The UAE's federal data protection law took effect in January 2022, and most teams building for the Emirates still treat it as "GDPR, roughly." That approximation is close enough to be dangerous — it gets consent mostly right and gets jurisdiction badly wrong.
The short answer: Federal Decree-Law 45/2021 applies to processing personal data of individuals in the UAE regardless of where your company sits. But if your entity is established in DIFC or ADGM, a different law governs you entirely — and that is the single most common and costly mistake in UAE compliance.
This guide covers what to build. For how the UAE compares with Saudi Arabia and Qatar, start with the Gulf regulatory compliance guide.
This is technical guidance for developers and product owners, not legal advice. Reporting on the status and content of the executive regulations has been inconsistent across sources. Verify the current position with a qualified UAE advisor before relying on any specific interpretation, including this one.
First: which law actually governs you?
This determines everything else, and it depends on where your entity is established — not which emirate you operate in or where your users are.
| Your entity is in | Law that applies | Character |
|---|---|---|
| Mainland UAE (Dubai, Abu Dhabi, Sharjah…) | Federal Decree-Law 45/2021 | Consent-centred, federal |
| DIFC (Dubai International Financial Centre) | DIFC Data Protection Law | GDPR-style, own commissioner |
| ADGM (Abu Dhabi Global Market) | ADGM Data Protection Regulations | GDPR-style, own regulator |
| Healthcare (anywhere in UAE) | Federal law plus health data rules | In-country storage requirement |
Why teams get this wrong: "We're a Dubai company" is ambiguous. A company in Dubai Internet City is mainland; a company in DIFC is not. The free zones are separate legal jurisdictions with their own data protection statutes, their own regulators, and their own registration and breach-reporting procedures.
The practical consequence: building to the federal law when DIFC governs you means you have complied with the wrong statute. DIFC and ADGM are closer to European GDPR — they require a documented lawful basis (not necessarily consent), carry data protection officer obligations in some cases, and have their own notification routes.
Check this first, before any architectural decision. Your trade licence tells you which jurisdiction you are in.
Consent — and the bases that are not consent
Consent is the default basis under the federal law, and it must be explicit, specific, freely given, and unambiguous, given through a clear affirmative action. It must also be revocable at any time.
What does not qualify:
- Pre-ticked checkboxes — a clear affirmative action means the user acts, not that they fail to object
- One blanket consent covering unrelated purposes
- Consent buried in terms of service
- Making the core service conditional on consent it does not require
What to build:
□ Separate opt-in per purpose (service / marketing / analytics)
□ Never pre-ticked
□ Plain-language explanation of each purpose
□ Withdrawal as easy as granting it
□ Timestamped record: when, and against which policy version
Where the UAE differs usefully from a consent-only reading: the law recognises processing without consent in defined situations, including protection of public interest or public health, data the subject has already made public, legal claims and judicial procedures, employment and social security obligations, and occupational or preventive medicine.
This matters for product design. If you are processing employee data to meet an employment obligation, consent is not the right basis — and asking for consent you do not need creates a worse position, because a user who withdraws it leaves you unable to perform an obligation you are legally required to perform.
Document your basis per processing activity. "Consent for everything" is simpler to build and harder to defend.
User rights — what the product must actually do
Individuals have the right to access, correct, erase, restrict, and object to processing, plus the right to withdraw consent at any time and to complain to the UAE Data Office.
| Right | What you build |
|---|---|
| Access | Show them the data you hold |
| Correction | Let them edit it |
| Erasure | Delete account and data — genuinely |
| Restriction | Suspend processing without deleting |
| Objection | Stop a specific processing activity |
| Withdrawal | One-click consent revocation |
Restriction is the one most often missing. It is not deletion — it is "keep it but stop using it," which for most systems means a status flag your processing paths must actually respect. Building erasure without restriction is a partial implementation that looks complete.
And erasure must mean erasure. A deleted_at flag is not deletion. Check backups, logs, analytics exports, and any warehouse copies. Data removed from your primary database but sitting in a log aggregator has not been deleted.
The implementation pattern here is nearly identical to Saudi Arabia's, so the Saudi PDPL developer guide is worth reading alongside this — build once, satisfy both.
Breach notification
Controllers must notify the UAE Data Office when a breach compromises the privacy, confidentiality, or security of a data subject. In practice this is generally treated as within 72 hours of discovery, aligning with regional norms.
This is a monitoring requirement wearing a paperwork costume. You cannot report within 72 hours a breach you find out about in two months. What it actually demands:
- Detection — alerting that surfaces anomalous access or exfiltration
- Forensics — logging detailed enough to establish what was accessed, when, and whose data
- A written procedure — who is told internally, who decides, who contacts the Data Office
- Vendor terms requiring your processors to notify you within 24 hours, since their delay consumes your window
Write the procedure before you need it. A breach is not the moment to design a process.
Cross-border transfers
The federal law permits transfers to jurisdictions offering adequate protection, or under approved contractual safeguards — a conditional model rather than Saudi Arabia's more restrictive one.
The exception that overrides everything: health data. UAE health data carries an in-country storage requirement. This is an architectural constraint, not a contractual one you can paper over with a clause. If your product touches health data, read health apps in the UAE before choosing hosting.
The check almost everyone skips: confirming the primary database is in-region and stopping. Backups replicate across regions by default in most managed services. Logs contain personal data and typically ship to a third-party service abroad. Analytics, crash reporting, push notification providers, and AI APIs all move data across borders. Each is a transfer.
Ask any provider three things: where is primary data, where are backups, where are logs. The hosting comparison guide covers which UAE regions exist and what they actually guarantee.
What this costs to build
Assuming it is designed in from the start rather than retrofitted:
| Work | Effort | Indicative cost |
|---|---|---|
| Consent management (granular, logged, revocable) | 3 – 6 days | $1,500 – $4,000 |
| User rights (access/correct/erase/restrict/object) | 6 – 12 days | $3,000 – $7,000 |
| Audit logging and breach detection | 4 – 8 days | $2,000 – $5,000 |
| Lawful basis mapping and retention policy | 2 – 4 days | $1,000 – $2,500 |
| Bilingual privacy policy | — | $500 – $2,000 |
| Legal review | — | $2,000 – $8,000 |
Restriction and objection rights push the user-rights line above its Saudi equivalent — there are simply more states to model.
Retrofitting costs three to five times this, because adding restriction to a system that never modelled processing states is structural work, not a feature.
A pre-launch checklist
- Confirmed whether federal, DIFC, or ADGM law governs your entity
- Documented a lawful basis for each processing activity — not consent by default
- Granular, non-pre-ticked, revocable consent where consent is the basis
- Timestamped consent records with policy version
- All six rights available in-product, including restriction and objection
- Erasure covers backups, logs, and analytics exports
- Confirmed where primary data, backups, and logs are stored
- Health data (if any) stored in-country
- Every third-party processor reviewed for transfers
- Data processing agreements requiring 24-hour breach notification to you
- Written breach response procedure with named owners
- Monitoring capable of detecting a breach inside the window
- No production data in development environments
- Privacy policy in Arabic and English reflecting actual practice
Related reading
- Gulf regulatory compliance guide — how the UAE compares with Saudi Arabia and Qatar.
- Saudi PDPL developer guide — the overlapping implementation, in more depth.
- Health apps in the UAE — DHA licensing and health data residency.
- Hosting comparison — UAE regions and where data actually lives.
- App development in Abu Dhabi — ADGM and the local market.
- Web design company in Dubai — Dubai pricing and requirements.
Frequently asked questions
Does UAE data protection law apply if my company is abroad?
Yes. Federal Decree-Law 45/2021 applies to processing personal data of individuals inside the UAE regardless of where your company or servers are located. Being registered elsewhere does not exempt you if you have UAE users.
Is DIFC covered by the UAE federal law?
No. DIFC has its own data protection law with its own commissioner, and ADGM likewise has separate regulations. Both are closer in structure to European GDPR than to the federal law. Which one governs you depends on where your entity is established, not which emirate you operate in — check your trade licence before making architectural decisions.
Do I always need consent to process data in the UAE?
No, and defaulting to consent for everything is a common design error. The law recognises processing without consent in defined situations including public interest, public health, data the subject made public, legal claims, and employment and social security obligations. Document a lawful basis per activity — asking for consent you do not need creates problems when a user withdraws it.
How quickly must I report a data breach in the UAE?
Controllers must notify the UAE Data Office when a breach compromises a data subject's privacy, confidentiality, or security, generally treated as within 72 hours of discovery. The practical requirement is monitoring that detects breaches at all, plus vendor agreements requiring your processors to notify you within 24 hours.
Can I store UAE user data outside the UAE?
For ordinary commercial data, transfers are permitted to jurisdictions with adequate protection or under approved contractual safeguards. Health data is the exception and carries an in-country storage requirement. Remember that backups and logs are transfers too, even when your primary database is in-region.
Is UAE law the same as GDPR?
They share structure and vocabulary but differ meaningfully. The federal law is more consent-centred, has its own notification routes and supervisory body, and its executive regulations have had an uncertain public status. DIFC and ADGM laws are closer to GDPR. Building to GDPR gets you most of the way, but it does not settle which UAE jurisdiction applies to you.
What is the difference between erasure and restriction?
Erasure deletes the data. Restriction keeps it but stops you processing it — a state most systems never model, which is why it is the right most often missing from implementations. Building erasure alone looks complete and is not.
Conclusion
Start with jurisdiction, not requirements. Whether federal, DIFC, or ADGM law governs you changes the statute, the regulator, and the obligations — and it is determined by where your entity is established.
Do not default to consent for everything. Mapping a lawful basis per processing activity is more work upfront and materially more defensible.
And build restriction alongside erasure. It is the requirement most implementations quietly skip, and the one that reveals whether compliance was designed or assumed.
Building for the UAE market? Get in touch for a free scoping conversation — including an honest answer about when you need a UAE advisor rather than a developer. See our web development and mobile app services.