Do You Need Data Privacy & Protection Advisory? A Practical Starting Point
Data Privacy & Protection Advisory helps UAE-based businesses map how they actually collect, use, store, and share personal data, then closes the gap between that reality and their obligations under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), the DIFC Data Protection Law, ADGM's Data Protection Regulations, and sector-specific rules that layer on top of them. Most businesses treat privacy as a policy document sitting in a shared drive; PNPC treats it as a control environment — a data inventory that matches what systems actually hold, consent and notice mechanisms that match what forms and apps actually capture, a breach-response plan someone has actually rehearsed, and a designated privacy contact who can answer a regulator's question without guessing.
Understanding the Service
Data Privacy & Protection Advisory is the practice of assessing how a UAE entity collects, processes, stores, shares, and disposes of personal data, and then designing the policies, technical controls, and governance structure needed to bring that handling into line with applicable UAE data protection law. The UAE's core federal framework is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL), which came into effect in 2022 and applies broadly to the processing of personal data of individuals inside the UAE by entities established in the UAE or processing data of individuals in the UAE, regardless of the processing entity's own location, subject to specified exclusions (including government data processed for national security purposes and certain data already regulated under sector-specific health, banking, or financial data laws).
For the full scope, current process and what PNPC includes, see the dedicated Data Privacy & Protection Advisory service page.
Is This Relevant to Your Business?
- The business collects, stores, or processes personal data of customers, employees, or third parties in the UAE — which covers the overwhelming majority of operating businesses, from e-commerce and retail to professional services and manufacturing — and has never conducted a structured assessment of its PDPL, DIFC, or ADGM obligations
- The business transfers personal data outside the UAE, whether to a group parent, a cloud hosting provider, an offshore processing team, or a SaaS vendor, and is unsure whether that transfer requires a specific safeguard or documented basis under the applicable data protection law
- A customer, employee, investor, or regulator has asked for a copy of the entity's privacy policy or data protection programme, and the business does not currently have one that reflects actual practice
- The entity is DIFC or ADGM-registered and needs its data protection programme built and documented specifically against that centre's own law and Commissioner/Office of Data Protection expectations, rather than a generic mainland PDPL approach
What This Doesn't Cover
- The business is pre-revenue or pre-launch and has not yet built the systems, forms, or vendor relationships that will actually collect personal data — a data-flow map built on assumed rather than real systems will need to be redone once the business is live
- The business already has a properly documented, recently reviewed data protection programme aligned to the correct regime (PDPL, DIFC, or ADGM) — in this case, a periodic review or specific gap-check is more appropriate than a full ground-up advisory engagement
- What the business actually needs is bespoke technical implementation — encryption engineering, a customer consent-management platform build, or deep system integration — which is specialist engineering work PNPC can scope and coordinate but does not itself deliver as software development
Common Questions
Which UAE businesses are actually required to have a data protection programme in place?
Under Federal Decree-Law No. 45 of 2021 (the PDPL), obligations extend to any entity established in the UAE that processes personal data, and to entities outside the UAE that process personal data of individuals located in the UAE in specified circumstances, subject to defined exclusions. This covers the great majority of operating businesses — anyone with employees, customers, or website visitors is processing personal data. DIFC and ADGM-registered entities fall under those centres' own, separate data protection laws instead of the federal PDPL. PNPC confirms the applicable regime and scope for each specific business rather than assuming a default answer.
What is the difference between the federal PDPL, the DIFC Data Protection Law, and ADGM's Data Protection Regulations?
The PDPL is the federal law applying to mainland UAE and most free zones without their own dedicated data protection regime. DIFC and ADGM are financial free zones with their own independent legal systems, and each has enacted its own data protection law — the DIFC Data Protection Law and ADGM's Data Protection Regulations respectively — supervised by that centre's own regulator (the DIFC Commissioner of Data Protection and the ADGM Office of Data Protection). A group with a mainland trading entity and a DIFC-registered financial services arm can genuinely be subject to two different regimes for different parts of its operation. PNPC identifies which regime governs which entity at the outset of every engagement.
What counts as personal data under UAE law?
Personal data broadly means any information relating to an identified or identifiable natural person — names, Emirates ID and passport numbers, contact details, employment and financial records, IP addresses and device identifiers, and biometric data used for access control are all typically in scope. Certain categories — health data, biometric data, data revealing racial or ethnic origin or religious belief, and criminal record data — are commonly treated as sensitive personal data requiring a higher standard of protection and, in most regimes, a narrower set of lawful grounds for processing.
Working With PNPC Global
Talk to PNPC before your privacy policy is tested by a regulator, a breach, or an investor's due diligence checklist — not after.
PNPC Global has advised Dubai businesses since 1986. Explore the full Business Transformation & Technology Consulting practice for related services, or go straight to the Data Privacy & Protection Advisory page for specifics.
Specific rates, fees, thresholds and deadlines are set by the relevant authority and change over time — this article deliberately does not quote figures that could go stale. Confirm current numbers directly with PNPC or the official source before you act.