UAE PDPL vs. GDPR: Federal Law, DIFC, and ADGM Compared

Most comparisons of the UAE's data protection law against the GDPR treat "the UAE" as a single regime. That framing misses the fact that matters most to any business actually operating there: the UAE runs three separate data protection systems at once, and which one applies to you depends entirely on where your entity is legally established.

A company incorporated on the UAE mainland answers to the federal Personal Data Protection Law. A company set up in the Dubai International Financial Centre answers to DIFC's own law and its own Commissioner. A company set up in Abu Dhabi Global Market answers to a third, separate law and a third regulator. These three regimes do not share a regulator, do not share an adequacy list, and, as this page lays out in detail, are not equally enforceable today.

At a Glance: GDPR vs. UAE Federal PDPL vs. DIFC vs. ADGM

Which Regime Applies to You

This is the question every reader of this page actually has, and the answer is jurisdictional, not sector-based.

• If your entity is licensed on the UAE mainland (in Dubai, Abu Dhabi, or any other emirate, outside the two financial free zones), the federal PDPL applies to your processing of personal data.
• If your entity is licensed in the DIFC, DIFC's own Data Protection Law applies to your DIFC operations, not the federal PDPL.
• If your entity is licensed in ADGM, ADGM's Data Protection Regulations apply to your ADGM operations, not the federal PDPL.
• If your group has entities in more than one of these, each entity is separately subject to its own regime. There is no single "UAE data protection compliance" answer for a multi-entity group; there are up to three.

The federal PDPL is written to apply broadly across the mainland, but Article 2(2)(g) carves out "companies and establishments located in free zones in the Country and have special legislations regarding Personal Data protection." DIFC and ADGM both fall inside that carve-out because each has its own data protection statute, though neither is named in the PDPL itself. The carve-out sits in Article 2(2)(g) of the PDPL itself, and it matches how the two zones actually operate: each maintains its own Commissioner, its own statute, and its own enforcement history entirely separate from the federal side.

For background on the UAE's data privacy laws overall, including how the framework fits into the broader Gulf region, see our dedicated country page.

Background and Current Status of Each Regime

GDPR

The General Data Protection Regulation took effect across the EU/EEA on 25 May 2018. It is the most mature and most litigated data protection framework in the world, with an extensive body of regulatory guidance, court decisions, and a coordinated network of national data protection authorities operating under the European Data Protection Board. For a fuller primer, see what is GDPR.

UAE Federal PDPL

Federal Decree-Law No. 45 of 2021 "Concerning the Protection of Personal Data" was issued on 20 September 2021, published in Official Gazette No. 712 on 26 September 2021, and took effect on 2 January 2022. The official UAE legislation portal lists the law's status as active.

What has not happened is the part that gives most data protection laws their teeth. The PDPL itself requires Executive Regulations to spell out the operative detail, including the specific administrative penalty schedule. Those regulations have never been issued, nearly five years after the law was passed. The regulator the PDPL assigns those functions to, the UAE Data Office, established not by the PDPL itself but by its companion statute, Federal Decree-Law No. 44 of 2021, was described on the UAE government's own website in forward-looking terms, as a body that "will act as" the federal regulator, language consistent with an authority that never actually became operational.

On 14 June 2026, the UAE's Vice President and Prime Minister, Sheikh Mohammed bin Rashid Al Maktoum, approved the establishment of a new Artificial Intelligence and Data Authority, described as the single national body responsible for data, artificial intelligence, and digital government, reporting directly to the Cabinet. It consolidates three existing bodies, including the UAE Data Office. The official Cabinet announcement of the new Authority does not mention the PDPL or data protection by name; its stated mandate is framed around AI strategy, the digital economy, and digital government standards. Some law firms have suggested the new Authority will eventually finish the PDPL's Executive Regulations, but that is an inference from outside commentary, not a stated government commitment, and the timing is explicitly described as uncertain given competing AI-governance priorities.

The practical result: the federal PDPL's substantive provisions on consent, data protection officers, breach notice, and cross-border transfer are formally in force, but the administrative machinery needed to enforce them, including any penalty schedule, has never been switched on, and the body meant to run that machinery no longer exists as a standalone data protection regulator.

DIFC

The Dubai International Financial Centre's Data Protection Law No. 5 of 2020 came into force on 1 July 2020 (Article 4). It is modeled closely on the GDPR and is administered by a dedicated, active regulator, the Commissioner of Data Protection (DIFC), which is entirely separate from the federal side.

On 8 July 2025, DIFC enacted the DIFC Laws Amendment Law No. 1 of 2025, which entered into force on 15 July 2025 and made several substantive changes to the Data Protection Law:

• It introduced an express private right of action at Article 64A, so a DIFC data subject can sue a controller or processor directly in the DIFC Courts for compensation rather than relying only on a Commissioner complaint. This brought DIFC into line with ADGM, whose Regulations have carried an equivalent compensation right at section 59 since 2021.
• It expanded the law's extraterritorial reach to cover controllers and processors incorporated in DIFC regardless of where the actual processing occurs, and to processing that takes place in DIFC as part of "stable arrangements," now explicitly including sub-processors.
• It amended the provision governing disclosure to public authorities and law enforcement, requiring controllers and processors to verify that a request is valid and proportionate before disclosing data.

ADGM

Abu Dhabi Global Market's Data Protection Regulations 2021 are ADGM's standalone framework, administered by the Office of Data Protection, also called the Commissioner of Data Protection (ADGM). The Regulations came into force in phases during 2021 and 2022 as entities newly registered in ADGM and pre-existing ADGM entities separately transitioned onto the new rules. Like DIFC's law, ADGM's Regulations are closely modeled on the GDPR's structure.

Scope and Territorial Application

The scope split matters because it is easy to assume "UAE data protection law" is a single perimeter. It is not. A group with a mainland trading entity and a DIFC-registered financial services entity is running two entirely separate compliance obligations under two different laws, answering to two different regulators, even though both entities sit inside the same country.

Data Subject Rights

All four regimes give individuals broadly similar categories of rights: access to their data, correction of inaccurate data, deletion in defined circumstances, restriction of processing, objection to certain processing (including direct marketing), and protections around automated decision-making. GDPR's rights framework (Articles 15 through 22) is the most extensively litigated and guided version of this model, and DIFC and ADGM's rights provisions both track it closely, consistent with their GDPR-modeled drafting.

The practical gap is not in what rights the federal PDPL grants on paper, but in what happens when a UAE mainland data subject tries to exercise one. Without Executive Regulations or an operating regulator, there is currently no established federal complaint or enforcement pathway comparable to what DIFC's Commissioner, DIFC's Courts, or ADGM's Office of Data Protection can each offer. DIFC's July 2025 amendment sharpens this further for that free zone specifically, since a DIFC data subject can now go to court directly rather than depending solely on the Commissioner to act.

Legal Bases for Processing

GDPR sets out six legal bases for processing under Article 6, including consent, contractual necessity, legal obligation, vital interests, public task, and legitimate interests, with a stricter regime for special category data under Article 9. DIFC and ADGM's laws include a comparable structure of lawful processing grounds and heightened rules for sensitive categories of data, consistent with their GDPR-based drafting approach.

The federal PDPL similarly frames consent as a central basis for processing, alongside other grounds such as contractual necessity and legal obligations, but because the Executive Regulations have not been issued, the operative detail of how these grounds are assessed and enforced in practice has not been fleshed out the way it has under DIFC and ADGM guidance, or under the extensive body of EDPB and national-authority guidance built up around GDPR.

Regulators and Enforcement Reality

This is where the three-regimes trap is sharpest, because it inverts a common assumption. A business that concludes "UAE data law has no teeth" is right only about the federal, mainland leg.

Federal PDPL: The UAE Data Office was designated as the federal regulator but never became operational. As of 14 June 2026, it no longer exists as a standalone body, having been folded into the new Artificial Intelligence and Data Authority alongside two other government units. No penalty schedule has ever been published, because the Cabinet decision needed to set one has not been issued. There is, as of this writing, no functioning federal enforcement pathway for a PDPL violation.

DIFC: The Commissioner of Data Protection (DIFC) is not just standing but by far the busiest data protection enforcer in the UAE. The Commissioner publishes both investigation decision notices and administrative fines, and the volume is substantial: 717 preliminary notices and 273 administrative-fine decision notices in 2025, up from 173 in 2023. Most arise from basic compliance failures such as letting a processing notification lapse or not responding to an investigation request, rather than headline breaches. As of the July 2025 amendment, DIFC also has a judicial enforcement route, since data subjects can now bring a Data Protection Law claim directly in the DIFC Courts.

ADGM: The Office of Data Protection has issued real, named enforcement actions. On 21 May 2024, the ODP issued a Penalty Notice against Okadoc Technologies Limited over contraventions of the Regulations' individual-rights provisions, arising from the company's handling of a data subject access request. On 23 June 2023, the ODP issued a Direction against VentureRock Global Limited over a contravention of the Regulations' security principle. These are ADGM's only two published enforcement actions to date, but they are two more than the federal regime has ever issued, and they demonstrate that ADGM's regulator functions as a real enforcement body, not just a name on a statute.

The upshot: two of the UAE's three data protection regimes are already actively enforcing their laws against named companies. The one that is not is the federal, mainland regime, which is also the one most competitor content treats as "the UAE's data protection law" without qualification.

For businesses weighing whether they need a dedicated compliance role across these regimes, see our overview of data protection officer requirements.

Cross-Border Data Transfers

This table is where the practical trap becomes concrete. Neither DIFC's nor ADGM's adequacy list references the UAE mainland or the federal PDPL as an adequate transfer destination, even though both free zones recognize each other. And the federal side has no adequacy list of its own to receive data at all, because the mechanism that would create one, the Data Office's determination process, never became operational. A group moving personal data from a DIFC or ADGM entity to its own mainland UAE affiliate is not operating under a clearly adequate or clearly safeguarded transfer today; it is operating in a genuine regulatory gap.

For a broader look at how this kind of transfer mechanism works elsewhere, see standard contractual clauses and our survey of data localization laws by country.

Breach Notification

Breach notification timing is one of the clearest points of divergence between these four regimes, and it does not follow a single pattern.

The pattern worth remembering: across these regimes, the regulator-facing leg is sometimes a hard 72-hour clock, but the individual-facing leg is consistently a "without undue delay" or "as soon as practicable" standard rather than a fixed number of hours. Do not treat "72 hours" as a blanket figure that applies identically to every notice obligation in every regime; DIFC in particular has no fixed-hour deadline at all, for either the regulator or the individual, which is a genuine and useful point of contrast against both ADGM and GDPR.

Penalties

DIFC's penalty structure is worth flagging specifically because it is easy to misreport as a single number. It is not one cap; it is a schedule of per-article maximums that differ depending on which obligation was violated, with breach-notification failures sitting toward the lower end of that schedule and other categories of violation reaching higher. It is also not the whole picture. Schedule 2 governs the administrative tier only; Article 62(3) separately empowers the Commissioner to issue a general fine expressly not limited to the amounts specified in Schedule 2, sized to the seriousness of the contravention and the risk of actual harm. For a serious contravention, DIFC exposure is uncapped.

The federal PDPL's row is the starkest contrast on this table. There is currently no published penalty amount, high or low, for a PDPL violation, because the Cabinet decision that would set one has never been issued.

Recent Developments

Compliance Guidance for Groups Operating Across All Three UAE Regimes

A business with a presence on the mainland and in one or both free zones should treat this as three compliance programs, not one, until the federal side changes materially:

• Map each entity to its regime first. Legal establishment, not business activity, determines which of the three laws applies. A mainland branch of a DIFC-registered company is still a separate question from the DIFC entity itself.
• Do not assume mainland-to-free-zone transfers are safe by default. Because neither DIFC nor ADGM's adequacy list includes the UAE mainland, and the federal side has no adequacy mechanism of its own, moving data between a free zone entity and a mainland affiliate should be treated as an unresolved transfer question, not a routine intra-group flow.
• Register in both free zones, the duty is not ADGM-only. ADGM requires every registered entity that processes personal data to register as a Data Controller, with annual renewal. DIFC separately requires controllers and processors to register with its Commissioner by filing a notification of processing operations, kept up to date by amended notifications, accompanied by a prescribed fee (Article 14(7)-(8)); failing to do so is fineable up to USD 25,000 under Schedule 2, and lapsed notifications are among the most common causes of DIFC administrative fines. The federal regime operates no registration requirement, because the machinery to run one was never established. So the checklist differs across all three, but two of the three do require registration.
• Build your breach-notice playbook around the strictest applicable clock. For a group with DIFC, ADGM, and mainland entities, defaulting internal escalation procedures to ADGM's 72-hour benchmark, and applying GDPR's 72-hour standard wherever EU data subjects are also involved, is the safer operational choice even where DIFC's own law does not impose the same fixed deadline.
• Do not rely on the federal PDPL's stated rights and obligations as a functioning enforcement backstop yet. Contractual and technical safeguards matter more on the mainland today precisely because the regulatory and penalty machinery that would otherwise enforce the statute is not yet running.
• Watch the Artificial Intelligence and Data Authority, not the old UAE Data Office name, for future federal developments. Any Executive Regulations or federal penalty schedule that eventually appears will come from this new body, whose current public mandate is framed around AI and digital government rather than data protection specifically.