The UAE Personal Data Protection Law (PDPL), Federal Decree-Law No. 45 of 2021, is the UAE’s main federal data protection law. If your organization collects data about customers, employees or website visitors in the UAE, it very likely applies to you.
This UAE PDPL compliance checklist turns the law into 12 practical steps, then shows how to support each one with Microsoft 365. It is written for IT, risk and compliance teams. It is not legal advice, so confirm details with your legal advisers.
Who Does the UAE PDPL Apply To?
The PDPL applies to the processing of personal data of people in the UAE, and to controllers and processors established in the UAE. It covers automated and manual processing.
Some areas are excluded or covered by other rules, including:
- Government data and authorities that control or process it.
- Companies in DIFC and ADGM, which have their own data protection laws.
- Health and banking data that already fall under specific sector laws.
- Personal data processed for purely personal purposes.
UAE PDPL vs GDPR: Key Differences
| Topic | UAE PDPL | EU GDPR |
|---|---|---|
| Legal basis | Consent is central, with defined exceptions | Six lawful bases, including legitimate interests |
| Regulator | UAE Data Office | National data protection authorities |
| Scope | UAE, excluding DIFC, ADGM and some sectors | EU and EU residents’ data worldwide |
| DPO | Required in specific high-risk cases | Required in defined cases |
| Details | Many specifics set by executive regulations | Detailed in the regulation and guidance |
If you already follow GDPR, much of your work carries over. Our GDPR advisory and data protection services can help map the differences.
The 12-Step UAE PDPL Compliance Checklist
1. Confirm scope and role
Decide whether you are a controller, a processor or both, and which entities, free zones and systems are in scope.
2. Build a data inventory
List what personal data you hold, where it lives, why you collect it and who can access it. Include Microsoft 365, CRM, HR and finance systems.
3. Identify sensitive personal data
Flag health, biometric, religious, criminal and similar categories. These need stronger controls.
4. Document lawful processing and consent
Record the basis for each processing activity. Make consent clear, specific and easy to withdraw.
5. Update privacy notices
Tell people what you collect, why, how long you keep it and how to exercise their rights.
6. Set up data subject request handling
Create a process to handle access, correction, erasure, portability and objection requests on time.
7. Apply security controls
Use MFA, least privilege access, encryption and device management. See our guide to identity and access management in Microsoft 365.
8. Classify and protect data
Apply sensitivity labels and data loss prevention. Learn how in What is Microsoft Purview DLP.
9. Define retention and deletion
Keep personal data only as long as needed, then delete it under policy, not by accident.
10. Prepare for breaches
Write an incident response plan that includes notifying the UAE Data Office and, where required, affected individuals.
11. Control cross-border transfers
Know where your data is stored. Transfers outside the UAE need an adequate destination or another permitted basis.
12. Appoint an owner and train staff
Name a DPO or privacy lead, train employees and review compliance at least once a year.
How Microsoft 365 Supports Each Step
| Checklist step | Microsoft 365 capability |
|---|---|
| Data inventory | Purview Content Explorer and data classification |
| Sensitive data | Sensitive information types and trainable classifiers |
| Security controls | Entra ID Conditional Access, Intune, Defender |
| Classify and protect | Sensitivity labels, encryption and DLP |
| Retention and deletion | Retention policies and labels |
| Data subject requests | Purview eDiscovery and content search |
| Breach readiness | Audit logs, Defender XDR and Sentinel |
| Data residency | Microsoft 365 data residency in UAE regions |
Planning to roll out Copilot? Labels and DLP also stop personal data appearing in AI answers. See our Microsoft 365 Copilot readiness checklist.
Common PDPL Compliance Mistakes
- Assuming DIFC or ADGM rules apply to mainland operations, or the other way round.
- Writing policies without technical controls to enforce them.
- Keeping personal data forever because nobody owns deletion.
- Forgetting personal data in email, Teams chats and OneDrive.
- Not testing the breach notification process.
Get Help With UAE PDPL Compliance
M365 Enterprise Hub helps organizations turn PDPL requirements into working controls. Explore our UAE PDPL compliance services, Microsoft Purview compliance setup and data classification and retention policies, or book a free PDPL readiness call.
Frequently Asked Questions
What is the UAE PDPL?
The UAE Personal Data Protection Law is Federal Decree-Law No. 45 of 2021. It sets rules for how organizations collect, use, store, share and protect personal data in the UAE, and it gives individuals rights over their data.
Does the UAE PDPL apply to companies in DIFC or ADGM?
Generally no. DIFC and ADGM have their own data protection laws and regulators. Companies in those free zones follow the DIFC Data Protection Law or the ADGM Data Protection Regulations instead.
Does the UAE PDPL apply to companies outside the UAE?
It can. The law covers processing of personal data of people in the UAE and processing carried out by controllers or processors established in the UAE, wherever the data is processed.
Do we need a Data Protection Officer under the UAE PDPL?
A DPO is required in specific cases, such as large-scale processing of sensitive personal data or systematic monitoring of individuals. Many organizations appoint one anyway to own compliance.
What rights do individuals have under the PDPL?
Individuals can request access to their data, correction, erasure, restriction of processing, data portability and can object to certain processing, including some automated decisions.
Do we have to report data breaches?
Yes. The law requires controllers to notify the UAE Data Office of breaches that affect the privacy or security of personal data, and in some cases the affected individuals. Check the latest executive regulations for timelines.
Can Microsoft 365 help with UAE PDPL compliance?
Yes. Microsoft Purview tools such as sensitivity labels, DLP, retention, audit and data subject request support help you put PDPL controls in place and produce evidence.
Is this article legal advice?
No. It is a practical overview. Confirm your obligations with qualified legal counsel and the latest guidance from the UAE Data Office.