Does the UAE Personal Data Protection Law apply to companies outside the UAE?

The UAE Government Portal states that the provisions of Federal Decree-Law No. 45 of 2021 apply to the processing of personal data, whether in full or in part, through electronic systems, inside or outside the country. The law came into force on 2 January 2022 and the UAE Data Office, established under Federal Decree-Law No. 44 of 2021, acts as the federal regulator.

Is a single privacy policy enough for a mainland and DIFC group?

Only if it addresses both regimes. Article 6(3) of DIFC Law No. 5 of 2020 applies that law to a controller or processor incorporated in the DIFC wherever the processing occurs, and to any controller or processor processing personal data in the DIFC as part of stable arrangements. Its Article 10 list of lawful bases is a separate framework from the consent-led approach described for Federal Decree-Law No. 45 of 2021.

Can a UAE business rely on consent for marketing?

Consent is the general rule under Federal Decree-Law No. 45 of 2021, which the UAE Government Portal describes as prohibiting processing without the owner's consent except where necessary to protect a public interest or carry out legal procedures and rights. Marketing needs a second check, because Federal Law No. 15 of 2020 on Consumer Protection protects consumer data and prohibits suppliers from using it for marketing.

Privacy Policy in the UAE

A UAE privacy policy usually has to answer to more than one regime. Federal Decree-Law No. 45 of 2021 is the onshore baseline, in force since 2 January 2022, reaching processing carried out inside or outside the country and prohibiting processing without the data subject's consent outside defined exceptions. The DIFC applies DIFC Law No. 5 of 2020, which has its own extraterritorial reach and its own list of lawful bases, and health data has a separate federal instrument that expressly covers free zones.

Download the UAE drafting checklist (.docx)Where to read UAE law

Governing law

Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data is the federal framework, supervised by the UAE Data Office established under Federal Decree-Law No. 44 of 2021. The DIFC applies Data Protection Law, DIFC Law No. 5 of 2020.

Data protection laws, UAE Government Portal (updated 4 December 2025)

What a privacy policy has to contain in the UAE

The Personal Data Protection Law applies to the processing of personal data, in full or in part, through electronic systems, inside or outside the country. It came into force on 2 January 2022.
Data protection laws (Federal Decree-Law No. 45 of 2021), UAE Government Portal
The law prohibits the processing of personal data without the consent of its owner, except in cases where processing is necessary to protect a public interest or to carry out legal procedures and rights.
Data protection laws (Federal Decree-Law No. 45 of 2021), UAE Government Portal
The law gives the data owner the right to request correction of inaccurate personal data and to restrict or stop the processing of his personal data, and it sets requirements for cross-border transfer and sharing of personal data for processing purposes.
Data protection laws (Federal Decree-Law No. 45 of 2021), UAE Government Portal
The UAE Data Office, established under Federal Decree-Law No. 44 of 2021 and affiliated with the Cabinet, acts as the federal data regulator, preparing policies and legislation, approving monitoring standards, running complaints and grievance systems and issuing implementation guidelines.
Data protection laws (UAE Data Office and Federal Decree-Law No. 44 of 2021), UAE Government Portal
The DIFC law applies to processing by a controller or processor incorporated in the DIFC regardless of where the processing happens, and to a controller or processor wherever incorporated that processes personal data in the DIFC as part of stable arrangements rather than on an occasional basis.
Data Protection Law, DIFC Law No. 5 of 2020 (Consolidated Version, March 2022), Art. 6(3)
In the DIFC, processing needs one of the lawful bases in Article 10, which include consent complying with Article 12, necessity for performance of a contract to which the data subject is a party or pre-contractual steps at his request, compliance with applicable law, protection of vital interests, and defined DIFC Body functions.
Data Protection Law, DIFC Law No. 5 of 2020, Art. 10

What catches drafters out

Consumer data has a second statute. Federal Law No. 15 of 2020 on Consumer Protection protects consumer rights including consumer data and prohibits suppliers from using it for marketing, so a policy that relies on a general consent for marketing needs to be checked against it.
Data protection laws (Federal Law No. 15 of 2020 on Consumer Protection), UAE Government Portal
Health data is carved out separately. Federal Law No. 2 of 2019 Concerning the Use of Information and Communication Technology in Health Fields regulates ICT in the health care sector in the UAE including its free zones, so a free zone entity handling health data is not outside the federal regime.
Data protection laws (Federal Law No. 2 of 2019), UAE Government Portal