language: en · source language: ar · status: in-force · last checked: 2026-09-20

UAE — Personal Data Protection Law (Federal Decree-Law 45/2021)

The UAE's federal privacy law — issued 20 September 2021, published in Official Gazette 712 (supplement) on 26 September 2021, in force 2 January 2022 (المادة 31), supervised by the UAE Data Office (مكتب الإمارات للبيانات). GDPR-shaped in outline: consent-centric bases, data-subject rights, breach notification, DPO, DPIA, and transfer rules keyed to adequacy or safeguards. 31 articles.

Statute text is Arabic (the authentic language); this README is curation.

Applicability to EdTech

• Two things a GDPR-trained reader will expect and will not find. The decree-law contains no provision on minors — no age of digital consent, no guardian-consent mechanism, nothing (searched: قاصر، صغير، ولي الأمر، أهلية، سن). And it sets no fines: المادة 26 leaves both the list of violations and the administrative penalties to a Cabinet resolution. Anyone carrying a "guardian consent applies" assumption into a UAE deal is carrying it from somewhere other than this statute. (This README asserted exactly that until 2026-09-20, on a summary; the text does not support it.)
• The compliance clock is tied to regulations that the portal does not list. المادة 28 required the Executive Regulations within six months of issuance, and المادة 29 gives controllers and processors six months from the issuance of those regulations to bring themselves into conformity, extendable once. As at 2026-09-20 a search of the official portal in Arabic returns no Executive Regulations for this decree-law — so on the face of the statute the conformity period has not started running. Treat that as an observation about the official index, not as advice; the substantive duties in articles 5–23 are in force regardless.
• Free zones are carved out, but conditionally. المادة 2 excludes companies in UAE free zones that have their own personal-data legislation — which is what leaves DIFC (DP Law 5/2020) and ADGM (DPR 2021) governing inside those zones. Also outside scope: government data and government entities (أ–ب), security and judicial bodies (ج), health data and banking/credit data already covered by their own legislation (ه–و). A public-school deal may therefore fall outside this law and inside the emirate's own rules.
• Extraterritorial reach (المادة 2): a controller or processor located outside the UAE that processes the personal data of data subjects inside it is caught.
• Transfers: المادة 22 is the adequacy route (Data Office-approved jurisdictions, or treaty), المادة 23 the derogations — contractual undertakings where the destination has no data-protection law, explicit consent, contractual necessity, and so on.
• DPO is risk-triggered, not size-triggered (المادة 10): high risk to confidentiality and privacy, systematic and comprehensive evaluation of sensitive data including profiling, or large-scale processing of sensitive data.
• Breach notification to the Data Office (المادة 9) and DPIA (المادة 21) track the GDPR pattern closely enough to reuse GDPR artefacts as a starting point — but note that article 9 fixes no deadline: the period, procedure and conditions are all left to the Executive Regulations. There is no UAE equivalent of "72 hours" to design to.
• School regulators layer on top: ADEK (Abu Dhabi) requires its private and charter schools to vet edtech vendors, to tell them they are bound by this law (Digital Policy 5.5.2), and to bar contractors from sharing personal data without ADEK's explicit consent (7.1.3.a). KHDA (Dubai) has published no comparable instrument (research note).

Contents

Currency

The portal prints حالة التشريع: ساري (Legislation State: Active) and the builder's verify fails the moment that changes or the article roll moves. No amending instrument is listed against it.

Enforcement

UAE Data Office (مكتب الإمارات للبيانات), established by Federal Decree-Law 44/2021. Complaints under المادة 24; appeals against Data Office decisions under المادة 25.

Licence

The corpus reproduces the authentic Arabic text of Federal Decree-Law No. 45 of 2021 from the official UAE legislation portal (uaelegislation.gov.ae).

UAE copyright law places official documents, including the texts of laws, outside its protection. Article 3(2) of Federal Decree-Law No. 38 of 2021 on Copyright and Neighbouring Rights (بوابة التشريعات الإماراتية — مرسوم بقانون اتحادي بشأن حقوق المؤلف والحقوق المجاورة, the authentic Arabic text, read 2026-10-01 in a rendering browser because the portal refuses other clients) provides: "لا تشمل الحماية ما يأتي: [...] 2. الوثائق الرسمية أياً كانت لغتها الأصلية، أو اللغة المنقولة إليها، مثل نصوص القوانين واللوائح والقرارات والاتفاقيات الدولية والأحكام القضائية، وأحكام المحكمين والقرارات الصادرة من اللجان الإدارية ذات الاختصاص القضائي." The article ends by protecting collections of such documents only where their selection or arrangement is original ("ومع ذلك تتمتع مجموعات ما ورد في البنود (2)، (3)، (4) من هذه المادة بالحماية إذا تميز جمعها أو ترتيبها أو أي مجهود فيها بالابتكار."); the corpus takes the decree-law's own text, not a third party's compilation.

The portal's terms and conditions (uaelegislation.gov.ae/en/legal/terms-and-conditions, read 2026-10-01) regulate security and misuse of the site and contain no restriction on reusing legislation; the footer reads "Copyright © 2026 Ministry of Cabinet Affairs. All rights reserved.", a notice on the website that does not reach texts article 3(2) excludes. The English page linked from Sources is an official translation, which article 3(2) also covers, but the corpus cites it and does not reproduce it.

Conditions: none attach to the statute text, because no copyright subsists in it. The corpus still identifies its source: each fact document names its source in its opening citation line and in its Meta section, and Sources here links the official text (the UAE legislation portal). The changes (the selection of provisions, the Markdown layout and the added anchors) are described in Meta. The corpus does not claim that the publisher endorses it, and only the officially promulgated text is authentic.

Related

• EU GDPR — the pattern this law follows in outline and departs from on minors and penalties
• ADEK Digital & Records Policies — Abu Dhabi's school-level data and technology rules, which require compliance with this law
• KHDA school data (research note) — Dubai: no comparable KHDA instrument found

Sources

• بوابة التشريعات الإماراتية — مرسوم بقانون اتحادي رقم (45) لسنة 2021 — the authentic Arabic text
• The same page in English — an official translation the portal itself disclaims in favour of the Arabic
• u.ae — Data protection laws overview
• KHDA (khda.gov.ae) · ADEK (adek.gov.ae)