UAE PDPL Compliance with ConsentX

Exemptions from the federal UAE PDPL

The federal law contains important exclusions.

The PDPL does not apply to certain categories, including:

• Government data
• Government entities controlling or processing personal data
• Personal data held by security and judicial authorities
• A Data Subject processing personal data for personal purposes
• Certain personal health data covered by specific legislation
• Certain banking and credit data covered by specific legislation
• Companies and establishments located in free zones that have special legislation governing personal-data protection

Businesses should therefore identify which UAE privacy regime applies before designing their compliance programme.

UAE PDPL and DIFC / ADGM

The UAE does not operate one single privacy regime for every organisation.

The federal PDPL is separate from the data-protection frameworks of the Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM), which are distinct regimes.

An organisation with entities in mainland UAE, DIFC and ADGM should therefore map processing activities and compliance obligations separately for each entity.

What is personal data under the UAE PDPL?

The PDPL defines personal data broadly as information relating to an identified natural person or a natural person who can be identified directly or indirectly.

Examples can include:

• Name
• Identification information
• Voice
• Image
• Location information
• Online identifiers
• Contact details
• Account information
• Device-related information
• Employment information
• Other information capable of identifying an individual

The law therefore covers significantly more than traditional identity documents.

What is processing?

Processing covers activities performed on personal data, including activities such as:

• Collection
• Recording
• Organisation
• Structuring
• Storage
• Adaptation
• Modification
• Retrieval
• Consultation
• Use
• Disclosure
• Transmission
• Dissemination
• Combination
• Restriction
• Erasure
• Destruction

Website owners should therefore treat analytics, advertising, customer-management, personalisation and other digital activities as potentially relevant processing activities where personal data is involved.

Lawful processing under the UAE PDPL

The UAE PDPL establishes consent as an important basis for processing but also identifies circumstances where processing may take place without consent.

The law allows processing in specified situations, including circumstances involving:

• Contractual necessity
• Legal obligations
• Public interest
• Judicial or legal procedures
• Protection of the Data Subject's interests
• Protection of public health
• Protection of national security or public order
• Employment and social-protection obligations in specified circumstances
• Where the Data Subject has made the information public
• Archiving
• Scientific, historical or statistical purposes where the statutory conditions are satisfied
• Other circumstances recognised by the law

Therefore, a business should not automatically treat consent as the legal basis for every processing operation. The correct approach is to identify the purpose of processing and determine the applicable legal basis.

Consent requirements under the UAE PDPL

Where consent is required, the law defines consent as a clear, specific and unambiguous indication that the Data Subject accepts processing through a clear positive statement or action.

A compliant consent mechanism should therefore avoid:

• Pre-selected consent
• Ambiguous wording
• Hidden consent
• Bundled unrelated purposes
• Silence as consent
• Consent obtained without adequate information
• Interfaces that make withdrawal unnecessarily difficult

A practical consent record should establish:

• Who gave consent
• When consent was given
• What information was presented
• Which purpose was accepted
• Which processing activity was covered
• What version of the privacy notice or consent interface applied
• Whether consent was later withdrawn

Specific and informed consent

Consent should be sufficiently specific to the processing activity.

For example, a business may separately process data for:

• Account management
• Service delivery
• Analytics
• Advertising
• Personalisation
• Product improvement
• Marketing
• Third-party sharing
• AI or profiling

Where consent is relied upon, the organisation should determine whether separate choices are appropriate rather than placing unrelated purposes under one generic permission.

Withdrawal of consent

The PDPL provides individuals with rights concerning their personal data and establishes controls around consent.

Where processing relies on consent, organisations should provide a practical mechanism through which a Data Subject can withdraw that consent.

A withdrawal mechanism should be:

• Easy to locate
• Understandable
• Accessible
• Consistent with the original consent experience
• Connected to the systems that rely on the consent decision

ConsentX can support this website-level preference-management layer.

Transparency and privacy notices

Organisations should provide Data Subjects with appropriate information about their processing activities.

A privacy notice should explain relevant information such as:

• Identity of the Controller
• Contact information
• Categories of personal data collected
• Purpose of processing
• Legal basis
• Data-sharing arrangements
• Recipients
• Retention practices
• International transfers
• Data-subject rights
• How rights can be exercised
• Relevant contact details for privacy enquiries

The notice should be presented in a manner that allows individuals to understand the processing before making relevant choices.

Data-subject rights under the UAE PDPL

The UAE PDPL gives Data Subjects a range of rights concerning their personal data.

Depending on the circumstances, these include rights relating to:

• Information and transparency
• Access
• Correction
• Completion of personal data
• Erasure
• Restriction of processing
• Stopping processing
• Data transfer
• Objection to certain processing
• Automated processing
• Other rights established by the law

Organisations should therefore maintain a formal Data Subject Request process.

Right to access personal data

A Data Subject can request access to personal information processed about them, subject to the applicable legal conditions and exceptions.

A robust access-request workflow should allow an organisation to:

• Receive the request
• Verify the identity of the requester
• Search relevant systems
• Identify applicable exemptions
• Coordinate with processors
• Compile the required information
• Respond through an appropriate channel
• Maintain an audit record

Right to correction

Data Subjects can request correction or completion of inaccurate or incomplete personal data where the statutory conditions are met.

Businesses should ensure that corrections can propagate to relevant systems and processors.

This is particularly important where the same customer information is stored in:

• CRM systems
• Marketing platforms
• Customer-support software
• Billing systems
• Analytics systems
• Third-party applications

Right to deletion

The PDPL recognises circumstances in which a Data Subject can request deletion of personal data.

Deletion should not be treated as an unconditional requirement to erase every record immediately.

Organisations should consider:

• Whether the data is still required
• Whether another law requires retention
• Whether a legal claim depends on the information
• Whether a statutory exception applies
• Whether another legitimate purpose permits continued processing
• Whether third-party processors need to be instructed to delete the information

Right to restrict processing

The PDPL provides for restrictions on processing in specified circumstances.

Restriction workflows should allow organisations to distinguish between:

• Deletion
• Continued storage without active use
• Complete cessation of processing
• Processing that remains necessary for a legal or statutory purpose

This distinction is important for compliance operations because not every privacy request necessarily results in immediate deletion.

Right to object

Data Subjects have rights to object to certain forms of processing.

Businesses should provide a process for receiving and assessing objections, particularly where processing involves:

• Direct marketing
• Profiling
• Automated decision-making
• Other processing for which the law provides an objection right

Data transfer and portability

The UAE PDPL provides rights relating to the transfer of personal data.

Organisations should maintain technical capabilities that allow relevant personal information to be identified and exported in an appropriate format where the statutory requirements for transfer apply.

This can require coordination across:

• Customer databases
• CRM platforms
• Cloud systems
• SaaS applications
• Analytics systems
• Third-party processors

Sensitive personal data

The PDPL provides additional safeguards for sensitive personal data.

Sensitive information may include categories of information that could reveal particularly private characteristics or circumstances of an individual.

Businesses should apply stronger controls where sensitive information is processed, including:

• Data minimisation
• Access restrictions
• Strong authentication
• Encryption
• Monitoring
• Appropriate retention periods
• Privacy impact assessments where required
• Enhanced governance

Data Protection Officer

The PDPL provides for the appointment of a Data Protection Officer (DPO) in specified circumstances.

A DPO may be required where processing activities involve circumstances such as:

• Regular and systematic monitoring
• Processing sensitive personal data on a large scale
• Other circumstances established by the law or implementing requirements

The DPO function may include:

• Monitoring compliance
• Advising on privacy obligations
• Supporting impact assessments
• Managing data-subject rights
• Supporting breach response
• Cooperating with the competent authority
• Maintaining privacy governance

The precise operational requirements should be reviewed against the applicable implementing framework.

Data Protection Impact Assessments

The UAE PDPL requires impact assessments for certain processing activities that are likely to result in a high risk to the privacy and confidentiality of Data Subjects.

A DPIA should assess matters such as:

• Nature of the processing
• Purpose
• Scope
• Categories of personal data
• Categories of Data Subjects
• Potential risks
• Security controls
• Mitigation measures
• Retention
• Data-sharing
• International transfers
• Residual risk

DPIAs are particularly relevant for processing involving:

• Sensitive data
• Large-scale monitoring
• Profiling
• Automated decision-making
• New technologies
• Extensive tracking
• High-risk processing

Privacy by design

Organisations should incorporate privacy considerations into systems and product development.

A privacy-by-design programme can include:

• Data minimisation
• Purpose limitation
• Default privacy settings
• Access controls
• Encryption
• Pseudonymisation
• Retention controls
• Consent management
• User preference management
• Audit logging
• Privacy testing

For digital businesses, privacy should be addressed when a website, application or analytics architecture is designed rather than after deployment.

Security obligations

Controllers and Processors are expected to implement appropriate technical and organisational measures to protect personal data.

Security measures should reflect:

• Nature of the personal data
• Processing risks
• Technology used
• Potential consequences of a breach
• Cost and feasibility of safeguards
• The organisation's operating environment

Controls can include:

• Encryption
• Access management
• Authentication
• Network security
• Endpoint protection
• Secure development
• Vulnerability management
• Monitoring
• Logging
• Backup and recovery
• Incident response
• Employee training
• Vendor security controls

Personal data breaches

The UAE PDPL establishes obligations concerning personal-data breaches.

A breach-response programme should enable organisations to:

• Detect incidents
• Contain affected systems
• Determine whether personal data is involved
• Assess the nature and severity of the incident
• Identify affected Data Subjects
• Determine notification obligations
• Notify the competent authority where required
• Notify affected individuals where required
• Document the incident
• Implement corrective measures

The detailed operational requirements, including notification procedures and timing, are among the areas that depend on the implementing framework. The PDPL itself requires further rules concerning its implementation.

Cross-border data transfers

The UAE PDPL regulates transfers and sharing of personal data outside the UAE.

International transfers should be assessed before data is:

• Sent to an overseas cloud provider
• Stored on an international SaaS platform
• Accessed by a foreign group company
• Shared with an overseas processor
• Transferred to a foreign marketing provider
• Processed through infrastructure located outside the UAE

The PDPL provides mechanisms for international transfers, including transfers based on adequacy, applicable agreements, contractual safeguards and other conditions established by the law.

Businesses should therefore maintain an international-transfer inventory identifying:

• Origin country
• Destination country
• Recipient
• Purpose
• Data categories
• Legal transfer mechanism
• Contractual safeguards
• Security measures

Cookies and online tracking under the UAE PDPL

The UAE PDPL is relevant to cookies and tracking technologies where they involve personal data.

Businesses should assess:

• What information the cookie collects
• Whether the information identifies or can identify an individual
• The purpose of the tracking
• Whether third parties receive the information
• The applicable legal basis
• Whether consent is required
• How long information is retained
• How users can change their preferences

Common technologies requiring review include:

• Analytics cookies
• Advertising cookies
• Retargeting pixels
• Social-media pixels
• Conversion tracking
• Device identifiers
• Session technologies
• Behavioural analytics
• Third-party advertising scripts

Where consent is the applicable basis, organisations should prevent the relevant processing from starting before the required choice is obtained.

Direct marketing

Marketing activities involving personal data should be assessed against the PDPL and other applicable UAE rules.

Businesses should review:

• Source of marketing information
• Purpose of collection
• Legal basis
• Consent
• Opt-out mechanisms
• Preference management
• Profiling
• Advertising platforms
• Third-party disclosures
• Retention

The UAE also has separate telemarketing rules. Cabinet Resolution No. 56 of 2024 regulates telemarketing calls, while Cabinet Resolution No. 57 of 2024 provides administrative penalties for violations of those telemarketing rules. These requirements should be assessed separately from the federal PDPL.

Automated decision-making and profiling

The UAE PDPL addresses automated processing and provides protections relating to decisions based on automated processing.

Businesses using AI systems, profiling, behavioural scoring, automated eligibility decisions, personalised advertising, recommendation systems, fraud detection, credit assessment or other automated decision technologies should assess:

• What personal data is processed
• The purpose
• The significance of the decision
• Transparency
• Applicable objection rights
• Human involvement where appropriate
• Security
• Third-party processing
• DPIA requirements

AI systems that process personal data should be assessed as part of the organisation's wider privacy governance programme.

Data minimisation and purpose limitation

Organisations should collect personal data for legitimate and clearly defined purposes and avoid collecting information that is unnecessary for those purposes.

For example, a website requesting the following should be able to explain why each category is needed:

• Name
• Email
• Telephone number
• Location
• Device information
• Behavioural data
• Advertising identifiers

Data minimisation should also be considered when configuring analytics, advertising and customer-data platforms.

Data retention

Businesses should establish retention schedules for personal data.

A retention programme should address:

• Customer accounts
• Marketing databases
• Consent records
• Cookies
• Analytics data
• Security logs
• Support tickets
• Data-subject requests
• Employee records
• Processor-held data

Retention should be based on legal, contractual, operational and privacy requirements rather than indefinite storage.

Controllers and Processors

The PDPL distinguishes between two roles.

Controller. The entity that determines the method, criteria and purpose of processing personal data.

Processor. The entity that processes personal data on behalf of and under the instructions of a Controller.

Examples of processors may include:

• Cloud providers
• CRM providers
• Analytics vendors
• Marketing platforms
• Customer-support providers
• Payment service providers
• SaaS platforms

Controller-Processor arrangements should clearly establish:

• Processing instructions
• Security requirements
• Confidentiality
• Sub-processing
• Data-subject assistance
• Breach notification
• International transfers
• Deletion or return of data
• Audit and cooperation requirements

Processor management

Using a third-party provider does not eliminate the need for privacy governance.

Before onboarding a processor, organisations should evaluate:

• Where the provider processes data
• Security certifications
• Sub-processors
• International transfers
• Retention
• Deletion procedures
• Incident response
• Contractual safeguards
• Data-subject support
• Regulatory cooperation

A processor inventory should be maintained throughout the relationship.

Data governance and accountability

A mature UAE PDPL programme should include:

• Data inventory
• Records of processing
• Privacy policies
• Privacy notices
• Consent records
• Processor contracts
• Transfer assessments
• DPIAs
• DPO governance
• Security policies
• Incident response
• Data-subject request workflows
• Retention schedules
• Periodic compliance reviews

Consent management is one component of this broader governance framework.

Executive Regulations status

One of the most important points to understand about the UAE PDPL is the status of its Executive Regulations.

Article 28 of Federal Decree-Law No. 45 of 2021 provides for Executive Regulations to be issued by the Council of Ministers. Article 29 then provides a regularisation period for Controllers and Processors beginning from issuance of those regulations.

Current specialist legal trackers continue to report that the federal PDPL Executive Regulations have not been published, meaning detailed implementation requirements remain an important area to monitor.

Accordingly, businesses should not present an unverified regulation number or invented implementation deadline as the UAE PDPL's Executive Regulations.

The core obligations contained directly in Federal Decree-Law No. 45 of 2021 remain the foundation of the federal framework.

UAE PDPL and sector-specific laws

The federal PDPL does not operate in isolation.

Certain sectors have their own privacy and data-governance requirements, including areas such as:

• Healthcare
• Banking
• Credit information
• Telecommunications
• Financial services
• Government services
• Free-zone regulated activities

The PDPL itself excludes certain health and banking or credit information where separate legislation regulates its protection and processing.

Businesses should therefore perform a sector-specific legal assessment before assuming that the federal PDPL is the only applicable framework.

UAE PDPL compliance checklist

Use this checklist to review your privacy programme.

• Identify all personal data processed
• Identify sensitive personal data
• Determine whether the federal PDPL applies
• Check whether a sector-specific exemption or law applies
• Determine whether DIFC or ADGM rules apply
• Identify Controllers and Processors
• Map processing purposes
• Determine the applicable legal basis
• Review consent mechanisms
• Make consent specific and informed
• Maintain consent evidence
• Publish appropriate privacy notices
• Establish Data Subject request procedures
• Support access requests
• Support correction requests
• Support deletion requests
• Support restriction requests
• Support objection requests
• Assess data-transfer requirements
• Review international transfers
• Identify third-party processors
• Review processor contracts
• Assess DPO requirements
• Conduct DPIAs where required
• Implement appropriate security controls
• Establish breach-response procedures
• Assess automated decision-making
• Review profiling activities
• Review cookies and tracking technologies
• Configure consent before applicable tracking
• Maintain retention schedules
• Monitor developments to the Executive Regulations
• Review applicable sector-specific requirements