UAE data protection readiness check

The UAE does not have one data protection regime — it has several, and the first question is always which one applies: the federal PDPL (Decree-Law No. 45 of 2021) on the mainland, DIFC Data Protection Law No. 5 of 2020, ADGM’s regulations, and sector regimes for health and banking. Two clocks matter right now. The federal Executive Regulations are still unpublished — when they land, Article 29 gives six months to comply, less than a serious compliance build takes. And in the DIFC, Regulation 10 — in force since September 2023 — puts transparency and assessment duties on anyone processing personal data through AI systems. Health data is stricter again: Federal Law No. 2 of 2019, Article 13 keeps it inside the UAE unless a specific exemption applies. Twelve questions to find your exposure.