UNITED ARAB EMIRATES Law and Practice Contributed by: Yasser Omar and Laryssa Perkins, Hadef & Partners LLC
• Federal Decree-Law No 45 of 2021 Concern - ing the Protection of Personal Data (PDPL): The PDPL regulates the processing of personal data in the UAE, with a focus on ensuring transparency, data subject rights, and data security. Based on many of the principles set out in the General Data Protection Regulation (GDPR), it applies to entities processing data of individuals residing in the UAE, regardless of where the processing entity is locat - ed, so it can have extraterritorial effects if a foreign company processes the personal data of individu - als in the UAE. • The DIFC Data Protection Law, DIFC Law No 5 of 2020 (the “DP Law”): The DP Law operates in the DIFC and, like the PDPL, is based closely on the GDPR. • The ADGM Data Protection Regulations 2021: These Regulations, again based on the GDPR, govern data protection within the ADGM.
While the PDPL is in force, it is not yet being enforced. It is necessary for the implementing regulations to be issued first (and as of November 2025 were still pend - ing). After this, there will be a six-month grace period for entities to whom the PDPL applies to take steps to ensure compliance. Information such as financial penalties for breaches is not yet known. These will be set out in the implementing regulations. For the DP Law and the ADGM Data Protection Regulations 2021, there are significant potential financial penal - ties (from USD10,000 to USD100,000 in the DIFC and up to USD28 million in the ADGM). Application of a multiplier penalty for particularly egregious breaches is possible. On a practical level, the similarities between the GDPR and the PDPL are such that, notwithstanding that the implementing regulations have not yet been issued, many entities are structuring their data protection poli - cies and procedures to be in place now and, where necessary, adapted when the implementing regula - tions are issued.
657 CHAMBERS.COM
Powered by FlippingBook