The UAE is not one data protection regime but several. Onshore companies follow the federal Personal Data Protection Law (PDPL), while companies in the DIFC and ADGM financial free zones follow their own GDPR-style laws, enforced by their own commissioners. Where you incorporate therefore shapes your compliance programme.
The UAE is also a leading crypto and AI hub, with dedicated virtual-asset regulators and a growing set of digital laws, including a Child Digital Safety Law in force since January 2026.
- Onshore data law
- Federal Decree-Law 45/2021 (PDPL)
- Free zones
- DIFC Data Protection Law 2020; ADGM Data Protection Regulations 2021
- Children
- Child Digital Safety Law (Federal Decree-Law 26/2025), from 1 Jan 2026
- Virtual assets
- VARA (Dubai), ADGM FSRA, DIFC DFSA
- AI
- No horizontal law; DIFC rules on autonomous systems
- Uncertainty
- Status of PDPL executive regulations contested
Who needs to comply
Startups processing personal data in the UAE
The PDPL applies to processing in the UAE and to processing of UAE residents’ data by entities abroad, with free-zone and sector carve-outs.
Companies in the DIFC or ADGM
They follow free-zone data protection laws with registration, DPO and transfer rules.
Platforms and apps used by children in the UAE
The Child Digital Safety Law restricts processing of under-13s’ data and adds platform duties.
Crypto, Web3 and virtual-asset businesses
Licensing is required from VARA, the ADGM FSRA or the DFSA depending on location and activity.
Health-tech and fintech
Health data laws and Central Bank rules add localisation and security duties.
The laws, in detail
01Federal Personal Data Protection Law (PDPL)
Consent and other bases, rights, security, breach notification and cross-border transfers.
When it applies
Processing in the UAE or of data subjects in the UAE, excluding free zones with their own laws and some regulated sectors.
What you must do
- Lawful basis, usually consent
- Data subject rights
- Security measures and breach notification
- Transfer conditions for data leaving the UAE
- DPO in specified cases
Regulator
UAE Data Office
Penalties
To be set by executive regulations; their status is contested in current commentary.
02DIFC Data Protection Law 2020 & ADGM Data Protection Regulations 2021
GDPR-style regimes for entities in the financial free zones, including DIFC rules on processing via autonomous and semi-autonomous systems.
When it applies
Entities incorporated or processing in the DIFC or ADGM.
What you must do
- Registration and annual notifications
- DPO for high-risk processing
- Transfer safeguards
- Breach notification
- Notices on AI and autonomous system processing (DIFC)
Regulator
DIFC Commissioner of Data Protection; ADGM Office of Data Protection
Penalties
Administrative fines set by each regime.
03Child Digital Safety Law (Federal Decree-Law 26/2025)
Duties for digital platforms and ISPs to protect children online.
When it applies
Platforms operating in or targeting users in the UAE, including apps, games, social, messaging and e-commerce.
What you must do
- No processing of under-13s’ data without verifiable parental consent and strict conditions
- Age-appropriate safety measures
- Cooperation with authorities
Regulator
TDRA and other designated authorities
Penalties
Penalties under the law, with a transition period into 2027.
04Virtual-asset regimes (VARA, ADGM FSRA, DFSA)
Licensing and conduct rules for virtual-asset service providers.
When it applies
Offering virtual-asset activities in or from the UAE.
What you must do
- Licence before operating
- Custody, marketing and compliance rulebooks
- AML/CFT and Travel Rule
Regulator
VARA (Dubai); FSRA (ADGM); DFSA (DIFC)
Penalties
Fines, licence action and enforcement.
05Cybercrime and content laws
Federal Decree-Law 34/2021 on rumours and cybercrimes, and media content standards.
When it applies
Online services and content accessible in the UAE.
What you must do
- Content moderation aligned with UAE law
- Cooperation with lawful requests
Regulator
TDRA; law enforcement
Penalties
Criminal penalties and blocking.
Compliance checklist
01 · Before you launch
- Choose onshore, DIFC or ADGM with data and licensing in mind
- Map the applicable data protection regime
- Check virtual-asset or financial licensing
- Assess children’s use of the product
02 · At launch
- Registration and DPO (free zones)
- Consent and transfer safeguards
- Parental consent for under-13s
- Content moderation policies
03 · As you scale
- Monitor PDPL executive regulations
- Child Digital Safety Law full enforcement from 2027
- Sector localisation (health, finance)
Key dates
- Jul 2020DIFC Data Protection Law in force
- Jan 2022Federal PDPL in force
- 2023Dubai VARA full regime
- 1 Jan 2026Child Digital Safety Law in force (transition into 2027)
Common mistakes
- Assuming one UAE privacy law applies everywhere
- Launching crypto features without the right regulator
- Copying a GDPR notice without free-zone registration
FAQs
Which UAE law applies to my startup?
It depends where you are incorporated and operate: onshore companies follow the federal PDPL; DIFC and ADGM entities follow their own laws.
Is there a UAE AI law?
No horizontal AI law, but the DIFC regulates processing through AI and autonomous systems, and sector rules apply.
In the law library
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.