Can website data leave the UAE?

Yes. Under the UAE PDPL, Federal Decree-Law No. 45 of 2021, personal data can go to countries with an adequate level of protection, and to others under the conditions the law sets, such as contractual safeguards or the data subject's express consent. Entities in the DIFC and ADGM follow their own free zones' laws.

The law's other duties still apply to that data: a legal basis for processing it, a record of processing with purposes, categories of data and retention periods, appropriate security measures, and breach notification to the UAE Data Office.

The law also reaches organisations outside the UAE that process personal data of people inside it. Much of the detail is left to executive regulations, which had not been published on the UAE's official legislation portal as of September 2026.