The UAE runs three separate data protection regimes. Onshore and in most free zones the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies, but compliance deadlines run from executive regulations that we could not confirm as issued. The DIFC and ADGM financial free zones have their own GDPR-style laws with active regulators, registration duties and transfer rules. Separately, federal e-invoicing becomes mandatory for businesses with revenue of AED 50 million or more from 1 January 2027.
Which regime applies: onshore federal law, DIFC or ADGM
The federal Personal Data Protection Law (PDPL) has been in force since 2 January 2022. It does not apply to government data, to health data and banking or credit data that have their own protective legislation, or to companies in free zones that have their own data protection legislation. In practice this means mainland companies and most free-zone companies fall under the PDPL, while DIFC and ADGM entities follow their own zone law.
The DIFC Data Protection Law (DIFC Law No. 5 of 2020) applies to controllers and processors incorporated in the DIFC wherever they process, and to entities elsewhere that process personal data in the DIFC on an ongoing basis. The ADGM Data Protection Regulations 2021 apply to entities established in ADGM and are supervised by the ADGM Office of Data Protection. A group with a mainland operating company and a DIFC or ADGM holding or treasury entity therefore needs to map each entity to the correct regime rather than run one UAE-wide policy.1234
Federal PDPL: what is in force and what is still waiting
The PDPL makes consent the default basis for processing, with listed exceptions such as public interest and legal proceedings. Controllers must notify the federal Data Office of personal data breaches within a period the executive regulations are to set, and processors must tell the controller as soon as they become aware of a breach. The UAE Data Office was created by Federal Decree-Law No. 44 of 2021; the government portal still describes it as the body that will act as the federal data regulator.
Article 29 gives controllers and processors up to six months from the issue of the executive regulations to comply, extendable once. We could not find official confirmation that the executive regulations have been issued, so the federal compliance clock may not yet have started. Businesses should still build PDPL-aligned processes now, because the statute itself is in force and the six-month window will be short once it opens.5678
Moving data out of the UAE and between zones
Under the PDPL, personal data may leave the UAE to jurisdictions or under agreements approved by the Data Office (Article 22) or in other listed cases, including the data subject's explicit consent (Article 23). Because the Data Office has not published an adequacy list, many businesses rely on the Article 23 routes for now.
DIFC entities may transfer to a jurisdiction the Commissioner of Data Protection treats as adequate or under appropriate safeguards such as DIFC standard contractual clauses. The DIFC adequacy list includes ADGM and the Qatar Financial Centre but not the onshore UAE, so a transfer from a DIFC entity to its mainland affiliate needs safeguards. ADGM uses the same structure of adequacy, approved clauses or binding corporate rules, and limited derogations.9104
E-invoicing and other digital obligations
The Ministry of Finance's e-invoicing system applies in phases. Businesses with revenue of AED 50 million or more must appoint an accredited service provider by 30 October 2026 and go live by 1 January 2027. Businesses below that threshold must appoint a provider by 31 March 2027 and go live by 1 July 2027; government entities follow by 1 October 2027. Business-to-consumer transactions are excluded until the Minister decides otherwise.
Other digital laws sit alongside data protection: Federal Decree-Law No. 26 of 2025 on Child Digital Safety took effect on 1 January 2026 and is relevant to platforms and services used by children.111213
| Regime | Applies to | Regulator | Breach reporting | Transfers out |
|---|---|---|---|---|
| Federal PDPL (Federal Decree-Law No. 45 of 2021) | Mainland and free zones without their own data law; excludes government data and sector-regulated health and banking data | UAE Data Office (Federal Decree-Law No. 44 of 2021) | To the Data Office within a period to be set by executive regulations | Data Office-approved jurisdictions or agreements, or listed cases including explicit consent |
| DIFC Data Protection Law (DIFC Law No. 5 of 2020) | Entities incorporated in the DIFC; others processing in the DIFC on an ongoing basis | DIFC Commissioner of Data Protection | As soon as practicable | Adequate jurisdictions (list includes ADGM and QFC, not onshore UAE) or appropriate safeguards |
| ADGM Data Protection Regulations 2021 | Entities established in ADGM | ADGM Office of Data Protection | 72 hours, without undue delay | Adequacy, ADGM standard contractual clauses or binding corporate rules, limited derogations |
How it works, step by step
- Work out which revenue band applies for e-invoicing (AED 50 million or more, or below).1112Ministry of Finance
- Appoint an accredited e-invoicing service provider by the deadline for your band (30 October 2026 or 31 March 2027).1112Ministry of Finance
- Go live on the e-invoicing system by 1 January 2027 or 1 July 2027, depending on band.1112Ministry of Finance
- For a DIFC entity, file the data processing notification with the Commissioner and renew it annually.14DIFC Commissioner of Data Protection
No timings or fees are shown unless an official source states them.
Documents usually needed
- Record of processing activities mapped by entity and regime (PDPL, DIFC or ADGM)
- Privacy notices and consent records for PDPL processing
- DIFC data protection notification and annual renewal
- Standard contractual clauses (DIFC or ADGM) for transfers to the mainland or abroad
- Data breach response plan with regulator-specific timelines
- Contract with an accredited e-invoicing service provider
Common mistakes
- Assuming one UAE-wide privacy policy covers mainland, DIFC and ADGM entities alike.
- Treating a DIFC-to-mainland intra-group transfer as domestic; the DIFC does not list the onshore UAE as adequate.
- Waiting for PDPL executive regulations before doing any compliance work, when the statute is already in force.
- Missing the 72-hour breach window in ADGM because the group plan follows a looser timeline.
- Leaving e-invoicing service provider selection until the last weeks before the 30 October 2026 deadline.
When the business crosses borders
- Foreign parents receiving UAE customer or employee data need a PDPL transfer basis, often explicit consent until the Data Office approves jurisdictions.
- DIFC and ADGM recognise each other as adequate, which simplifies flows between the two financial free zones.
- Health and banking data with their own legislation fall outside the PDPL, so transfers of that data must be checked against the sector rules instead.
Questions businesses ask
Are the PDPL executive regulations in force?
We could not find official confirmation that they have been issued. The law gives businesses up to six months from their issue to comply, extendable once.7
Does the federal PDPL apply in the DIFC or ADGM?
No. It excludes free-zone companies that have their own data protection legislation; DIFC and ADGM entities follow their zone law.234
Do small businesses need e-invoicing?
Yes, in the second phase. Businesses with revenue below AED 50 million must go live by 1 July 2027, unless they make only business-to-consumer supplies, which are excluded for now.12
What this guide does not yet confirm
These points need checking with a qualified local professional in the United Arab Emirates before you rely on them.
- Whether PDPL executive regulations have been issued: no official source found; secondary sources reported them as not issued as of September 2026.
- Federal breach notification deadlines, DPO thresholds and penalty amounts depend on executive regulations and a Cabinet decision that we could not locate.
- Health data localisation rules under Federal Law No. 2 of 2019 and banking data rules of the Central Bank were not reviewed in detail.
- Cybersecurity obligations for critical infrastructure (UAE Cybersecurity Council and sector regulators) were not confirmed.
- The specific obligations of the Child Digital Safety law for platforms were not reviewed.
- Maximum fines under the DIFC and ADGM regimes were not confirmed from the official pages we opened.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
The federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, has been in force since 2 January 2022. Federal (onshore and free zones without their own data protection law).
Arabic text prevails over the English translation.
The PDPL does not apply to government data, to health data or banking and credit data that have their own protective legislation, or to companies and establishments in free zones that have their own data protection legislation. Federal PDPL scope; free-zone exclusion covers DIFC and ADGM, which have their own laws.
The DIFC Data Protection Law applies to controllers and processors incorporated in the DIFC regardless of where processing takes place, and to non-DIFC entities that process personal data in the DIFC on an ongoing basis. DIFC only (DIFC Law No. 5 of 2020); occasional processing in the DIFC by non-DIFC entities is not covered; purely personal or household activity is excluded.
The ADGM Data Protection Regulations 2021 apply to all entities established in ADGM, are supervised by the independent ADGM Office of Data Protection, and allow transfers outside ADGM on the basis of adequacy, ADGM standard contractual clauses or binding corporate rules, or limited derogations. ADGM only.
The PDPL prohibits processing personal data without the data subject's consent, subject to listed exceptions such as processing necessary to protect the public interest. Federal PDPL; other exceptions are listed in Article 4.
Under the PDPL a controller must notify the Data Office of a personal data breach within the period set by the executive regulations, and a processor must inform the controller as soon as it becomes aware of a breach. Federal PDPL. The notification period depends on executive regulations not confirmed as issued.
Controllers and processors must comply with the PDPL within no more than six months from the date its executive regulations are issued, and the Council of Ministers may extend this once for a similar period. Federal PDPL transition. Article 28 required executive regulations within six months of promulgation.
We found no official source confirming that the executive regulations have been issued. Secondary sources (DLA Piper, last modified January 2025; an industry blog updated September 2026) report them as not issued.
The UAE Data Office, affiliated with the Cabinet and established by Federal Decree-Law No. 44 of 2021, is described by the government portal as the body that will act as the federal data regulator. Federal.
The portal uses future tense; a secondary source (DLA Piper, January 2025) states the Data Office had not yet been established in practice.
The PDPL allows personal data to be transferred outside the UAE in cases approved by the Data Office, such as jurisdictions with adequate protection or agreements the UAE has joined, and in other listed cases including the data subject's explicit consent. Federal PDPL; Article 22 (Data Office-approved cases) and Article 23 (other cases).
A DIFC entity may transfer personal data outside the DIFC only to a jurisdiction the Commissioner treats as adequate or under appropriate safeguards such as DIFC standard contractual clauses or limited derogations; the published adequacy list includes ADGM and the Qatar Financial Centre but not the onshore UAE. DIFC only; DP Law 2020 Articles 26 and 27.
The page does not expressly state that the onshore UAE is inadequate; it is simply not on the list.
Businesses subject to the e-invoicing system with revenue of AED 50 million or more must appoint an accredited service provider by 30 October 2026 and implement the e-invoicing system by 1 January 2027. Federal; applies onshore and in free zones to persons subject to the system. The provider deadline was extended from 31 July 2026.
Ministry of Finance news item of 10 May 2026 confirms the extension and that the 1 January 2027 date is unchanged.
Businesses subject to e-invoicing with revenue below AED 50 million must appoint an accredited service provider by 31 March 2027 and implement the system by 1 July 2027; government entities must do so by 31 March 2027 and 1 October 2027 respectively. Federal. Business-to-consumer transactions, and persons making only such transactions, are excluded until the Minister decides otherwise (Article 5(2)). Voluntary adoption and a pilot programme started from 1 July 2026.
Federal Decree-Law No. 26 of 2025 Regarding Child Digital Safety took effect on 1 January 2026. Federal. Obligations for platforms were not reviewed.
A DIFC controller must notify the Commissioner of Data Protection of its processing, including processing of special category data and transfers to non-adequate jurisdictions, and must renew the notification annually. DIFC only. Fees per the Commissioner's table: Category I (DFSA-regulated) USD 1,250 registration and USD 500 annual renewal; Category II (non-regulated, excluding retail) USD 750 and USD 250; Category III (retail) USD 250 and USD 100. Notifying that no personal data is processed is free.
Under the ADGM Data Protection Regulations 2021 a personal data breach must be reported within 72 hours, without undue delay. ADGM only.
Source is an ADGM presentation, not the regulation text; confirm the article in the Regulations.
Questions on this topic
15 statements on data protection, cyber and digital compliance in the United Arab Emirates
