organisation. DPO duty is triggered by high-risk or large-scale sensitive data processing.✓ | None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓ |
| Regulator | UAE Data Office (nominal regulator, not fully operational); consolidated into the UAE Artificial Intelligence and Data Authority, established 14 June 2026. | National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓ |
| Breach or incident reporting | Notify the Data Office immediately on becoming aware of a breach that harms privacy (Art. 9); exact deadline and procedure await the Executive Regulations.✓ | Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓ |
| Deadline to answer personal data requests | No fixed deadline in the Decree-Law: requests are free and corrections must be made without undue delay. DLA Piper cites one calendar month, extendable by two months, but this is not in the statute and may come with the Executive Regulations.✓ | 1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓ |
| Data protection officer | Required for high-risk processing using new technologies, systematic assessment/profiling of sensitive data, or large volumes of sensitive data (Art. 10). Can be staff or contractor; need not be UAE-based.✓ | DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓ |
| Local representative | No local representative requirement in the Decree-Law.✓ | Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓ |
| Sending data abroad | Restricted. Allowed to jurisdictions approved as adequate by the Data Office or under listed exceptions (e.g., consent, contract); details await Executive Regulations.✓ | Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓ |
| Cookies and consent | Consent is the default legal basis, with exceptions (contract, legal claims, public interest, health). No cookie-specific rules. People can object to direct marketing and related profiling (Art. 17).✓ | Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓ |
| Maximum penalty | PDPL itself sets no fines; a Cabinet decision on violations and penalties is pending. The Cybercrime Law (Decree-Law 34/2021) may apply: detention and/or AED 50,000–500,000.✓ | Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓ |
= confirmed by two independent sources, at least one official.
Facts marked “Being verified” are still being confirmed and are not given as answers.
Who each law applies to
- UAE PDPL
- Processing of data of people living or doing business in the UAE; UAE-based controllers/processors whatever the data subject's location; and foreign controllers/processors handling data of people in the UAE (extraterritorial). Leaves DIFC and ADGM laws intact.
- EU GDPR
- Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.
What you must do under UAE PDPL
- Map processing of UAE residents' data, including offshore processing of it.
- Get clear consent or document another permitted legal basis before processing.
- Appoint a DPO if you run high-risk or large-scale sensitive data processing.
- Set up a breach process to notify the Data Office immediately once a breach is known.
- Restrict transfers outside the UAE to approved countries or listed exceptions.
- Honour access, correction, erasure and objection requests, including opt-outs from direct marketing.
What you must do under EU GDPR
- Identify a lawful basis for every processing purpose and record it.
- Publish a clear privacy notice covering purposes, recipients, retention and rights.
- Keep a record of processing activities and sign Art 28 contracts with processors.
- Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
- Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
- Answer access, erasure and other rights requests within one month.
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@