PDPL, DIFC DPL, and ADGM DPR, Three Parallel Regimes
Which law applies depends entirely on where your business is legally registered
The UAE's federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, governs mainland UAE businesses, with full enforcement now active and penalties reaching into the millions of dirhams. DIFC registered entities fall instead under the DIFC Data Protection Law, enforced by a separate Commissioner of Data Protection, with fines up to 100,000 dollars per violation. ADGM registered entities fall under yet another regime, the ADGM Data Protection Regulations, with fines reaching 28 million dollars. Getting this wrong at the outset means rebuilding compliance architecture later. We identify the correct regime for your business before writing a line of code.