UAE PDPL, DIFC DPL, ADGM DPR, KSA PDPL compliance

We help businesses navigate the region’s key privacy regulations:

UAE PDPL (Federal Data Protection Law)

DIFC DPL (Dubai International Financial Centre)

ADGM DPR (Abu Dhabi Global Market)

KSA PDPL (Saudi Arabia Personal Data Protection Law)

Our tailored compliance solutions help you meet local requirements for data processing, cross-border transfers and individual rights, so you avoid penalties and build lasting customer trust.

Which data protection law applies to your business?

The Gulf has several overlapping regimes, and more than one can apply to the same organisation. As a starting point:

• UAE PDPL (Federal Decree-Law No. 45 of 2021): the federal law for the UAE mainland. It applies to organisations established in the UAE and also to those outside the UAE that process the personal data of people in the UAE. It is overseen by the UAE Data Office. Free zones with their own data protection legislation, such as DIFC and ADGM, are generally governed by that legislation instead.
• DIFC Data Protection Law (Law No. 5 of 2020): applies to entities incorporated in the Dubai International Financial Centre and to certain processing connected to the DIFC. It is overseen by the DIFC Commissioner of Data Protection.
• ADGM Data Protection Regulations 2021: applies to entities in Abu Dhabi Global Market and is overseen by the ADGM Office of Data Protection.
• KSA Personal Data Protection Law: applies to the processing of personal data of individuals in Saudi Arabia, including by organisations based outside the Kingdom. It is overseen by SDAIA and supported by Implementing Regulations covering breach notification and DPO appointment, and by a separate Regulation on Personal Data Transfer Outside the Kingdom.
• GDPR and UK GDPR: can also apply to a Gulf business that offers goods or services to people in the EU or UK, or monitors their behaviour.

Not sure where you stand? Our gap analysis maps your activities to the laws that apply and shows what is missing. This page is general information, not legal advice.

How we help

1. Scope and map: we identify what personal data you collect, where it flows and which regimes apply.
2. Assess: we compare your current practices against each applicable law and rank the gaps by risk.
3. Remediate: we draft or update privacy notices, policies, records of processing, consent and retention rules, and data processing agreements.
4. Assess high-risk activity: we run data protection impact assessments and transfer impact assessments where cross-border data flows or new technologies are involved.
5. Prepare and train: we set up a breach response process through our incident management support and train your teams.
6. Maintain: we can act as your outsourced Data Protection Officer and keep your programme current as laws and guidance change.

What compliance typically involves

• A lawful basis for each use of personal data, with valid consent where it is required
• Clear privacy notices and processes for data subject requests such as access, correction and deletion
• Controls on transferring personal data outside the UAE or Saudi Arabia, including contracts and risk assessments
• A tested process for reporting personal data breaches to the regulator and affected individuals
• Appointing a Data Protection Officer where the law requires one
• Impact assessments for high-risk processing, including AI and profiling
• Written agreements with vendors and processors that handle personal data for you
• Records, policies and staff training that you can show to a regulator

Who this is for

Companies in the UAE and Saudi Arabia, free-zone and financial-centre entities, and international businesses expanding into the region, including those that already comply with GDPR and need to map that work to local rules.

Frequently asked questions

Does the UAE PDPL apply to companies outside the UAE?

It can. The law applies to organisations that process the personal data of individuals in the UAE even if the organisation itself is based elsewhere.

If we comply with GDPR, are we covered in the UAE and Saudi Arabia?

GDPR work gives you a strong base, but the local laws differ on points such as breach notification, cross-border transfers, regulator registration and DPO appointment. We map your GDPR programme to each regime and close the remaining gaps.

How is the UAE PDPL different from the DIFC and ADGM regimes?

The PDPL covers the UAE mainland, while DIFC and ADGM have their own laws and regulators. Which one applies depends on where your entity is established and what processing you carry out. Read our comparison of DIFC DPL, ADGM DPR and UAE PDPL.

Does Saudi Arabia’s PDPL apply to foreign companies?

Yes, where they process the personal data of individuals in the Kingdom. See our Saudi PDPL compliance checklist.

How is the UAE PDPL different from GDPR?

The two share core principles, but they differ on points such as breach notification timing and regulator structure. See GDPR vs UAE PDPL for a side-by-side explanation.

Want a quick self-assessment first? Work through our free UAE and Saudi PDPL readiness checklist.