Founding-customer offer:25% off your first year on annual plans confirmed before 31 March 2027.Talk to us
UAE · PDPL
UAE PDPL: map your personal data and show you're in control.
The law is in force and its implementing regulations are awaited. Prepare against the obligations as issued.
Talk to a specialist first — we set up your workspace with you.
Or try the free risk checkWhat you have to do
Where the UAE PDPL obligations land.
- 01
Establish a lawful basis for each processing activity — mainly consent, with the law’s other permitted grounds where they apply.
UAE PDPL - 02
Give clear notice of what is collected, why, and who it is shared with.
UAE PDPL - 03
Honour data subject rights, including access, correction, erasure, restriction and objection, within the law’s timeframes.
UAE PDPL - 04
Notify the UAE Data Office of a personal data breach without delay, and inform affected individuals where the law requires it.
UAE PDPL
Source: UAE Federal Decree-Law No. 45 of 2021 — see /frameworks/uae-pdpl for the full list of requirements.
How Risknox handles it
Fortress holds the records each obligation depends on.
Data inventory
Where UAE personal data sits, by system and owner, from machines that connect or manual upload.
Processing records (RoPA)
Every processing activity, with the lawful basis recorded against it.
Consent
Notices and consent records, kept so the basis you rely on can be shown.
Rights requests
Access, correction, erasure and objection, each with a due date.
What it costs
Talk to us for pricing.
Pricing depends on the programs you run and the number of seats. We scope it on a short call.
Book a 20-minute walkthroughBook a walkthrough
Twenty minutes on your UAE data map.
We look at what UAE personal data you hold, the basis you rely on for each activity, and what to evidence before the regulations land.
Questions we get asked
Is the UAE PDPL in force?+
The law is in force. Its implementing regulations are still awaited, which is why organisations are preparing now: the obligations are set by the law as issued, and the procedural detail will follow in the regulations.
Does the UAE PDPL apply to companies outside the UAE?+
It can. The law covers processing of personal data of people in the UAE, including by controllers outside the country. Where it applies, the obligations travel with the data.
Which data falls outside the UAE PDPL?+
Government data, and health, banking and credit data covered by their own sector laws. Entities established in the DIFC and ADGM are also outside it, because those free zones have their own data protection laws.
What about transfers outside the UAE?+
The law places conditions on transfers of personal data outside the UAE and expects the basis for each transfer to be recorded. Fortress keeps the record with the processing activity it belongs to.