United Arab Emirates: compliance overview

Regulatory timeline: what comes next

1. 2025-07-01not final

   Current consolidation: as amended by DIFC Laws Amendment Law No. 1 of 2025 and No. 2 of 2022

   DIFC Data Protection Law 2020 and the DIFC Data Protection Regulations (including Regulation 10 on AI systems)

2. 2025-09-09

   Data Protection Regulations (Amendment No. 1) 2025 comes into force on publication

   ADGM Data Protection Regulations 2021 (Abu Dhabi Global Market)

3. 2026-09-12not final

   Verified: no Executive Regulations located on official channels; the compliance transition period and the schedule of administrative penalties still depend on them

   UAE Federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021)

Data transfer routes

• UAE cross-border transfers: federal PDPL (Arts. 22-23) and DIFC Data Protection Law (Arts. 26-27)

  Neither regime has a volume threshold. The DIFC route where adequacy is absent is Art. 27: Art. 27(1) permits a transfer to a third country or international organisation on condition that (a) the controller or processor has provided appropriate safeguards as described in Art. 27(2) and enforceable data subject rights and effective legal remedies are available; (b) one of the specific derogations in Art. 27(3) applies; or (c) the limited circumstances in Art. 27(4) apply. Article 27(2) lists the appropriate safeguards: (a) a legally binding instrument between public authorities; (b) Binding Corporate Rules subject to Art. 27(6); (c) standard data protection clauses adopted by the Commissioner in accordance with Regulations setting out a procedure for developing them; (d) an approved code of conduct under Art. 48 together with binding and enforceable commitments of the controller or processor in the third country or international organisation to apply the appropriate safeguards including as regards data subject rights; and (e) an approved certification mechanism under Art. 50 with the same binding and enforceable commitments. Article 27(3) lists the derogations: (a) explicit consent after being informed of the possible risks arising from the absence of an adequacy decision or appropriate safeguards; (b) necessity for the performance of a contract between the data subject and the controller or pre-contractual measures at the data subject’s request; (c) necessity for the conclusion or performance of a contract in the data subject’s interest between the controller and a third party; (d) necessity for reasons of Substantial Public Interest; (e) necessity or legal requirement in the interests of the DIFC, including the DIFC Bodies’ proper discharge of their functions; (f) necessity for the establishment, exercise or defence of a legal claim; (g) necessity to protect the vital interests of a data subject or others where the data subject is physically or legally incapable of giving consent; (h) a transfer made in compliance with Applicable Law and the data minimisation principle in Art. 9(1)(f) from a register intended to provide information to the public and open for viewing by the public or by anyone who can demonstrate a legitimate interest; (i) subject to Art. 28, a transfer necessary for compliance with an obligation under Applicable Law to which the Controller is subject, or made at the reasonable request of a regulator, police or other government agency or competent authority; (j) subject to international financial standards, a transfer necessary to uphold the legitimate interests of a Controller recognised in international financial markets, unless overridden by the Data Subject’s legitimate interests relating to their particular situation; and (k) a transfer necessary to comply with applicable anti-money laundering or counter-terrorist financing obligations, or for the prevention or detection of a crime. Points (i), (j) and (k) matter in practice - they cover transfers made on a regulator’s or law-enforcement request - so do not read Art. 27(3) as stopping at (h). Art. 27(6) separately bars a public authority subject to DIFC law from relying on Art. 27(3)(a), (b) or (c), or on Art. 27(4). The key open item onshore: Art. 28 requires the Council of Ministers, on the proposal of the Bureau’s Director General, to issue the Executive Regulations, and Art. 29 gives controllers and processors a fixed period from the issuance of those Regulations to regularise their position, extendable once by the Council for a similar period. Verification note: the month figures in those two articles could not be read from the text layer of the official Arabic PDF obtained in this pass (the numerals are not in extractable text), so no period is asserted here. The UAE Legislation portal returns 403 to every non-browser client, so its "Related legislations" panel could not be checked, and no Executive Regulations appear on the u.ae data protection page either. Whether the controls and stipulations delegated by the closing paragraph of Art. 23 are yet in place therefore cannot be confirmed, and the operational detail onshore remains uncertain - hence a medium confidence rating and a need to re-check the status of the Executive Regulations before relying on this entry.

  Lead time: Estimate: 3-8 weeks for the DIFC contract or BCR route; 3-6 weeks for the onshore PDPL contract route, though the status of the Executive Regulations is unconfirmed and the text may need revision once it is clear. The procedure and timing for the Bureau approval referred to in Art. 22 were not verified in this pass. · Cost band Medium