The 5 UAE laws, decisions and regulations on data protection in the Polaris Legal Library, each summarised from the official text with status, key provisions and penalties.
Search within this topic: open the search page with the data protection filter applied.
Federal Decree-Law No. 34 of 2021 on Countering Rumors and Cybercrimes
The UAE cybercrime law, replacing the 2012 law. It criminalises unauthorised access to systems and data, electronic fraud and forgery, online defamation, spreading rumours and false news, misuse of personal data and unlicensed online financial or crypto promotion, with imprisonment and fines up to the millions of dirhams. The legislation portal records one amendment without naming it.
Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data
The UAE's first federal personal data protection law. It sets lawful-basis, consent, purpose limitation, security, breach notification and data subject rights requirements for controllers and processors in the UAE and for those processing UAE residents' data from abroad, supervised by the UAE Data Office. Government data, the DIFC and ADGM, and health and banking data are excluded.
ADGM Data Protection Regulations 2021
GDPR-style regime administered by the ADGM Office of Data Protection: data-protection principles, individual rights, controller and processor duties, data protection officers for certain entities, breach notification and a registration requirement for every ADGM entity that processes personal data, renewed annually. Replaced the 2015 regulations with transition periods for existing entities.
DIFC Data Protection Regulations (Consolidated Version No. 2, in force 1 September 2023)
Made under the Data Protection Law 2020, the Regulations detail records of processing, notifications to the Commissioner, complaints, fines, personal data breaches, digital marketing and communications and autonomous or AI-based systems, with appendices of fees, standard notices and the list of adequate jurisdictions for transfers.
Data Protection Law, DIFC Law No. 5 of 2020
GDPR-aligned statute replacing the 2007 law: it sets lawful bases for processing, data subject rights, controller and processor duties, breach notification, data protection officers for high-risk processing, restrictions on transfers out of the DIFC and the powers and fines of the Commissioner of Data Protection. Consolidated July 2025.
Whether you are establishing a new venture, restructuring an existing enterprise, or exploring residency pathways — we are here to advise.
Arrange a Consultation →