Which UAE Data Protection Regime Applies to You?

The federal Personal Data Protection Law (PDPL) — Federal Decree-Law No. 45 of 2021 — applies across the mainland and most free zones (outside DIFC and ADGM). It sets out substantive obligations around how personal data should be handled.

The DIFC Data Protection Law — DIFC Law No. 5 of 2020 — is a working regime with active enforcement machinery, applying to data processing by DIFC entities.

The ADGM Data Protection Regulations 2021 run a fee-based registration system for ADGM entities, again a functioning, operating regime rather than a framework awaiting implementation.

The critical point that distinguishes these three is not just their content but their operational status: DIFC and ADGM are live, enforceable regimes today; the federal PDPL is not yet fully operational in the same sense, for reasons set out below.

The federal PDPL sets out real substantive obligations for how personal data should be collected, used, and protected on the mainland. What it currently lacks is the executive regulations that would normally operationalise a framework law like this — and as of this guide, those executive regulations have still not been issued.

The practical consequence is significant: there is no functioning registration requirement, no published adequacy list determining which countries data can be transferred to, no set of standard contractual clauses for cross-border transfers, no defined breach-notification timeline, and no published fine schedule under the federal regime. The law exists; the machinery that would make it enforceable in the way DIFC’s or ADGM’s regimes are enforceable does not yet exist.

This is not the same as saying the federal PDPL is irrelevant — the substantive obligations are real and organisations should be building toward compliance with them — but it is a materially different risk and compliance picture from DIFC or ADGM, and treating the federal regime as though it already has the same functioning enforcement infrastructure as DIFC would be inaccurate.

Various claims about a specific future deadline for federal PDPL compliance circulate in secondary commentary. None of those claims are treated as established fact in this guide — no specific compliance deadline for the federal PDPL is stated here, because none has been substantiated to a standard this guide is willing to publish. Anyone planning around a specific date should verify it directly against an official, primary source rather than relying on secondary reporting.

DIFC Law No. 5 of 2020 (as amended) is, by contrast, a mature and operating regime. It sets out registration and compliance obligations for DIFC entities processing personal data, backed by an active regulator and real enforcement mechanisms.

One structural feature worth flagging: DIFC’s regime makes processors — not just controllers — directly liable for their own data protection obligations, rather than routing all liability through the controller. This is a meaningfully different liability structure from a regime that only holds controllers accountable.

• DIFC ↗

Since 15 July 2025, DIFC’s data protection regime has included a private right of action — meaning an individual whose data protection rights have been breached can bring a claim directly, rather than relying solely on regulatory enforcement to vindicate their rights.

This is a significant practical difference from regimes where the only real enforcement route runs through a regulator’s own investigation and decision-making process. A private right of action gives individuals a more direct route to a remedy, and gives organisations a correspondingly more direct source of litigation risk, separate from regulatory risk.

DIFC Regulation 10, addressing autonomous and semi-autonomous systems, is — as of this guide — the only dedicated, binding, AI-specific regulation anywhere in the UAE. Neither the federal regime nor ADGM has an equivalent dedicated binding instrument targeting AI systems specifically in the same way.

For any organisation building or deploying AI systems that process personal data through a DIFC entity, this makes Regulation 10 a genuinely distinctive compliance consideration — one that doesn’t have a direct parallel to check against under federal or ADGM data protection law.

The ADGM Data Protection Regulations 2021 set out their own registration system for ADGM entities, structured around registration fees rather than mirroring DIFC’s specific mechanisms exactly. It is, like DIFC’s regime, a functioning and operating system with an active regulator, not a framework awaiting executive regulations.

ADGM entities handling personal data need to work through ADGM’s own registration and compliance process specifically — DIFC registration or federal PDPL awareness doesn’t substitute for it, since these are three separate compliance obligations that can each apply to different parts of the same corporate group.

• ADGM ↗

As with employment law, the deciding factor is generally where the entity processing the data is registered — a mainland or standard free zone entity sits under the federal PDPL, a DIFC entity under DIFC Law No. 5 of 2020, and an ADGM entity under the ADGM Data Protection Regulations 2021.

A corporate group with entities across more than one jurisdiction can genuinely be subject to more than one regime simultaneously for different parts of its data processing — a mainland trading entity and a DIFC holding entity in the same group can each carry separate, non-interchangeable compliance obligations.

DIFC and ADGM, as working regimes, each have their own frameworks addressing when personal data can be transferred outside the jurisdiction — an area where mature regimes typically specify adequacy assessments or approved transfer mechanisms.

The federal regime’s position on cross-border transfers is constrained by the same gap described above: without executive regulations in force, there is no published adequacy list or standard contractual clause framework operating at the federal level in the way DIFC or ADGM organisations can point to for their own transfers.

Federal Law No. 2 of 2019, concerning the use of information and communications technology in health fields, imposes a health-data localisation obligation. Article 13 provides that health data and information relating to health services provided inside the State may not be stored, processed, generated or transferred outside the State except by a resolution of the Health Authority in coordination with the Ministry. Article 2 states that the Law applies to all methods and uses of information and communication technology in the areas of health in the State, “including the free zones”.

Whether that phrase reaches the financial free zones specifically — DIFC and ADGM — is genuinely unresolved, and this guide does not state that it does. Federal Law No. 8 of 2004 exempts the financial free zones from federal civil and commercial laws, and ADGM describes its position in those terms. Federal Law No. 2 of 2019 cites the Financial Free Zones Law in its preamble but does not name DIFC or ADGM in its operative provisions, and no primary source found resolves the question either way. The practical consequence for a health-tech or clinical business in DIFC or ADGM is that it should not assume its free zone’s data protection regime is the whole picture, and should get the point assessed rather than treat it as settled in either direction.

DIFC and ADGM, as working regimes, each operate with defined expectations and mechanisms around notifying a breach — part of what makes them functioning, enforceable systems rather than frameworks in name only.

The federal regime does not currently have a defined breach-notification timeline in force, consistent with the broader gap created by the absence of executive regulations. Organisations under the federal PDPL should not assume a specific notification deadline exists simply because one would be typical of a mature data protection law.

DIFC and ADGM each have active regulators capable of investigating and taking enforcement action, with DIFC additionally offering the private right of action described above as a parallel route to a remedy for individuals.

The federal regime currently has no published fine schedule in force — again a direct consequence of the executive regulations not yet having been issued — so the practical enforcement exposure under the federal PDPL today looks very different from the exposure a DIFC or ADGM entity actually faces.

That there is one “UAE data protection law” — there are three main ones, at different stages of operational maturity, and conflating them leads to either overestimating federal enforcement risk or underestimating DIFC and ADGM risk.

That a specific 2027 compliance deadline applies to the federal PDPL — this claim circulates but is not substantiated to a standard this guide treats as established, and it is deliberately not repeated here.

That DIFC and ADGM data protection compliance is interchangeable — it isn’t; they are separate regimes with separate registration systems, and DIFC’s processor liability and private right of action in particular have no direct ADGM equivalent as described here.

That being in a free zone means federal law never applies — Federal Law No. 2 of 2019 applies in the State “including the free zones”, and whether that reaches DIFC and ADGM specifically is an open question rather than a settled no.