EdLaw
Dubai — KHDA private-school data and technology requirements (research note: no dedicated instrument)
This note records a search, made on 2026-10-08, for a data-protection, privacy, digital or technology instrument that the Knowledge and Human Development Authority (KHDA) imposes on Dubai's private schools and, through them, on their suppliers. None was found. Abu Dhabi has one: ADEK's School Digital Policy. KHDA's published legislation for private schools contains no counterpart.
What was searched
- KHDA's legislation index for private schools (web.khda.gov.ae — Private Schools Regulations), which links every resolution KHDA lists for private schools. The fifteen PDFs linked there were downloaded and searched for "personal data", "data protection", "privacy", "confidential", "technology", "digital", "electronic" and "cyber". None of them is a data-protection or technology instrument. The hits are listed below.
- Web searches for a KHDA data-protection policy, privacy policy, student-data policy, or digital-learning or technology requirements that bind schools or edtech suppliers. These returned schools' own privacy notices (which name KHDA as a recipient of student data) and press reports, but no KHDA instrument.
What the private-school legislation does say
- Executive Council Resolution No. (2) of 2017 Regulating Private Schools in the Emirate of Dubai (PDF). This is the framework instrument. Article (13) lists the obligations of a private school. Its items 21 and 22 concern records and data: schools must create and keep records of their students, staff and finances for the period KHDA prescribes, and must enter student and staff data on KHDA's system and keep it updated. Item 37 requires schools to integrate information technology into the educational process. Schedule (2) to the resolution fines failures under items 21 and 22 (its entries 37 and 38) at AED 50,000 each. Article (4), item 16, gives KHDA the function of building a database of private schools, their staff and their students. The resolution sets no rule on how schools protect personal data or select and contract with technology suppliers.
- Administrative Resolution No. (23) of 2026 (PDF, issued 7 April 2026). It lists the violations of Resolution 2/2017 that require a written warning before a fine is imposed. Item 7 is failure to provide data to KHDA, and item 10 is delay in entering transferred students' details "into the relevant system". No data-protection violation appears.
- Administrative Resolution No. (41) of 2026 on educational permits for private schools (PDF). The schedule of what a permit application must contain (item 10) includes a list of policies the school will implement, among them an "information technology policy". The school writes that policy; KHDA does not prescribe its content.
The English texts are translations by Dubai's Supreme Legislation Committee. Each states that in case of conflict the Arabic text prevails.
Not yet in force
Press reports from October 2026 (e.g. The National, 2026-10-01; press, not a definitive source) say KHDA will issue a policy on artificial intelligence and device use in private schools in 2027. Nothing has been published, so there is no text. Collect it from the legislation index when it appears.
Where Dubai schools' data duties do come from
The federal Personal Data Protection Law (Decree-Law 45/2021). Schools in a Dubai free zone that has its own data-protection law are outside it under PDPL article 2, and governed instead by that zone's law (e.g. DIFC Data Protection Law No. 5 of 2020, not in this corpus). For a supplier, the practical layer is the school's contract and its own published policies.
Licence
The corpus reproduces no text here except short identifying phrases (titles and two quoted words). This README is the corpus's own research note, and the label describes it, not the resolutions it cites. Dubai legislation's English texts are published "©2017 The Supreme Legislation Committee in the Emirate of Dubai" (and ©2026 for the 2026 resolutions). If any of them is extracted, its terms must be read first.
Related
- ADEK Digital & Records Policies — Abu Dhabi's school data and technology rules
- AE PDPL — the federal data-protection law