What Is UAE PDPL? Federal Decree by Law No. 45 of 2021 Concerning the Protection of Personal Data

Federal Decree by Law No. 45 of 2021 is the UAE's federal Personal Data Protection Law. The UAE Government describes it as a framework for personal-data governance, confidentiality, processing controls, data-subject rights, and cross-border transfers. It entered into force on 2 January 2022.

Article 2 covers specified processing by data subjects, controllers, and processors connected with the UAE, including some processing by organizations outside the UAE involving data subjects inside the country. The article also lists exclusions and special free-zone boundaries, so applicability must be assessed from the controller, processing purpose, location, sector, and applicable local law.

Articles 13 through 19 of the official text cover information, data transfer, correction, erasure, restricted processing, stopping processing, automated decisions, and contacting a controller. Article 24 provides a complaint right, and Article 25 provides a written grievance route against specified Bureau actions within 30 days of notification. Each right has conditions or exceptions, so it should be framed around the specific processing and current statutory text.

You can ask the controller to correct or erase personal data when the conditions in Article 15 apply, subject to its exceptions. The federal law does not create one universal people-search opt-out form, and finding a listing online does not by itself establish that the controller is subject to every provision or that deletion will be granted.

Article 17 gives a data subject a right to object to and stop processing when it is intended for direct marketing, including related profiling, subject to the law's conditions. Use the controller's current privacy or marketing-preference route and retain proof of the request.

Article 24 gives a data subject the right to submit a complaint to the Bureau when the person believes the law or applicable Bureau rules have been violated. Article 25 separately provides a written grievance to the Bureau’s General Director within 30 days after notice of a Bureau decision, administrative penalty, or other action, while leaving the grievance procedure to the Executive Regulations. A current public federal filing mechanism was not located, so check the latest official instructions before submitting; TDRA’s listed services are not a confirmed federal PDPL complaint route.

No blanket conclusion should be made. Article 2 excludes companies and establishments in free zones that have special personal-data-protection legislation. The reviewed partial map includes DIFC, ADGM, Dubai Healthcare City, the Dubai Data Law No. 26 of 2015 overlay, and a federal health-ICT overlay; it is not an authoritative comprehensive list of every UAE free zone or sectoral regime. Check the controller's establishment and the applicable local or sectoral framework.

No. This page is intentionally noindex while the current federal executive regulations, Article 26 penalty instrument, public complaint mechanism, complete free-zone map, local interactions, exceptions, official-language control, and broker-specific routes remain open review items. The 14 June 2026 Cabinet announcement describes a planned Artificial Intelligence and Data Authority transition, but its public operational procedure was not located.