Get audit-ready for UAE PDPL
UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) · UAE Data Office
The UAE's federal personal data protection law (in force 2 January 2022): lawful basis and consent, processing principles, controller and processor duties, breach reporting, DPO appointment, data subject rights, impact assessments and cross-border transfers. Free-zone entities under their own regimes (e.g. DIFC, ADGM) and sector-regulated health and banking data are outside its scope.
UAE PDPLWhat is UAE PDPL?
The UAE's federal personal data protection law (in force 2 January 2022): lawful basis and consent, processing principles, controller and processor duties, breach reporting, DPO appointment, data subject rights, impact assessments and cross-border transfers. Free-zone entities under their own regimes (e.g. DIFC, ADGM) and sector-regulated health and banking data are outside its scope.
Who it applies to
Organisations processing personal data of people in the UAE, and controllers and processors established there. Free zones with their own data protection laws (such as DIFC and ADGM) and sector-regulated health and banking data fall outside it.
How the standard is organised
A GDPR-style law: lawful basis and consent, processing principles, controller and processor duties, breach notification, data protection officers, data subject rights, impact assessments and rules for cross-border transfers.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
UAE PDPL on the Bitkosh platform
The 40 UAE PDPL controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- 6.3Make consent easy to withdraw, and honour withdrawals
The consent request states the right to withdraw; withdrawal is as easy as giving consent and stops further consent-based processing (earlier processing remains lawful).
Consent - 22.1Transfer abroad only to adequate jurisdictions where possible
Transfers outside the UAE go to countries with data protection legislation the Data Office recognises as adequate, or under data protection agreements the UAE is party to.
Cross-Border Transfers - 5.1Process fairly, transparently and lawfully
Processing activities are reviewed to confirm they are fair to the data subject, transparent about what happens to their data, and lawful.
Processing Principles - 7.5Use processors that give sufficient guarantees
Processors are selected and contracted only where they provide sufficient guarantees of appropriate technical and organisational measures.
Controller & Processor Obligations - 8.4Define roles where several processors are involved
Where more than one processor is involved, a written agreement sets out each one's obligations and roles; without one they are jointly liable.
Controller & Processor Obligations - 10.2Publish the DPO's contact details and notify the Data Office
The DPO's contact address is published and notified to the UAE Data Office.
Data Protection Officer
More privacy & data protection frameworks
Frequently Asked Questions
Who publishes UAE PDPL, and who does it apply to?
How is UAE PDPL conformance demonstrated?
How is UAE PDPL structured?
Ready to get audit-ready for UAE PDPL?
See how the Bitkosh Readiness Platform gets you audit-ready for UAE PDPL — and the other 47 ready frameworks — from a single control library.