Have the UAE PDPL executive regulations been issued?
Not as of September 2026. Article 28 of Federal Decree-Law No. 45 of 2021 called for executive regulations within six months of the law's issue, but they had not been published on the UAE's official legislation portal. The law itself has been in force since 2 January 2022.
The compliance period is tied to them. Controllers and processors have six months from the regulations' issue to bring their processing into line (Article 29), and the Cabinet may extend that once for the same period. That clock has not started.
Penalties wait too: Article 26 leaves the violations and administrative penalties to a Cabinet decision, which had not been published as of September 2026. Until the regulations appear, the law's own conditions are the standard to build to, such as consent that is specific, clear and unambiguous and can be withdrawn at any time.
Read the full UAE PDPL guideSources
- 1.UAE Government — data protection laws
- 2.DLA Piper, Data Protection Laws of the World — United Arab Emirates
- 3.DataGuidance — UAE data protection overview
Last reviewed . Not legal advice.