United Arab Emirates

Federal Decree-Law No. 45 of 2021, Article 2(1), covers you if you sit outside the country and use personal data about people inside it. Article 2(2) then takes several groups back out. Government data and government bodies are out. Security and judicial authority data are out. Health data and banking or credit data that already have their own laws are out. Companies set up in free zones with their own data protection laws are also out. Article 10 says you need a data protection officer in only three cases. Those are high-risk work, regular checking of sensitive data, and handling large amounts of sensitive data. The law does not say that person must live in the country. The law also does not say you need a local representative. That detail was left to the Executive Regulations, which have never been issued.

The answer depends on your industry. Here is each one. - Health and social care. Closed. Federal Law No. 2 of 2019, Article 13, says health data created by services inside the country may not be stored, used, generated or sent abroad. The only way out is a decision from the relevant health authority, made with the Ministry. - Payments. Closed. The rule is the Central Bank Retail Payment Services and Card Schemes Regulation, Circular 15/2021. Article 14(22) says personal and payment data must be stored and kept inside the country. - Insurance. Closed. The Electronic Insurance Regulations 2020, Article 9(2), say you must protect data by measures that include storing it inside the country and in the cloud. - Banking and identity checks. Closed for one document. Cabinet Resolution No. 55 of 2026, Article 13, says users must not send the Know Your Customer report, or any data in it, outside the country. - Government and public sector. Outside the national law. Article 2(2) of the national law leaves out government data and government bodies. Whether that data must stay in the country is set by internal government policy, which is not published as law. - Financial free zones, meaning the Dubai International Financial Centre and the Abu Dhabi Global Market. Conditional. Each has its own privacy law and its own list of approved countries you may send data to. - Telecoms. We found no published rule requiring data to stay in the country on the regulator's own list of regulations, checked 18 August 2026. Other sources describe an Internet of Things policy that requires storage inside the country. See the unconfirmed list. - Mapping and geospatial data. We found no federal rule requiring data to stay in the country, checked 18 August 2026, medium confidence.

Federal Decree-Law No. 45 of 2021, Article 22, lets you send data to a country that has its own data protection law. That law must cover privacy, confidentiality and people's rights over their data. It must also give courts oversight of the companies using the data. Article 23 covers countries without such a law. You may send data there if the recipient signs binding promises to give the same protection. You may also rely on the person's explicit consent, where there is no security concern. Or you may send data where it is needed for a contract, legal proceedings, court cooperation or the public interest. The list of approved countries is empty. No approval decision has ever been published. So Article 22 does nothing and Article 23 carries all real traffic. There is also no schedule of fines, so today there is nothing to fine you with. Industry rules override all of this. Health, payments, insurance and the identity-check report have no route abroad at all. The one exception is health data, where the health authority can issue a specific decision.

Federal Decree-Law No. 44 of 2021 created the UAE Data Office. The government portal describes it as the federal data regulator, responsible for policies, standards, complaints systems and guidance. We could not find a website of its own. Two addresses, dataoffice.gov.ae and uaedataoffice.gov.ae, do not work, checked 18 August 2026. We found no published register, no guidance and no decisions. Article 26 of the privacy law leaves breaches and fines to a Cabinet decision, and we found none. Without it there is no fine to impose. The industry regulators are different. The Central Bank of the UAE published a financial penalty of 20,000,000 dirhams (about 5.4 million US dollars) on 24 June 2026. It published another of 1,820,000 dirhams (about 495,000 US dollars) on 6 July 2026. Both were against foreign bank branches. The Abu Dhabi Global Market Office of Data Protection published a penalty notice against Okadoc Technologies Limited on 21 May 2024. It also published a direction against VentureRock Global Limited on 23 June 2023. Both were under its own 2021 rules. We rate enforcement overall as waking. The national law is not enforced. The industry and free-zone regulators are active.

Government sources confirm these minimum keep-times. Health records: 25 years from the last health procedure, under Federal Law No. 2 of 2019, Article 20. Payment service providers: 5 years for personal and payment data, plus a secure backup in a separate place. That is Circular 15/2021, Article 10(10) and Article 14(22). Identity checks: 5 years for the reports, the requests for them and the records of handing them over, under Cabinet Resolution No. 55 of 2026, Articles 10, 12 and 13. There is no maximum keep-time. The privacy law left the detail on keeping data to a minimum, and on deleting it, to Executive Regulations that do not exist. So there is no enforceable national delete-by date today. We hold medium confidence on that. Clashes between the rules are easy to sort out here, and the minimum keep-times win. The privacy law does not apply to health data, or to banking and credit data that have their own laws. So a person's right to erasure under the privacy law cannot override an industry minimum keep-time.

Federal Decree-Law No. 45 of 2021, Article 9, says the company that decides how data is used must tell the Bureau when it finds a breach. This covers breaches that affect the privacy, confidentiality or security of data. The notice must set out the nature and causes of the breach. It must give the rough number of records affected. It must give contact details for the officer you appointed. It must cover the expected impact and the steps you are taking to fix it. The deadline for telling the affected people was left to the Executive Regulations. A company handling data for you must tell you immediately when it finds a breach. The Executive Regulations do not exist, and neither does the penalty decision under Article 26. So there is no national deadline in hours you can be held to. The telecoms and digital government regulator runs a cyber incident reporting service. Its stated audience is the government sector. Its published service description sets a 3 to 90 working day response window. That is a response time, not a duty on private firms to report. Firms in the Dubai International Financial Centre and the Abu Dhabi Global Market follow their own regulators' deadlines.

(1) Federal Decree-Law No. 45 of 2021, Article 2(2), leaves out government data and government bodies. It also leaves out security and judicial data, health data, and banking and credit data that already have their own laws. It leaves out free-zone companies with their own privacy laws too. If you build your compliance work only on the national law, you will miss the rule that actually binds you. (2) Federal Law No. 2 of 2019, Article 24, sets a fine for storing or sending health data abroad. It runs from 500,000 dirhams (about 136,000 US dollars) to 700,000 dirhams (about 191,000 US dollars). Article 25 lets health authorities add penalties of up to 1,000,000 dirhams (about 272,000 US dollars) and cancel your licence. (3) Cabinet Resolution No. 55 of 2026 has applied since 21 April 2026. It stops users of the national Know Your Customer platform from taking the report, or any data in it, out of the country. This export ban is newer than most published guidance. (4) Federal Decree-Law No. 26 of 2025 on Child Digital Safety says a child is anyone under 18. It requires documented, checkable consent from a caregiver for children under 13. Accounts must start on the highest privacy settings, and withdrawing consent must be easy. Its fines were left to a future Cabinet decision. So the duties apply now, but there are no penalties yet. (5) The Dubai International Financial Centre and the Abu Dhabi Global Market are separate legal jurisdictions. Each has its own privacy law, its own registration duties and its own commissioner. The Abu Dhabi commissioner makes every company that uses personal data register with it, and publishes its enforcement notices.

Powers the government already holds. It can use any of these with no warning and no consultation. 1. The Executive Regulations under Article 28 of Federal Decree-Law No. 45 of 2021. They were due within six months of September 2021 and are still not published, nearly five years late. Article 29 gives companies no more than six months from the day they are issued to put their position right. So publication starts a six-month countdown for every company in the country. 2. The Cabinet decision under Article 26 setting out breaches and fines. Until it exists there is no fine. The day it exists, the national law becomes enforceable. 3. The list of approved countries under Article 22. It has never been filled in. Filling it in would set out which destinations are lawful, and so would limit the others. 4. The health authority's power under Article 13 of Federal Law No. 2 of 2019 to allow, or refuse, storing health data abroad, decision by decision. 5. The penalties rules under Article 16 of the 2025 Child Digital Safety law. Known work in progress. The national Know Your Customer digital platform. Its Executive Regulations took effect on 21 April 2026. Its rules on administrative breaches are Cabinet Resolution No. 56 of 2026. The securities regulator has been renamed the Capital Market Authority, and now publishes its rulebook at a new address.