Navigating Grey Areas In The UAE's Data Protection Regime

The Executive Regulations are yet to be issued, allowing data controllers ample time to adapt to the law, but in their absence, the transition may be incomplete and counterproductive.

The UAE legislator was among the first in the region to introduce a standalone data privacy law in September 2021, Federal Decree Law No. 45 of 2021 on the Protection of Personal Data (the PPD).

The PPD is a relatively succinct law comprising 31 articles, most of which refer to the PPD's Executive Regulations (ER) for further clarity. The expectation has been that the ER would be issued within six months from the date of the issuance of the PPD, however this has taken longer than expected.

As final and comprehensive data privacy legislations have been introduced in the region over the last 12 months, this article will take a look at what we can expect from the PPD's ER.