United Arab Emirates

Federal Decree-Law No. 45 of 2021, Article 2(1), applies to 'each Controller or Processor residing outside the State and carrying out the activities of processing Personal Data of Data Subjects inside the State'. Article 2(2) excludes government data, governmental entities that control or process personal data, security and judicial authority data, health data and banking/credit data that already have their own legislation, and companies established in free zones that have their own personal data protection legislation. A data protection officer is required under Article 10 only where processing is high risk, involves systematic assessment of sensitive data, or involves large volumes of sensitive data; the law does not on its face require that person to be resident in the country. No general in-country representative duty appears in the statute — that kind of detail was left to Executive Regulations that have not been issued.

Headline rating: sectoral. Overrides, each with its own rating: - Health and social care — closed. Federal Law No. 2 of 2019, Article 13: health data generated by services provided inside the country may not be stored, processed, generated or transferred abroad unless the relevant health authority issues a decision in coordination with the Ministry. - Payments — closed. Central Bank Retail Payment Services and Card Schemes Regulation, Circular 15/2021, Article 14(22): personal and payment data shall be stored and maintained in the State. - Insurance — closed. Electronic Insurance Regulations 2020, Article 9(2): data protection must be delivered by measures including storing data inside the State and in the cloud. - Banking and identity checks — closed for one document. Cabinet Resolution No. 55 of 2026, Article 13: users must refrain from transferring the Know Your Customer report or any data in it outside the State. - Government and public sector — outside the national law entirely. Article 2(2) of the national law excludes government data and government entities, leaving residency to internal government policy that is not published as legislation. - Financial free zones (Dubai International Financial Centre and Abu Dhabi Global Market) — conditional. Each has its own privacy law with a European-style approved-destinations list. - Telecoms — no published localisation rule found on the regulator's own list of regulations, checked 18 August 2026. Secondary sources describe an Internet of Things policy requiring in-country storage; see the unconfirmed list. - Mapping and geospatial data — no federal localisation rule found, checked 18 August 2026, confidence medium.

Federal Decree-Law No. 45 of 2021, Article 22, permits transfer where the destination has data protection legislation covering privacy, confidentiality and data subject rights, with judicial oversight of controllers and processors. Article 23 permits transfer to countries without such legislation where the recipient gives binding contractual undertakings of equivalent protection, or on the data subject's explicit consent (where there is no security concern), or where necessary for a contract, legal proceedings, judicial cooperation or public interest. Critically, the approved-destinations list is empty: no adequacy instrument has been published, so Article 22 is a dead letter and Article 23 carries all real-world traffic. Because there is no penalty schedule either, there is presently nothing to fine you with. Sector rules displace all of this: health, payments, insurance and the identity-check report have no transfer route at all except, for health, a specific decision from the health authority.

The UAE Data Office was created by Federal Decree-Law No. 44 of 2021 and is described on the government portal as the federal data regulator responsible for policies, standards, complaints systems and guidance. We could not find a website of its own (dataoffice.gov.ae and uaedataoffice.gov.ae do not resolve, checked 18 August 2026), any published register, any guidance document or any decision. Article 26 of the privacy law leaves violations and penalties to be set by a Cabinet decision, and none was found — without it there is no fine to impose. Contrast the sector regulators: the Central Bank of the UAE published financial sanctions of 20,000,000 dirhams (about $5.4m) on 24 June 2026 and 1,820,000 dirhams (about $495,000) on 6 July 2026 against foreign bank branches. The Abu Dhabi Global Market Office of Data Protection has published a penalty notice against Okadoc Technologies Limited (21 May 2024) and a direction against VentureRock Global Limited (23 June 2023) under its own 2021 regulations. Overall rating 'waking': the national regime is dormant, the sector and free-zone regimes are active.

Floors verified on government sources: 25 years from the last health procedure (Federal Law No. 2 of 2019, Article 20); 5 years for personal and payment data held by payment service providers, plus a secure backup in a separate location (Circular 15/2021, Article 10(10) and Article 14(22)); 5 years for identity-check reports, requests for them and records of provision (Cabinet Resolution No. 55 of 2026, Articles 10, 12 and 13). Ceiling: the privacy law's own minimisation and deletion detail was left to Executive Regulations that do not exist, so there is no enforceable national delete-by date today — confidence medium on that negative. Conflict resolution is unusually clean here and works in favour of the floors: the privacy law expressly does not apply to health data or to banking and credit data that have their own legislation, so a sector retention minimum cannot be overridden by a privacy-law erasure right.

Federal Decree-Law No. 45 of 2021, Article 9, requires the controller to notify the Bureau on discovering a breach affecting the privacy, confidentiality or security of data, with content including the nature and causes of the breach, the approximate number of records, the contact details of the appointed officer, expected impacts and corrective measures. The deadline for telling affected individuals is expressly left to the Executive Regulations. A processor that discovers a breach must tell the controller immediately. Because the Executive Regulations do not exist and the penalty decision under Article 26 does not exist, there is no enforceable national hour-count. The telecoms and digital government regulator operates a cyber incident reporting service whose stated audience is the government sector, and its published service description sets a 3 to 90 working day response window rather than a reporting duty on private firms. Firms in the Dubai International Financial Centre and the Abu Dhabi Global Market are on their own regulators' clocks.

(1) Federal Decree-Law No. 45 of 2021, Article 2(2), excludes government data, government entities, security and judicial data, health data and banking and credit data already covered by their own legislation, and free-zone companies with their own privacy legislation. A compliance programme built only on the national law will miss the rule that binds you. (2) Federal Law No. 2 of 2019, Article 24, sets a fine of not less than 500,000 dirhams (about $136,000) and not more than 700,000 dirhams (about $191,000) for storing or transferring health data abroad, and Article 25 allows health authorities to impose sanctions up to 1,000,000 dirhams (about $272,000) and to cancel a licence. (3) Cabinet Resolution No. 55 of 2026, in force since 21 April 2026, bars users of the national Know Your Customer platform from moving the report or any data in it out of the country — a new hard export ban that predates most published guidance. (4) Federal Decree-Law No. 26 of 2025 on Child Digital Safety defines a child as anyone under 18 but requires documented, verifiable caregiver consent for those under 13, with highest-privacy default settings and easy consent withdrawal. Its penalties are left to a future Cabinet decision, so the duties are live while the sanctions are not. (5) The Dubai International Financial Centre and the Abu Dhabi Global Market are separate legal jurisdictions with their own privacy laws, their own registration duties and their own commissioners. The Abu Dhabi commissioner requires every entity processing personal data to register as a data controller and publishes its enforcement notices.

Dormant switches — powers already held that can change the picture with no consultation: 1. The Executive Regulations under Article 28 of Federal Decree-Law No. 45 of 2021. They were due within six months of September 2021 and are still not published, nearly five years late. Article 29 gives controllers and processors no more than six months from their issuance to regularise their position, so publication starts a hard six-month clock for every company in the country. 2. The Cabinet decision under Article 26 setting out violations and penalties. Until it exists there is no fine; the day it exists the national law becomes enforceable. 3. The approved-destinations list under Article 22. It has never been populated. Populating it would define, and by implication restrict, lawful destinations. 4. The health authority's power under Article 13 of Federal Law No. 2 of 2019 to permit, or refuse, offshore storage of health data by individual decision. 5. The penalties regulation under Article 16 of the 2025 Child Digital Safety law. Known in-flight items: the national Know Your Customer digital platform, whose Executive Regulations took effect on 21 April 2026 and whose administrative violations regulation is Cabinet Resolution No. 56 of 2026; and the renaming of the securities regulator to the Capital Market Authority, which now publishes its rulebook at a new address.