Protecting client data in the UAE

The law and its regulator

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, known as the Personal Data Protection Law (PDPL), came into force on 2 January 2022, according to the UAE government portal. The portal says it applies to the processing of personal data, in full or in part through electronic systems, inside or outside the country, and sets general obligations on companies that hold personal data to secure it and keep it confidential. The official Arabic text, linked from the portal, extends it to controllers and processors in the UAE and to those abroad that process data of people in the UAE, as the law firm Clyde & Co also reported in November 2021.^[1][2][3]

The portal says the UAE Data Office, affiliated with the UAE Cabinet, will act as the federal data regulator. It lists the Office's responsibilities as preparing data protection policies and legislation, proposing and approving monitoring standards, preparing complaint and grievance systems, and issuing guidelines and instructions for implementing the law, and it links the Office to Federal Decree-Law No. 44 of 2021. The portal page was last updated in December 2025 and still uses the future tense, so this review could not confirm from official sources how fully the Office is operating.^[1]

Controllers, processors and lawful bases

The portal says the law prohibits processing without the consent of the data owner, except in some cases. The official text lists those cases, including performing a contract with the data subject, meeting obligations under other UAE laws, employment or social security obligations, legal claims and the public interest. It requires consent to be clear, simple and unambiguous, provable by the controller and open to withdrawal at any time. Clyde & Co notes there is no general legitimate interests basis, and reads the law as requiring consent, with opt-out mechanisms, for marketing use.^[1][2][3]

The official text requires processors to act on the controller's instructions and under contracts setting the scope and purpose of processing. Where several processors take part, a written contract should define each one's role, and otherwise they are jointly responsible. Controllers and processors must keep a special record of personal data, controllers must carry out an impact assessment before using modern technologies that pose a high risk to privacy, processing must be limited to what is necessary for its purpose, and a data protection officer must be appointed in certain circumstances, who may be an employee or an authorised person inside or outside the UAE.^[2][3]

Rights of individuals

The portal says the law gives the data owner the right to request correction of inaccurate personal data and to restrict or stop processing of it. The official text, summarised in similar terms by Clyde & Co, sets out a wider set: the right to receive information from a controller, to obtain their data and have it transferred to another controller, to have data corrected or erased in defined cases, to restrict processing in certain cases, to object to processing for direct marketing or statistical surveys, and to object to decisions from automated processing with legal or serious effects.^[1][2][3]

On notices, only limited information must be given before processing: the purposes, the sectors or establishments inside or outside the UAE with which the data will be shared, and the safeguards for cross-border processing. More detail, such as the types of data processed, how to exercise rights and how to lodge a complaint, is provided on request. Controllers must also give individuals clear and appropriate means to contact them and exercise their rights. The law itself does not set penalty amounts; it leaves violations and administrative penalties to a Cabinet decision.^[2][3]

Breach notification and cross-border transfers

The official text requires a controller, on learning of a breach that would affect the privacy, confidentiality and security of personal data, to report it and the investigation results to the UAE Data Office, and to notify affected individuals, within a period and under procedures set by the executive regulations. Clyde & Co notes that, unlike the GDPR, there appears to be no materiality threshold for notifying individuals. Processors must tell the controller immediately. No deadline can be stated here, because the law leaves it to executive regulations whose current status this review could not confirm.^[2][3]

The portal says the law sets requirements for the cross-border transfer and sharing of personal data for processing. Under the official text, data may be transferred abroad in cases approved by the UAE Data Office, such as where the destination has data protection legislation covering the key safeguards. Clyde & Co said it was unclear how adequacy would be assessed. Without adequate protection, transfers may rely on grounds such as a contract, the data subject's express consent where this does not conflict with UAE public and security interests, legal claims or contract performance.^[1][2][3]

DIFC, ADGM and what was still awaited

The official text excludes companies in free zones that have their own data protection legislation, and Clyde & Co names the Dubai International Financial Centre and Abu Dhabi Global Market as examples, saying the federal law operates alongside those regimes. The government portal separately lists the DIFC Data Protection Law, DIFC Law No. 5 of 2020, and the DIFC says its Commissioner is responsible for supervising and enforcing it. ADGM announced Data Protection Regulations 2021 on 14 February 2021, replacing its 2015 regulations and establishing an independent Office of Data Protection headed by a Commissioner. Which regime applies depends on where an organisation is established, and none of these sources addresses real estate brokers specifically.^{[1][2][4][5][3]}

Several points remain open. The official text required the Cabinet to issue executive regulations within six months of the law's issue, and gives controllers and processors six months from those regulations to comply, a period the Cabinet may extend. Clyde & Co said the regulations would settle breach notification timeframes, processor procedures and exemption criteria. The government portal does not mention the regulations, and this review did not find on an official page whether or when they were issued. Readers should check the UAE Legislation portal and the UAE Data Office for the current position.^[1][2][3]

Questions