The law today
The UAE's federal data protection law is Federal Decree-Law No. 45 of 2021. Its core obligations apply, while detailed Executive Regulations — which will set out items such as breach-notification timelines — had not been issued as of September 2026. Once issued, a compliance period is expected. Free zones such as DIFC and ADGM have their own data protection laws.
What it means in practice
- Lawful basis — process personal data with consent or another basis the law allows; the PDPL does not include a general 'legitimate interest' basis, which matters for marketing.
- CCTV — footage is personal data: limit access, set retention, and sign-post cameras.
- CRM and marketing — record consent, honour opt-outs and keep data accurate.
- Security — protect data with access control, encryption and monitoring.
- Breaches — be ready to notify the UAE Data Office and affected people.
- Cross-border transfers — only under the conditions the law sets.
A five-step start
- Map the personal data you hold — cameras, CRM, HR, websites.
- Check the lawful basis and consents.
- Tighten access and retention.
- Prepare a breach-response plan.
- Review vendors and cloud locations.
This article is general information, not legal advice. See our cybersecurity assessments.
Personal data you probably hold
- CCTV footage of staff, visitors and customers
- Access-control and time-attendance records, including biometrics
- CRM contacts, enquiry forms and WhatsApp conversations
- Employee files, payroll and visa documents
- Wi-Fi login and guest records in hotels and venues
Each of these needs a clear purpose, access limited to the people who need it, a retention period and secure deletion when that period ends.
Technology controls that support compliance
- Access control: role-based access to CCTV, HR and CRM systems, with multi-factor authentication for administrators.
- Encryption: for laptops, mobile devices, backups and data in transit.
- Logging and monitoring: know who viewed or exported footage and records.
- Retention settings: configure recorders, CRMs and mailboxes to delete data automatically when it is no longer needed — while meeting any minimum retention that other rules require.
- Network segmentation: keep cameras, access control and guest Wi-Fi separate from business systems.
Marketing and WhatsApp
Record when and how each contact gave consent, make it easy to opt out and honour opt-outs across every channel. Use the official WhatsApp Business Platform with approved message templates rather than personal phones for customer conversations.
Vendors and cloud services
Many systems — CRM, cloud CCTV, HR and AI tools — are run by third parties. Put data-processing terms in your contracts, ask where data is stored and how it is protected, and check the conditions for transferring data outside the UAE.
Keep it proportionate
Start with the data that carries the most risk, fix the obvious gaps, document what you have done and review it regularly. This is general information, not legal advice — confirm your specific obligations with a qualified adviser, especially if you operate in a free zone with its own data protection law.
Frequently asked questions
Does the PDPL apply in free zones?
DIFC and ADGM have their own data protection laws; other free zones are generally covered by the federal law.
Have the Executive Regulations been issued?
Not as of September 2026, according to published trackers; check for updates.
Is consent always needed for marketing?
Consent is the main route for direct marketing because the PDPL has no general legitimate-interest basis; take legal advice for your case.
Sources: IT Sec Now — PDPL Executive Regulations status