Who it applies to
Processing of personal data in the UAE outside the financial free zones (DIFC and ADGM have their own data protection laws). Government data, and health and banking data covered by their own legislation, are excluded. The law has been in force since January 2022, but its Executive Regulations had not been issued as of our last review.
Key obligations
| Requirement | What it means in practice |
|---|---|
| Breach notificationArticle 9 | Notify the UAE Data Office immediately on becoming aware of a breach that prejudices privacy, confidentiality or security, and notify affected individuals. Processors must inform the controller immediately.Detection & Response |
| Data protection officerArticles 10 and 11 | Appoint a DPO in the circumstances the law sets out, such as high-risk or large-scale sensitive processing.vCISO, GRC & Privacy |
| Impact assessmentArticle 21 | Assess the impact of high-risk processing before it starts.vCISO, GRC & Privacy |
| Cross-border transfersArticles 22 and 23 | Transfers are allowed to adequate jurisdictions or under the conditions the law sets out. |
| Banking sector | Banks and licensed financial institutions must notify the Central Bank of the UAE of significant breaches of consumer data and notify consumers at risk.Data Loss PreventionDetection & Response |
Good to know
- The law's grace period for compliance starts once the Executive Regulations are issued. Preparing now avoids a rush later.
- Critical infrastructure and government entities have separate obligations under the UAE Information Assurance Regulation and the Cyber Security Council's Critical Information Infrastructure Protection Policy (September 2025).
How we help
We translate these requirements into practical controls: a gap assessment against your current environment, then the technology, processes and evidence that close the gaps. Start with the area that matters most:
- Detection & Response: too many alerts and not enough visibility.
- vCISO, GRC & Privacy: risk and compliance live in spreadsheets.
- Data Loss Prevention: sensitive data is leaving the organisation.
- vCISO, GRC & Privacy: governance, risk management, DPIAs and DPO-as-a-service.
Sources
This summary is general information, not legal advice. Requirements change; confirm with the regulator or your legal advisers.