The UAE Has Three Data Protection Regimes: Federal Law, DIFC and ADGM — Which One Applies to You
The UAE has three separate data protection regimes, and which one binds you depends mainly on where your business is established.
- DIFC: companies in the Dubai International Financial Centre follow the DIFC Data Protection Law No. 5 of 2020 and its regulations.
- ADGM: companies in Abu Dhabi Global Market follow the ADGM Data Protection Regulations 2021.
- Everyone else: onshore and in the other free zones, the federal Personal Data Protection Law applies — Federal Decree-Law No. 45 of 2021 — unless a sector law takes the data out of it.
The federal law has been in force since 2 January 2022. Its executive regulations and the Cabinet decision on penalties had still not been issued at the time of writing. A company in Oman serving UAE customers needs to know which of the three it touches, and what “in force but not yet complete” means for planning.
The short answer
| Regime | Who it covers | Regulator | Status |
|---|---|---|---|
| Federal PDPL (Decree-Law 45/2021) | Onshore and most free-zone businesses, plus controllers abroad processing data of people in the UAE | UAE Data Office; a new federal AI and data authority was announced in June 2026 | In force since 2 Jan 2022; executive regulations and penalties decision not issued |
| DIFC Data Protection Law 2020 | Entities in the DIFC, and processing in the DIFC | Commissioner of Data Protection | Fully operational; includes a 2023 regulation on autonomous and AI systems |
| ADGM Data Protection Regulations 2021 | Entities in ADGM | ADGM Office of Data Protection | Fully operational; fines up to USD 28 million |
Sector rules sit on top of all three. Health data is governed by the federal law on information and communications technology in health fields, and banking data by Central Bank rules.
The federal law: in force, not yet complete
Who it covers
As summarised by Clyde & Co, the federal law applies to organisations established in the UAE processing personal data of people inside or outside the country. It also applies to organisations outside the UAE that process personal data of people inside it.
For a company in Oman, the second limb is the relevant one. If you sell to customers in Dubai or Sharjah, keep their accounts and send them invoices, the federal law reaches that processing even though your systems sit in Muscat.
What it excludes
The law carves out several categories. These include government data and government entities, data held by security and judicial authorities, processing for personal purposes, and health data and banking or credit data that have their own laws. Free-zone companies with their own data protection legislation, such as DIFC and ADGM entities, are also excluded.
That last exclusion is why “which free zone are you in” is the first question in any UAE data protection conversation.
Lawful bases: consent first, no legitimate interest
Processing requires the data subject’s consent unless an exception applies. The exceptions include performing a contract with the data subject, complying with legal obligations, protecting the public interest, and employment and social security obligations. Consent must be specific, clear and unambiguous, given by a clear positive statement or action.
Unlike GDPR, Saudi Arabia and Bahrain, the federal law has no general legitimate-interest basis. In that respect it is closer to Oman’s law. A system serving Omani and UAE customers can share one consent-first design.
Rights, including over automated decisions
Data subjects can access their data, have it transferred, corrected or erased, restrict processing in some cases, and object to processing such as direct marketing. They can also object to decisions based solely on automated processing, including profiling. Oman’s amended law added a comparable right in September 2026, which is covered in what Royal Decree 68/2026 changed.
DPO, breaches and transfers
A data protection officer is required in defined cases. These include high-risk processing using new technologies or large volumes, systematic assessment of sensitive data including profiling and automated processing, and processing large volumes of sensitive data. The DPO may be internal or external, and need not be based in the UAE.
Breaches likely to affect privacy, confidentiality or security must be reported to the UAE Data Office immediately upon becoming aware. Affected data subjects must also be told. The exact timing is left to the executive regulations.
Transfers abroad are permitted to jurisdictions with an adequate level of protection, subject to the regulator’s role. Without adequacy, derogations include performing a contract, establishing legal claims, and express consent that does not conflict with public and security interests.
Penalties: deferred to a decision not yet made
The law does not itself set fines. It leaves violations and administrative penalties to a Cabinet decision, which had not been issued at the time of writing. Organisations also get six months from the executive regulations’ issuance to adjust.
That combination is the federal law’s planning problem. You know what it requires, but not when enforcement starts or what a breach would cost. The sensible reading is to build to the law now, because the regulations will start a short clock once they arrive.
The June 2026 authority: what it changes, and what it doesn’t
In June 2026 the UAE announced a federal authority for artificial intelligence and data. Secondary sources report that it brings together the UAE Artificial Intelligence Office, the UAE Data Office and the digital government functions of the telecommunications regulator. Some expect it to finalise the PDPL’s executive regulations and take over enforcement. Others describe its mandate as government-facing for now.
We could not find the founding instrument’s text. Treat the authority as a likely future enforcer, not as a change to your current obligations. The law you need to meet is the same law.
DIFC: a mature regime with an AI regulation
The DIFC Data Protection Law No. 5 of 2020 took effect on 1 July 2020, with enforcement from 1 October 2020. It applies to entities in the DIFC and to processing carried out there, supervised by the DIFC Commissioner of Data Protection. Its structure will be familiar to anyone who knows GDPR: lawful bases including legitimate interests, accountability records, a list of adequate jurisdictions with safeguards such as standard clauses for other transfers, and breach notification to the Commissioner and to affected people in defined circumstances.
What sets the DIFC apart for anyone building chatbots or AI is Regulation 10. The DIFC enacted it in September 2023 and described it as the first regulation in the MEASA region on processing personal data through autonomous and semi-autonomous systems. As summarised by Clyde & Co in January 2026, it requires controllers and processors to assess, document and mitigate privacy risks before high-risk processing. People must be told that such systems are being used, with enough information to decide whether to object or withdraw consent.
If your customer is a DIFC firm and your software processes personal data on its behalf, its obligations will arrive in your contract. Expect questions about AI features specifically.
ADGM: the other free-zone regime
The ADGM Data Protection Regulations 2021 apply to entities in Abu Dhabi Global Market and are supervised by ADGM’s Office of Data Protection. Two figures matter. Fines can reach USD 28 million. And a breach must be notified to the Commissioner without undue delay and, where feasible, within 72 hours of becoming aware, unless it is unlikely to create a risk to individuals. Late notifications must explain the delay. Affected individuals are told without undue delay where the risk is high.
Health and banking data sit outside the general law
Two sector laws take data out of the federal PDPL.
Health data is governed by Federal Law No. 2 of 2019 on the use of information and communications technology in health fields. Its Article 13 restricts storing, processing, generating or transferring health data relating to services provided in the UAE outside the country, except in cases set by decision. A 2021 ministerial resolution created exceptions, each with conditions. A clinic booking system or health app with UAE patients is therefore a hosting decision, not just a privacy one.
Banking and credit data fall under Central Bank regulation and the laws protecting such data.
What an Omani company serving UAE customers should do
- Identify which UAE regime each customer relationship touches. Onshore consumers bring in the federal law. A DIFC or ADGM client brings in its regime through your contract.
- Use consent-first design. Without a legitimate-interest route in either the UAE federal law or Oman’s law, one consent model can serve both — if it records wording, version and timestamp.
- Build an objection path for automated decisions. Both the UAE federal law and Oman’s amended law give people a right to object.
- Prepare for breach notification now. “Immediately” plus a regulation-defined deadline means your runbook needs a UAE line before the regulation arrives.
- Check health and financial data separately. Sector laws can require in-country hosting regardless of the general law.
- Watch for the executive regulations. When they are issued, a six-month adjustment period starts.
Frequently asked questions
Is the UAE data protection law in force? Yes. Federal Decree-Law No. 45 of 2021 has been in force since 2 January 2022. Its executive regulations and the Cabinet decision on penalties had not been issued at the time of writing, so full enforcement is not yet possible. Organisations get six months from the regulations’ issuance to comply.
Does the UAE law apply to a company in Oman? It applies to controllers and processors outside the UAE that process personal data of people inside it. An Omani business with UAE customers should plan on that basis.
I’m in a free zone. Which law applies? DIFC entities follow the DIFC Data Protection Law 2020, and ADGM entities follow the ADGM Data Protection Regulations 2021. Most other free zones fall under the federal law, because they do not have their own data protection legislation.
Does the UAE allow processing based on legitimate interest? Not under the federal law, which works from consent plus listed exceptions. The DIFC and ADGM regimes, modelled more closely on GDPR, do recognise legitimate interests.
What does DIFC Regulation 10 mean for chatbots? It applies to personal data processed through autonomous and semi-autonomous systems, which can include AI chatbots. People must be told such systems are in use, and high-risk processing requires the risks to be assessed, documented and mitigated first. If you build for a DIFC client, expect its requirements in your contract.
Can UAE patients’ health data be stored in Oman? The federal law on ICT in health fields restricts storing and transferring health data relating to services provided in the UAE outside the country, except in cases set by ministerial decision. Check the exceptions and their conditions with a UAE adviser before choosing hosting.
This article states the position under the UAE federal law and the DIFC and ADGM regimes as in force on 21 October 2026, the date of publication. It is not legal advice. The federal executive regulations and penalties decision were pending at that date; confirm your position with a qualified adviser licensed in the UAE.
Sources: Clyde & Co — UAE issues landmark personal data protection law · DLA Piper — UAE data protection · Lexology — UAE establishes federal authority for AI and data · DIFC — amended Data Protection Regulations, including Regulation 10 · Clyde & Co — Regulation 10 of the DIFC Data Protection Law · Taylor Wessing — ADGM Data Protection Regulations · Federal Law No. 2 of 2019 on ICT in health fields
Serving UAE customers from Oman? ZAWAT builds business systems and handles integration and support with consent, objection paths and hosting set per jurisdiction. Book a call.