Regulation hub
Run UAE PDPL on one record, across every suite
The UAE's federal personal data protection law. Pritect maps each article that places an obligation on controllers and processors to the suite that carries it, so consent, data subject requests, breach reporting and cross-border transfers sit on one record with a named owner.
- Instrument
- Federal Decree by Law No. (45) of 2021
- Version
- Active
- In force
- 2 Jan 2022
UAE PDPL
Federal Decree by Law No. (45) of 2021
Ready
Data protection
Draft17 obligations mapped
Records of processing, consent, rights requests and impact assessments
- Art. 4
- Art. 5
- Art. 6
- Art. 7
- Art. 10
- +12
Incident Centre
Draft1 obligation mapped
Breach logging, notification decisions and the timeline
- Art. 9
Third-party governance
Draft1 obligation mapped
Processor due diligence, contract terms and monitoring
- Art. 8
Cybersecurity
Draft1 obligation mapped
Security controls and the evidence behind them
- Art. 20
UAE PDPL is now mapped across 4 suites. Each mapping waits for your Data Protection Officer to confirm it.
01 · Article to module
Every obligation lands in a suite.
The decree-law has 31 articles. This page maps the 20 that place obligations on controllers and processors to the Pritect suite that carries each one. Articles 1 to 3 (definitions, scope and the Bureau's power of exemption) and Articles 24 to 31 (complaints, grievances, penalties and final provisions) are not mapped, because they set the frame rather than an obligation to evidence.
Headings are quoted from the official English translation published by the UAE Legislation portal. The Arabic text is the authentic law and prevails in case of conflict. Read the official text
Lawful processing and consent
Art. 4 to 6
| Article | Heading | Pritect suite |
|---|---|---|
| Art. 4 | Cases of Processing Personal Data without the Consent of its Owner | Data protection |
| Art. 5 | Personal Data Processing Controls | Data protection |
| Art. 6 | Terms of Consent to Data Processing | Data protection |
Controllers, processors, breaches and the DPO
Art. 7 to 12
| Article | Heading | Pritect suite |
|---|---|---|
| Art. 7 | The Controller's General Obligations | Data protection |
| Art. 8 | The Processor's General Obligations | Third-party governance |
| Art. 9 | Reporting Personal Data Breach | Incident Centre |
| Art. 10 | Appointing Data Protection Officer | Data protection |
| Art. 11 | Roles of Data Protection Officer | Data protection |
| Art. 12 | Duties of the controller and the processor towards the Data Protection Officer | Data protection |
Data subject rights
Art. 13 to 19
| Article | Heading | Pritect suite |
|---|---|---|
| Art. 13 | Right to Receive Information | Data protection |
| Art. 14 | Right to Request Transfer of Personal Data | Data protection |
| Art. 15 | Right to correction or erasure of Personal Data | Data protection |
| Art. 16 | Right to Restrict Processing | Data protection |
| Art. 17 | Right to Stop Processing | Data protection |
| Art. 18 | Right to Processing and Automated Processing | Data protection |
| Art. 19 | Contacting the Controller | Data protection |
Security and impact assessment
Art. 20 to 21
| Article | Heading | Pritect suite |
|---|---|---|
| Art. 20 | Personal Data Security | Cybersecurity |
| Art. 21 | Assessment of the Impact of Personal Data Protection | Data protection |
Cross-border transfers
Art. 22 to 23
| Article | Heading | Pritect suite |
|---|---|---|
| Art. 22 | Cross-Border Transfer and Sharing of Personal Data for Processing Purposes if a Proper Protection Level is Available | Data protection |
| Art. 23 | Cross-Border Transfer and Sharing of Personal Data for Processing Purposes if a Proper Protection Level is not Available | Data protection |
02 · Timeline
When it applies.
Issued
20 Sep 2021
Attestation after Art. 31
Comes into force
2 Jan 2022
Art. 31
03 · Overlaps
One record answers several laws.
Where UAE PDPL and its neighbours cover the same ground, Pritect keeps one record and maps every law to it. The grouping is ours, for navigation, and is not a statement that the provisions are legally equivalent.
| Obligation | UAE PDPL | ADHICS | UAE Health ICT Law | GDPR |
|---|---|---|---|---|
| Processing principles | Art. 5 | DP 1 | Art. 15 | Art. 5 |
| Lawful basis | Art. 4 | Not tracked | Not tracked | Art. 6, Art. 9 |
| Consent | Art. 6 | Not tracked | Art. 16 | Art. 7 to 8 |
| Data subject rights | Art. 13 to 19 | DP 3 | Not tracked | Art. 12 to 22 |
| Records of processing | Not tracked | Not tracked | Not tracked | Art. 30 |
| Security of processing | Art. 20 | A 5, HR 1 to 4, AM 1 to 5, PE 1 to 3, AC 1 to 6, +4 | Art. 4, Art. 8, Art. 14 | Art. 32 |
| Breach notification | Art. 9 | IM 1 to 3 | Not tracked | Art. 33 to 34 |
| Impact assessment | Art. 21 | Not tracked | Not tracked | Art. 35 to 36 |
| Data protection officer | Art. 10 to 12 | DP 2 | Not tracked | Art. 37 to 39 |
| Processors | Art. 8 | TP 1 to 2 | Not tracked | Art. 28 to 29 |
| Cross-border transfers | Art. 22 to 23 | Not tracked | Art. 13 | Art. 44 to 49 |
04 · Questions
What teams ask first.
Does Pritect decide whether the UAE PDPL applies to us?
No. Art. 2, Scope of Application of the Decree by Law, decides that, and your counsel should read it against your operations. Pritect records the answer once, on the entity and its processing activities, so every assessment and notice after that uses it.
How does Pritect support reporting a personal data breach under the UAE PDPL?
Art. 9, Reporting Personal Data Breach, is mapped to the Incident Centre. A breach is logged once, linked to the affected processing activities, and moves through defined stages, with the reporting decision recorded as a step that a named person signs off.
Which data subject rights does Pritect track for the UAE PDPL?
Art. 13 to 19, from the Right to Receive Information to the Right to Processing and Automated Processing. Each request gets its own record, owner and evidence in the Data Protection suite, and the response waits for a named reviewer.
How are cross-border transfers recorded?
Art. 22 and 23 deal with transfers where a proper protection level is and is not available. Pritect records each transfer on the processing activity and the supplier involved, so the basis you rely on is documented once and reused by every assessment.
This page summarises publicly available legal text so you can orient yourself. It is not legal advice.