UAE PDPL compliance software
What it is
The UAE Personal Data Protection Law (PDPL) is Federal Decree Law No. 45 of 2021. It sets rules for how personal data is collected, used, shared, kept and deleted. It applies to the processing of personal data of people in the UAE. It also applies to controllers and processors in the UAE. A controller decides why and how personal data is processed. A processor handles that data on the controller's behalf. The UAE Data Office oversees the law. Its executive regulations set many detailed obligations, so businesses should track them as they are issued.
Who needs it
The PDPL applies to organisations that process personal data of people in the UAE. It covers controllers and processors that operate in the UAE, whatever sector they serve. Foreign businesses can also fall in scope when they process personal data of people in the UAE. The DIFC and ADGM free zones have their own data protection laws, so companies registered there sit outside this law. Some controllers and processors must appoint a data protection officer. Check whether your activities trigger that duty.
What auditors check
- A record of processing activities that lists each purpose, data category, recipient and retention period.
- A lawful basis for each processing activity, with proof of when and how consent was given where consent applies.
- A privacy notice that explains what personal data is collected, why, for how long and which rights apply.
- A process that handles data subject requests for access, correction, erasure and restriction within the statutory time limits.
- Written agreements with each processor that set out its duties and its instructions.
- Security measures that fit the risk, such as encryption, access control and regular testing.
- An incident response plan that reports personal data breaches to the UAE Data Office and informs affected people where the law requires.
- Checks on transfers of personal data outside the UAE, confirming the destination offers adequate protection or another permitted basis applies.
- Impact assessments for processing that poses a high risk to people, completed before that processing begins.
- A data protection officer appointed where the law requires one, with contact details on record.
How Oncrypt gets you ready
Oncrypt builds your UAE PDPL readiness from the controls the law puts in front of you. Our scans check your website and its trackers for personal data collection. We also check your email and domain settings, your cloud accounts and the forms that collect personal data. Each finding lands in your score with a clear fix and an owner. Our in house pentest team tests the systems that matter most. Our compliance lead checks the evidence. The evidence vault keeps each record ready for your next review. No regulator or auditor issues a PDPL certificate. Oncrypt does not issue one either. Oncrypt gets you ready and keeps evidence current.
Overlap with other frameworks
Questions
Does the UAE PDPL apply to free zone companies?
It depends on the free zone. The DIFC and ADGM have their own data protection laws, so companies registered there fall outside this law. Companies in other free zones and on the mainland fall under the PDPL. Confirm your position with your legal counsel.
Does Oncrypt make us UAE PDPL compliant?
No. No regulator or auditor issues a PDPL certificate. Oncrypt does not issue one either. Oncrypt gets you ready and keeps evidence current, so you can show your controls at any time.
Who enforces the UAE PDPL?
The UAE Data Office oversees the law. Organisations report personal data breaches to it, as the law requires.
Do the executive regulations change our duties?
They can. The executive regulations set many detailed obligations under the law. Track them as they are issued. Review your controls when they change.
How does the UAE PDPL compare with GDPR and the Saudi PDPL?
All three cover lawful processing, data subject rights and breach handling. One set of controls can serve each of them, though each law has its own duties.
Start with the gaps that matter most
Talk to us about your framework. We will show you what to fix first and what your auditor will ask for.