The Advent of Federal Decree-Law No. 45 of 2021
On November 28, 2021, the UAE Cabinet issued Federal Decree-Law No. 45 of 2021, known as the Personal Data Protection Law (PDPL). Effective from January 2, 2022, this landmark legislation establishes a comprehensive framework for the processing of personal data, aligning the UAE with international standards such as the GDPR.
Scope and Applicability
The PDPL applies to the processing of personal data using automated or manual means by any data controller or processor located within the UAE. Crucially, its extraterritorial reach extends to entities outside the UAE that process the personal data of residents located within the state, emphasizing the protection of individual privacy in a globalized digital economy.
Obligations of Controllers and Processors
Under the law, organizations must implement robust technical and organizational measures to ensure data confidentiality and integrity. This includes appointing a Data Protection Officer (DPO) in specific scenarios, conducting impact assessments, and adhering to strict rules regarding the cross-border transfer of personal data to ensure an adequate level of protection.