What Is Federal Decree by Law No. 45 of 2021 Concerning the Protection of Personal Data?
The United Arab Emirates' Federal Decree by Law No. 45 of 2021 Concerning the Protection of Personal Data is the federal Personal Data Protection Law. The UAE Government describes it as a framework for confidentiality, privacy, data governance, processing controls, and cross-border sharing. The law entered into force on 2 January 2022. The law applies to defined categories of electronic processing connected with data subjects, controllers, or processors in the UAE, including some processing by organizations outside the country. It also lists exclusions, including government data and entities, security and judicial authorities, personal-purpose processing, certain health and banking or credit data regulated by other legislation, and entities in free zones with special data-protection legislation. This page is a source-backed orientation, not legal advice. The law provides rights and complaint architecture, but the current executive-regulation position, free-zone boundaries, local-authority roles, exceptions, and a broker's applicable route require separate fact-specific review. It does not establish one universal data-broker form or guarantee removal.
At a glance
- Full name
- Federal Decree by Law No. 45 of 2021 Concerning the Protection of Personal Data
- Short code
- UAE PDPL
- Jurisdiction
- United Arab Emirates
- Enacted
- 2021
- Last major update
- Entered into force on 2 January 2022; executive-regulation, free-zone, and local-authority interactions remain open review items
- Regulator
- UAE Data Office
- Private right of action
- Limited
- Statutory citation
- Federal Decree by Law No. 45 of 2021
Scope, who UAE PDPL covers
Protected data
Data subject rights
Right to obtain information about personal-data processing and decisions based on that processing
Right to request transfer of personal data to another controller when technically feasible
Right to request correction or completion of inaccurate personal data without undue delay
Right to request erasure when the statutory conditions apply, subject to legal and public-interest exceptions
Right to restrict processing in the circumstances described by Article 16
Right to stop processing for direct marketing, certain statistical surveys, or processing that violates the law's controls
Right to object to certain decisions based on automated processing, including profiling
Right to submit a complaint to the UAE Data Office when the data subject believes the law or its procedures have been violated
Notable features
The federal framework combines purpose, minimization, accuracy, security, retention, cross-border, data-protection-officer, breach, automated-processing, and complaint provisions. It also expressly separates some government, sectoral, and special-free-zone regimes, so a federal-law summary should not be treated as a complete statement of every privacy rule operating in the UAE.
Enforcement & penalties
Regulator: UAE Data Office
Penalties: Article 26 provides that the Council of Ministers will issue a decision identifying violations and the administrative penalties for breaches of the law and its executive regulations. This explainer does not state a monetary amount because a current penalty schedule and its application were not established in the bounded source review.
Private right of action: The reviewed law expressly provides a complaint route to the UAE Data Office and a grievance route against the Office's decisions. This explainer does not assert a broad standalone damages action under the federal law; private remedies and court routes require case-specific UAE legal advice.
Relevance to data brokers
A data broker or marketing intermediary may fall within the law when its controller or processor relationship and processing activity meet the federal scope rules. The official text supports requests for correction, erasure, restriction, and direct-marketing cessation in the stated circumstances, but a public listing alone does not prove applicability or a guaranteed deletion result. Identify the current controller, use its current privacy or data-protection contact, preserve delivery evidence, and use the Data Office complaint route if the official procedure is available for the situation.
Exercise your rights
Review removal workflows for 1009 US/global profiles for $9
OfflistMe helps draft opt-out requests using the details you choose. Review the provider route and legal basis, then send from your own inbox. The tool is not legal advice and does not guarantee a broker's response.
Request Removal NowFAQ
What is the UAE Personal Data Protection Law?+
Federal Decree by Law No. 45 of 2021 is the UAE's federal Personal Data Protection Law. The UAE Government describes it as a framework for personal-data governance, confidentiality, processing controls, data-subject rights, and cross-border transfers. It entered into force on 2 January 2022.
Who can the UAE PDPL apply to?+
Article 2 covers specified processing by data subjects, controllers, and processors connected with the UAE, including some processing by organizations outside the UAE involving data subjects inside the country. The article also lists exclusions and special free-zone boundaries, so applicability must be assessed from the controller, processing purpose, location, sector, and applicable local law.
What rights does the UAE Personal Data Protection Law provide?+
The official text includes rights relating to information, data transfer, correction, erasure, restricted processing, stopping processing, automated decisions, contacting a controller, and complaints. Each right has conditions or exceptions, so it should be framed around the specific processing and current statutory text.
Can I ask a UAE data broker to delete my information?+
You can ask the controller to correct or erase personal data when the conditions in Article 15 apply, subject to its exceptions. The federal law does not create one universal people-search opt-out form, and finding a listing online does not by itself establish that the controller is subject to every provision or that deletion will be granted.
Can I stop direct marketing under the UAE PDPL?+
Article 17 gives a data subject a right to object to and stop processing when it is intended for direct marketing, including related profiling, subject to the law's conditions. Use the controller's current privacy or marketing-preference route and retain proof of the request.
How can I complain about personal-data processing in the UAE?+
Article 24 gives a data subject the right to submit a complaint to the UAE Data Office when the person believes the law or the Office's procedures have been violated. The official government overview says the Data Office is responsible for complaint and grievance systems; check its current official procedure before submitting because a general law page is not a live complaint form.
Does the federal UAE law cover every free zone?+
No blanket conclusion should be made. Article 2 excludes companies and establishments in free zones that have special personal-data-protection legislation, and the UAE Government separately identifies laws such as the DIFC data-protection law. Check the controller's free-zone establishment and the applicable local or sectoral framework.
Is the UAE Personal Data Protection Law currently fully reviewed here?+
No. This page is intentionally noindex while the current executive regulations, penalty schedule, local and free-zone interactions, complete exceptions, complaint procedure, official-language control, and broker-specific routes remain open review items. The cited official sources support the bounded statements shown on this page.
Official sources & citations
Other international privacy regimes
UAE PDPL sits in a global ecosystem of data-protection laws. Compare with other jurisdictions that shape cross-border data flows: