Its formal name is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and the UAE Data Office is the designated regulator. Consent has to be clear, specific and unambiguous, and people can withdraw it, see and correct their data, ask for it to be deleted and object to its use for direct marketing, including profiling. Transfers abroad are allowed to countries with adequate protection, and otherwise only in set cases, such as the person’s explicit consent.
Two things set it apart from GDPR. It does not apply in the financial free zones, where the DIFC and ADGM have their own data protection laws, or to health and banking data, which sector rules cover. And by September 2026, neither its executive regulations, which fill in the details, nor the Cabinet decision setting the penalties had been issued. Once the regulations are out, organisations get six months to comply, so it makes sense to build consent and data practices to the law’s standard now.
