EdLaw
UAE — Personal Data Protection Law (Federal Decree-Law 45/2021) (citation stub — statute text pending)
The UAE's federal privacy law (issued 20 September 2021, in force 2 January 2022), supervised by the UAE Data Office. GDPR-inspired: consent-centric bases, data-subject rights, breach notification, cross-border transfer rules keyed to adequacy or safeguards. Free-zone regimes (DIFC DP Law 5/2020, ADGM DPR 2021) apply instead within those zones.
Why a stub
Every machine door failed 2026-09-06: uaelegislation.gov.ae and ai.gov.ae return WAF 403s to non-browser clients, and the official Arabic PDF on u.ae (a Dubai Judicial Institute edition) extracts with glyph-order corruption (visual-order Arabic, e.g. "نرش" for "نشر") that fails the verbatim bar. Complete via a browser-saved copy of the uaelegislation.gov.ae text (AR authentic + official EN translation), like the Romania stubs.
What it covers (from official summaries — verify against the text when extracted)
- Applies to processing of UAE residents' data including by controllers abroad targeting the UAE; government data, and the DIFC/ADGM free zones, are outside scope.
- Consent is the primary basis with limited alternatives; processing a minor's data runs through guardian consent (no fixed digital-consent age published).
- Cross-border transfers need an adequate jurisdiction or contractual safeguards (arts. 22–23).
- Executive regulations operationalise the law — check the UAE Data Office for their current status before relying on detail.
- School regulators layer on top: KHDA (Dubai) and ADEK (Abu Dhabi) impose their own school-data and safeguarding requirements through licensing/inspection frameworks — procurement-level documents, collect when a UAE tender lands.
Sources (citations)
- u.ae — Data protection laws overview (links the official Arabic PDF)
- uaelegislation.gov.ae — legislation 1455 (browser-only)
- KHDA (khda.gov.ae) · ADEK (adek.gov.ae)