Comprehensive Privacy Law
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
United Arab Emirates · January 2, 2022 (federal law only — the DIFC and ADGM free zones run their own separate, self-contained data-protection regimes that apply only to entities registered within those specific zones, displacing rather than supplementing the federal law for them)
Verify detailsApplies to entities established in the UAE (regardless of where data subjects are located) and, extraterritorially, to entities outside the UAE that process personal data of individuals inside the UAE, including in connection with offering goods/services or monitoring behavior. Excludes government data/public entities, personal/household-use processing, and health or credit/banking data already governed by its own sector legislation; the data-protection authority (the Bureau) also has discretionary power to exempt entities that don't process large volumes of personal data.
This is a general reference, not legal advice or a determination that this law applies to your specific business. Run the full questionnaire to check against your actual presence, activities, and data types.