UAE Personal Data Protection Law (PDPL)

Yes, where they process the personal data of data subjects inside the UAE. The law reaches controllers and processors located outside the country, so a group handling UAE customer or employee data from another jurisdiction is in scope and needs to be able to demonstrate compliance.

Structurally similar and operationally different. Both are consent and rights based, both require records, breach handling and accountability, and both reach beyond their borders. The differences that matter in practice are the supervisory authority, the specific transfer conditions, the thresholds for appointing a data protection officer, and the notification timelines. A mature GDPR programme is a strong starting point but not a substitute.

No. Entities established in DIFC apply the DIFC Data Protection Law and answer to the DIFC Commissioner of Data Protection. ADGM works the same way with its own regime. A group with entities inside and outside the free zones ends up running one programme against two regimes, which is workable provided the mapping is explicit.

Only where the processing warrants it: high-risk processing, systematic profiling or automated decision-making, or sensitive personal data at scale. Where the obligation applies, the officer’s contact details go to the UAE Data Office and must be available to data subjects. Many organisations appoint one regardless, because it gives customer assurance questionnaires a clear answer.

To a jurisdiction the UAE treats as offering adequate protection, or on the basis of one of the alternative conditions the law provides, principally contractual safeguards binding the recipient, or the explicit consent of the data subject where that is genuinely free and informed. Two practical points: the adequacy position and the approved contractual wording are set through regulations issued under the law rather than by the law itself, so verify the current text, and an intra-group transfer is a transfer, which is the exemption groups most often assume incorrectly.

Controllers notify the UAE Data Office, and affected individuals where the breach threatens their privacy or the security of their data, with a description of the breach and its likely effects. The specific notification window is fixed by the Executive Regulations rather than by the decree-law, and published summaries of that timing contradict each other, so confirm the current requirement before writing it into a playbook. Build the process to detect, assess and escalate within hours regardless, because the reporting clock is never the binding constraint in practice.

Yes. Employees are data subjects, and HR processing tends to be the highest-risk personal data an organisation holds: health information, disciplinary records, background screening, payroll and, increasingly, monitoring data. Consent is a weak basis in an employment relationship because it is rarely freely given, so employment processing usually needs to rest on contractual necessity or legal obligation instead.

Enough to demonstrate compliance rather than assert it: what personal data you hold, why, on what lawful basis, who it is shared with, where it goes, how long it is kept, and what protects it. Controllers and processors both carry record-keeping duties. The record is also the artefact every other obligation depends on, since you cannot answer an access request, scope a breach, or assess a transfer against data you have not inventoried.