← Global Privacy Laws Research Library
Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data
Federal Decree-Law No. 45 of 2021: UAE Personal Data Protection Law
Prepared by Shubhank Suman · Last reviewed
CURRENT
- Legal character
- Federal decree-law
- Region
- Middle East
- Effective
- 2 January 2022
What it covers
The federal PDPL governs:
- personal-data processing
- sensitive personal data
- biometric data
- consent
- data-subject rights
- controller/processor obligations
- DPO
- security
- profiling
- automated decisions
- DPIAs
- international transfers
- complaints/enforcement.
AI, privacy and cybersecurity relevance
- AI: Very High
- Privacy: Very High
- Cyber: Very High
AI
VERY HIGH
This is one of the strongest privacy-law entries for AI because the statute expressly addresses:
- automated processing
- profiling
- human intervention
- AI-related DPIA triggers.
Cybersecurity
VERY HIGH
Article 20 is central.
Applicability
Covered processing inside the UAE and specified external processing connected with UAE activities, subject to statutory exclusions and sector-specific regimes.
Current validity
CURRENT: IN FORCE SINCE 2 JANUARY 2022. (UAE Legislation)
Read first
Articles 1, 5–6 → Article 11 → Article 18 → Article 20 → Article 21 → Articles 22–23.
Provisions / sections covered
Article 1: Definitions
Defines personal data, processing, automated processing, controller, processor, DPO and related concepts.
Personal data includes identifiers such as:
- name
- voice
- image
- ID number
- online identifier
- geographic location.
It also covers sensitive and biometric data. (Legal Advice Middle East)
Article 6: Consent
Establishes consent requirements.
Article 11: DPO
Requires a DPO in specified circumstances and gives the DPO duties including compliance oversight, complaint handling and risk-assessment advice. (Legal Advice Middle East)
Article 13 onward: Data-subject rights
Includes information/access-related rights and rights concerning processing restrictions.
Article 18: Automated processing
Provides specific protections where automated processing/profiling produces legal or significant effects.
The controller must provide appropriate privacy/confidentiality safeguards and involve human review at the data subject's request. (UAE Legislation)
Article 20: Personal-data security
Requires controllers/processors to adopt appropriate technical and organisational measures proportionate to processing risks.
The official text specifically addresses:
- confidentiality
- security
- integrity
- resilience
- recovery
- testing and evaluation. (UAE Legislation)
Article 21: DPIA
Requires an impact assessment where modern technologies create a high risk to privacy/confidentiality.
Triggers include:
- systematic/extensive automated assessment
- profiling producing legal/significant effects
- large-scale sensitive-data processing.
(Legal Advice Middle East)
Articles 22–23: Cross-border transfers
Establish transfer rules based on adequate protection and alternative safeguards/exceptions.
IMPORTANT DISTINCTION
Do not merge the federal PDPL with:
- DIFC Data Protection Law
- ADGM data-protection regime
- sector-specific UAE health/financial regulations.
These are separate legal regimes.
Subject-matter tags
- Consent
- Sensitive data
- Data subject rights
- Profiling
- Automated decision-making
- Impact assessment
- Security
- Cross-border transfers
- Data protection officer
- Controller and processor
- Biometrics
- Enforcement and penalties
- Transparency
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.