UAE PDPL, Health Data Localisation and Customer Data

The UAE federal Personal Data Protection Law (PDPL), Federal Decree-Law No. 45 of 2021, is in force, but its executive regulations had not been published in the sources reviewed, so detailed duties, procedures and penalties remain open 13. Compliance for a customer data platform (CDP) therefore stacks the federal law, the DIFC and ADGM regimes, health data localisation under Federal Law 2/2019, banking rules and marketing-consent laws.

Who this is for: DPOs, CISOs and marketing-operations leads with customers in the UAE, and architects deciding where profiles, consent records and health-related engagement data may live. Part of the regulation hub.

Status of the federal PDPL and the executive-regulations gap

The UAE government identifies Federal Decree-Laws 45/2021 (personal data) and 44/2021 (the Data Office). DLA Piper’s guide, modified 27 January 2025, reported that Executive Regulations were unpublished as of 6 January 2025. That historical report does not establish their status today. Current regulations, commencement consequences and penalty decisions must be checked in the UAE official sources. DLA Piper, secondary; UAE portal.

The law itself sets no penalties; a Cabinet decision is to specify violations and administrative penalties 3. Until then other laws fill the gap: Penal Code Articles 431 and 432, the cybercrime law (fines of AED 150,000 to 5,000,000 and/or prison for listed offences), and Article 13 of Federal Decree-Law No. 34 of 2021 (detention and/or fines of AED 50,000 to 500,000 for unlawful collection or processing of personal data) 3. The Central Bank and TDRA can also act within their sectors 3.

Assess federal PDPL, DIFC, ADGM and sector rules separately. The precise federal exclusions and their interaction with health, banking and free-zone law were not confirmed from the current official text. Record which regime applies to each processing activity before selecting a transfer mechanism.

DIFC and ADGM: separate regimes for financial free zones

The federal law keeps existing data protection laws in the DIFC and ADGM financial free zones intact 3. Many UAE groups have entities in both an onshore and a free-zone jurisdiction, so one CDP can serve three regimes.

Dubai Healthcare City. The DHCC Health Data Protection Regulation No. 7 of 2013 governs patient health information for licensed entities; penalties are unclear and there are no specific electronic-marketing provisions 5.

Health data localisation

Al Tamimi & Company describes Article 13 of the ICT Health Data Law as restricting offshore storage, processing, generation and transfer unless a health authority approves an exception in coordination with MOHAP. This is attributed legal commentary; the current exception instruments and emirate-specific hosting requirements were not retrieved. Al Tamimi, secondary source.

The practical effect for a CDP: patient identifiers combined with diagnosis, treatment or appointment data are health data, so the profile store, event pipeline, analytics and any AI inference that touch them should sit in the UAE unless an exception is documented. The healthcare industry hub covers the wider patient-data picture.

Banking and payments data

Marketing consent: telecom, consumer and social-media rules

Comparison of the UAE regimes

| Banking and payments | Licensed financial entities | Central Bank | Express consent for use or sharing | SVF and payments data stored in the UAE | Central Bank sanctions 3 |

What this means for a customer data platform in the UAE

• Build for the strictest overlap. Tag each profile with legal entity, regime and data class, and let policy decide storage, retention and activation. Rules will change when the Executive Regulations land, so keep them configuration, not code.
• Consent ledger. Hold purpose-level consent, channel, notice version and withdrawal state; require opt-in for telecom and social-media marketing and honour objections everywhere 3.
• Residency by data class. Health data and payment-scheme or SVF customer data stay in the UAE; other marketing data awaits the federal transfer rules, so avoid designs that cannot be relocated. A SaaS platform with UAE-region hosting can suit non-sensitive marketing data; see on-premise, private cloud and self-hosted customer data platforms.
• Vendor due diligence. Record processor and sub-processor locations, remote-access paths and breach-notice times. Our residency requirements by country and residency vs sovereignty pages help here.

PrivyCDP is a customer-owned platform that runs on-premise or in your own cloud account, which settles where the data sits and who holds keys; it does not replace consent, notice or breach duties. See deployment and the compliance guide. For the neighbouring regime, see Saudi PDPL and customer data.

UAE PDPL compliance checklist

• List legal entities and tag each as onshore, DIFC, ADGM or DHCC.
• Classify datasets: health, bank or payment, other marketing data.
• Keep health data in the UAE; document any Ministerial Decision 51 of 2021 exception 3.
• Keep SVF and retail-payment customer data in the UAE if licensed 3.
• Record purpose-level consent; require opt-in for electronic and social-media marketing 3.
• Offer a one-step opt-out and apply it across all channels.
• Add a right-to-object workflow for direct marketing and profiling (PDPL Art. 17; DIFC Art. 34) 34.
• Register as data controller with the ADGM Office of Data Protection where applicable 2.
• Run DPIAs for large-scale sensitive data or systematic profiling 3.
• Prepare a breach runbook covering the Data Office, the Central Bank and card-scheme timelines 3.
• Re-check the Executive Regulations and Cabinet penalty decision on the deadline tracker.

If your customer data platform must keep UAE health or payment-related profiles in a data centre or cloud account you control, a deployment qualification call scopes on-premise, private-cloud or hybrid options against these rules. More playbooks are in the regulation hub.