Your phone number sits in a dozen UAE property portals. Your Emirates ID is on file with your bank, your landlord, your gym, your doctor, and the delivery app that brought lunch yesterday. Until recently, almost none of that was governed by a single national rulebook. That changed when the UAE issued Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, known as the PDPL. The law gives residents real, enforceable rights over how companies collect, store, share, and delete personal information. This guide explains what the law means for you in practical terms, what falls within its scope, and how to use it in everyday situations from renting a flat to setting up a smart speaker.
What the UAE PDPL Actually Is
The Personal Data Protection Law was issued in September 2021 and came into force on January 2, 2022. It is the first federal law in the UAE to set out comprehensive standards for how personal data is processed across the country. Personal data covers any information that can identify a living person, directly or indirectly. That includes obvious items like name, passport, Emirates ID, and bank account details. It also covers location data, device identifiers, biometric records, and online behaviour patterns that most residents share without thinking.
The law sits alongside Federal Decree-Law No. 44 of 2021, which established the UAE Data Office as the federal regulator responsible for issuing guidance, approving codes of conduct, and supervising compliance. A separate piece of legislation, Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrime, criminalises unauthorised access, identity theft, and misuse of personal data on digital platforms. Together, these three laws form the backbone of UAE digital privacy.
Who the Law Applies To
The PDPL applies to any business inside or outside the UAE that processes the personal data of people residing in the country. A real estate brokerage in Dubai, an overseas e-commerce site shipping to UAE addresses, and an international hotel chain marketing to UAE residents all fall within its reach. This wide territorial scope is important for expats who shop, bank, and book across borders.
There are notable carve-outs. Government data, judicial data, and personal data held by security and intelligence agencies sit outside the law. Banking and credit data remain under the Central Bank of the UAE framework. Health information is governed by Federal Law No. 2 of 2019 on the use of information and communication technology in the health field. The two financial free zones, the Dubai International Financial Centre and Abu Dhabi Global Market, run their own regimes under DIFC Data Protection Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021. If you work in a DIFC firm and rent a flat through a mainland broker, two different rulebooks apply to the same week of your life. Knowing which one covers a given interaction is the first practical step. Residents settling in for the long term, including British expats renting in Dubai, can treat this as part of their relocation due diligence.
Your Seven Rights as a Data Subject in the UAE
The PDPL gives every individual a defined set of rights that businesses must respect on request. According to guidance published by the UAE Data Office, these rights form the operational core of the law and shape how controllers respond to resident requests.
- Right to information: be told what data is collected, why, and who it is shared with.
- Right of access: request a copy of the personal data a company holds about you.
- Right to rectification: have inaccurate or incomplete information corrected.
- Right to erasure: ask for deletion when data is no longer necessary or processing is unlawful.
- Right to restrict processing: pause certain uses while a dispute is resolved.
- Right to data portability: receive your data in a structured, machine readable format.
- Right to object: refuse marketing, profiling, and decisions made solely by algorithms.
These rights follow the structure adopted in leading international privacy frameworks, which makes compliance easier for multinational companies operating in the UAE and gives residents protections that are recognisable by global standards.
How This Changes Everyday Life in the UAE
Property Searches and Real Estate Portals
When you submit your number through a property listing, that contact information cannot be passed indefinitely to agents you never asked to hear from. Brokerages must now state a clear purpose at the point of collection and obtain consent for any use beyond that purpose. Residents browsing Dubai apartments for sale can look for a clear privacy notice before submitting enquiry forms, and can ask any portal to delete their record once a deal is signed or the search ends.
Tenancy Contracts, Ejari, and Property Management
Signing an Ejari tenancy involves sharing Emirates ID, passport, and visa data with the landlord, the agent, and the building management. The law requires each party in that chain to limit access to staff who genuinely need it, store the data securely, and delete it once retention obligations end. Tenants can now ask landlords for written confirmation of how their documents are stored, and can request removal of copies held beyond the tenancy period.
Mortgages, KYC, and Banking
Banks still operate under Central Bank rules for credit assessment and anti money laundering. The personal data collected for marketing, app usage, and non regulated services falls under the PDPL. Customers can opt out of marketing calls, ask for app permissions to be reviewed, and request deletion of dormant account data after legal retention periods expire.
Smart Devices, Home Apps, and Voice Assistants
Smart speakers, cameras, and home automation apps generate a constant stream of personal data. The PDPL requires UAE based providers to disclose what is recorded, for how long, and whether data leaves the country. Residents can review the privacy settings on every connected device and disable continuous recording where it is not needed.
What Businesses Operating in the UAE Must Do
Any company that handles personal data of UAE residents is treated as either a controller, which decides why and how data is processed, or a processor, which acts on the controller’s instructions. Both face concrete obligations. They must build a lawful basis for every processing activity, maintain internal records, run impact assessments before high risk projects such as biometric access or large scale profiling, and put in place contracts that bind their vendors to the same standards.
Cross border transfers are permitted where the destination country offers an adequate level of protection or where specific safeguards such as standard contractual clauses are in place. Breaches must be notified to the UAE Data Office without undue delay once the controller becomes aware of them. Many companies will also appoint a Data Protection Officer where their activities involve sensitive data, systematic monitoring, or large volumes of personal data. Family businesses, property developers, real estate agents, schools, and clinics across the UAE are all in scope.
How to Exercise Your Rights in Practice
Start with a written request sent by email to the company’s privacy or data protection contact. UAE businesses are now expected to publish this contact in their privacy notice. Identify yourself clearly, state which right you are exercising, and specify the data or service in question. Controllers have a reasonable period to respond, usually within thirty days, and can ask for proof of identity to protect against fraudulent requests.
Keep records. Save the email, the acknowledgement, and any reply. If the company does not act on your request, you can escalate to the UAE Data Office, which handles complaints, mediates with controllers, and can order corrective action. Templates and step by step guidance are increasingly available in Arabic and English on official portals. For most residents, a single well drafted email resolves the issue without further escalation, particularly for marketing lists, recruitment platforms, and old service accounts that should have been closed long ago.
Penalties, Enforcement, and the Direction of Travel
The PDPL allows the Council of Ministers to set administrative penalties for breaches, and the cybercrime law adds criminal penalties for unauthorised access, identity theft, and disclosure of personal data without consent. Enforcement is still ramping up, and the regulator has signalled a phased approach focused on guidance before sanctions. That does not weaken your rights. Residents who exercise them early help shape how the regulator prioritises cases. As reported by Gulf News in coverage of the UAE’s expanding privacy framework, companies are investing in privacy programmes because the value of a public breach now includes reputational damage in a market where trust drives bookings, leases, and sales.
The Bottom Line for UAE Residents
Digital privacy in the UAE has moved from a courtesy to a legal entitlement. The PDPL, the Cybercrime Law, and the Data Office together give residents tools that did not exist three years ago. Reviewing your privacy notices, opting out of unwanted marketing, and requesting deletion of data you no longer need anyone to hold are all steps that carry real weight. Whether you are renting your first studio, buying an investment unit, or settling into life across the emirates, your personal information is now part of the asset stack worth protecting. For broader context on what living in the UAE looks like today, privacy is the quiet pillar that increasingly defines a secure resident experience.
Sources
- UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
- UAE Federal Decree-Law No. 44 of 2021 establishing the UAE Data Office
- UAE Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrime
- Dubai International Financial Centre (DIFC) Data Protection Law No. 5 of 2020
- Abu Dhabi Global Market (ADGM) Data Protection Regulations 2021
Frequently Asked Questions
Yes. The PDPL protects the personal data of any individual residing in the UAE, regardless of nationality. It also applies when companies abroad process data of UAE residents, for example online retailers shipping to your address or hotels marketing to you while you live here. Free zone residents in the DIFC and ADGM are covered by their respective local frameworks. In every case, expats have rights to access, correct, and request deletion of personal data held by service providers.
Yes. Once your property search is over or the agent no longer needs your details for a lawful purpose, you can submit a written request asking them to delete your record. The brokerage must respond within a reasonable period, usually thirty days, and confirm what has been deleted. They may retain limited information where required by Dubai Land Department rules or anti money laundering laws, but marketing data and old enquiries should be removed promptly on request.
Personal data is any information that identifies or can identify a living person. This includes your name, Emirates ID, passport number, address, phone number, and email. It also covers location data, IP address, device identifiers, biometric records such as fingerprints and facial scans, and behavioural data collected through apps and websites. Sensitive categories such as health, religion, race, and biometric data attract stricter protections under the PDPL and require explicit consent or another specific legal basis.
First, put your request in writing and keep a copy of the response. If the company gives an unclear answer or fails to reply within a reasonable period, you can file a complaint with the UAE Data Office, the federal regulator established under Federal Decree-Law No. 44 of 2021. Free zone residents file with the relevant authority in DIFC or ADGM. The regulator can investigate, mediate, and order the company to comply, including deletion or correction of records.
Yes, where the provider processes personal data of UAE residents. Smart speakers, doorbell cameras, fitness trackers, and home automation apps all collect identifiable information. Providers must disclose what is collected, why, how long it is retained, and whether data is sent abroad. They must also offer ways to access, correct, and delete your records. Residents can review the privacy settings on each device, switch off continuous recording where unnecessary, and remove old accounts they no longer use.
