Summary: The UAE has a federal data protection law, and free zones such as DIFC and ADGM have their own regimes. Here is a practical overview.
Businesses operating in the UAE may be subject to the federal personal data protection law or to free zone rules, depending on where they are established. This is general information, not legal advice.
Common expectations
- Process personal data lawfully and transparently
- Collect only what you need
- Keep data secure
- Respect individuals' rights
- Manage cross-border transfers appropriately
Free zones
Companies in DIFC or ADGM follow those free zones' data protection laws.
Website actions
Publish a clear privacy notice, add consent wording to forms and review tracking tools.
FAQs
Which law applies to us?
It depends on where you are established and operate; take advice.
Do we need cookie consent?
Transparency is expected; requirements vary by regime.
Can data be hosted abroad?
Transfers are possible with appropriate safeguards.
