UAE PDPL, in plain English: what Federal Decree-Law No. 45 actually requires

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data came into force on 2 January 2022, establishing the UAE's first comprehensive federal data protection framework and creating the UAE Data Office as the federal regulator. For most organisations operating in the UAE mainland, it is now the primary reference point for how personal data must be collected, processed, stored and transferred.

In practice, the law obliges organisations to establish a lawful basis for processing, honour data subject rights including access, correction and erasure, implement appropriate technical and organisational security measures, and observe specific requirements around cross-border data transfer. None of that is unusual by global standards — what matters is how it is enforced locally, and how it interacts with sector-specific rules such as those governing healthcare data and financial services.

The organisations that struggle are rarely the ones unaware the law exists. They are the ones who treated the compliance exercise as a one-time policy drafting project rather than an operating capability — and then found themselves unable to actually respond to a real data subject request, or explain their data flows during a review.

Certus works with organisations to translate PDPL's obligations into the specific workflows, ownership and evidence that hold up under scrutiny — not just a policy binder that looks complete on the shelf.