If your website or app collects names, emails, phone numbers or any other information about people, data protection law applies to you. In the UAE the main federal law is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, often called the PDPL. Here is what product owners should know.
Who it applies to
The PDPL covers the processing of personal data of people in the UAE, and companies established in the UAE that process personal data, whether the processing happens inside or outside the country. Some areas have their own separate regimes: the financial free zones DIFC and ADGM have their own data protection laws, and certain sectors such as health and banking have additional rules.
The core principles
- Lawful basis: in most cases you need the person's clear consent, or another basis permitted by the law, before processing their data.
- Purpose limitation: collect data for specific, clear purposes and don't use it for unrelated ones.
- Data minimisation: only collect what you actually need.
- Accuracy and retention: keep data correct and don't keep it longer than necessary.
- Security: protect data with appropriate technical and organisational measures.
People's rights
Individuals have rights over their data, including the right to be informed, to access their data, to have it corrected, and in certain cases to have it erased or to restrict or object to processing. Your product should make these requests easy to submit and handle.
Privacy is cheapest when it is designed in from day one, and most expensive when it is bolted on after launch.
What this means for your product
- Publish a clear privacy policy that explains what you collect and why.
- Ask for consent where required, and record it.
- Encrypt data in transit (HTTPS) and protect it at rest.
- Limit who in your team and your suppliers can access personal data.
- Have a plan for detecting and reporting data breaches.
- Check the rules before transferring data to servers or services outside the UAE.
A moving target
Detailed implementing regulations and guidance continue to develop, so requirements can change. Review your position regularly, and take legal advice for anything specific to your business.
This article is a general overview for information only and is not legal advice. Always consult a qualified UAE lawyer about your obligations. Atlas Group can help with the technical side of compliance; contact us to learn more.
