Family data and privacy

What the Personal Data Protection Law covers

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data came into force on 2 January 2022, according to the u.ae portal, which describes it as a framework for confidentiality and privacy. The law defines personal data as any data relating to an identified or identifiable person, including through a name, voice, image, identification number, electronic identifier or location. Sensitive personal data includes data that reveals a person's family, ethnic origin, religious beliefs or criminal record, biometric data such as facial images or fingerprints, and data relating to health.^[1][2]

Article 2 applies the law to controllers and processors in the UAE and to those outside the UAE who process the data of people inside it. It lists exclusions, including a data subject who processes their own data for personal purposes, personal health data that has its own legislation, and companies in free zones with their own data laws. Whether a given use of family information falls inside or outside these exclusions is a legal question that this page does not answer.^[2]

Consent, purpose and security

Article 4 states that processing personal data without the consent of its owner is prohibited, then lists exceptions, such as processing needed to perform a contract, to protect the data subject's interests, for medical purposes under existing legislation, or to meet legal obligations. Article 6 says that where processing relies on consent, the controller must be able to prove it, it must be clear, simple, unambiguous and easily accessible, and it must include the right to withdraw easily. Withdrawal does not affect the lawfulness of earlier processing.^[2]

Article 5 sets processing controls: data should be handled fairly, transparently and lawfully, collected for a specific and clear purpose, limited to what is necessary, kept accurate, kept securely, and not retained after its purpose has been exhausted unless anonymised. Article 7 requires appropriate technical and organisational security measures. Article 9 requires controllers to notify the data office of a breach and, where privacy is prejudiced, to tell the person affected. Articles 13 to 15 give individuals rights to information, to receive their data in a machine-readable form, and to correction or erasure.^[2]

Children's data in UAE law

The English text of the 2021 law read for this page contains no provision that refers specifically to children or to parental consent. Children's data is addressed instead in Federal Decree-Law No. 26 of 2025 Regarding Child Digital Safety, which the UAE Legislation portal lists as effective from 1 January 2026. It defines a child as anyone who has not completed 18 years, and a child caregiver as the person legally responsible for the child, such as a parent or guardian.^[2][3]

Article 7 of that law, subject to the personal data protection legislation, prohibits digital platforms operating in or directed at the UAE from collecting, processing, publishing or sharing the personal data of children under 13 unless stated conditions are met. These include explicit, documented and verifiable caregiver consent, a simple way to withdraw it, a clear privacy policy, access limited to authorised people, and no use of the data for commercial purposes or targeted advertising. The Cabinet is to specify permitted data and consent methods, and educational or health platforms may be exempted by resolution. Article 18 gives those covered up to one year from entry into force to comply, extendable by the Cabinet. Whether the resolutions have been issued was not confirmed.^[3]

What Apple requires of apps

Apple's App Review Guidelines, last updated on 8 June 2026, require every app to link to a privacy policy that identifies what data is collected, how it is collected and all uses of it, and explains retention, deletion and how users can withdraw consent. Apps that collect user or usage data must secure consent, offer an easily accessible way to withdraw it, and should request only data relevant to core functionality. Apps that support account creation must also offer account deletion within the app.^[4]

For children, guideline 5.1.4 says personal data from kids calls for particular care and refers to laws such as COPPA and the GDPR. Apps intended primarily for kids should not include third-party analytics or advertising, and apps that collect or can share personal information from a minor must include a privacy policy and comply with children's privacy statutes. Separately, Apple requires developers to describe their privacy practices in App Store Connect, including those of third-party partners, which appear as privacy labels on the App Store. Developers may update their answers at any time.^[4][5]

Guidance from a data protection authority

The UK Information Commissioner's Office publishes the Age appropriate design code, a set of 15 standards for online services likely to be accessed by children. It is not UAE law and is not a new law in the UK either; the ICO describes it as explaining how data protection law applies to children's use of digital services. It is cited here only as general guidance from a data protection regulator.^[6]

The code says that the best interests of the child should be the primary consideration when designing and developing online services, and the ICO describes it as rooted in the UN Convention on the Rights of the Child. Its standards include high-privacy settings by default unless there is a compelling reason otherwise, collecting and retaining only the minimum personal data, not usually sharing children's data, and switching geolocation off by default. It also says that nudge techniques should not be used to encourage children to provide unnecessary personal data or to weaken their privacy settings.^[6]

Questions