United Arab Emirates
Saudi Arabia
UAE PDPL Compliance
The UAE PDPL, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, sets rules for how organisations collect, use, share and protect personal data. We help businesses operating in the UAE understand what applies to them and put practical processes and controls in place.
- Know what personal data you hold
- Processes for rights requests
- Security controls that back it up
UAE PDPL compliance is the work of aligning how an organisation collects, uses, stores, shares and secures personal data with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Shyphan AI ITSM helps businesses in the UAE map their data, build privacy processes and apply technical security controls, working alongside legal advisers on interpretation.
UAE PDPL ComplianceUAE PDPL Compliance: what it involves
The federal data-protection law applies to organisations that process personal data in the UAE, and to some outside the country that process data of people in the UAE. Financial free zones such as DIFC and ADGM have their own data-protection regimes, so groups with entities in several zones need to know which rules apply where. Many companies hold customer, employee and supplier data in CRMs, spreadsheets, HR systems and email without a clear record of what they hold or why.
We start with data mapping across your systems and teams, recording what personal data you process, the purpose, where it is stored and who receives it, including transfers outside the UAE. We then review privacy notices, consent, retention, data subject request handling and breach procedures. On the technical side we assess access control, encryption, logging and backups. Legal interpretation stays with your legal advisers; we deliver the operational and security work.
Where readiness starts
- 1A record of the personal data you process and why
- 2Clarity on which entities fall under federal law or a free zone regime
- 3Privacy notices that match what you actually do
- 4A named owner for data-protection requests
- 5A tested breach response procedure
Our UAE PDPL Compliance scope
Readiness support for the UAE Personal Data Protection Law, from data mapping to controls.
Records of what personal data you hold, why and where.
Notices and consent wording reviewed with your legal team.
A process to receive, verify and answer rights requests.
Steps for detecting, assessing and reporting data breaches.
Transfers of personal data outside the UAE identified.
Access, encryption and monitoring that protect personal data.
What you receive, and what shapes the cost
What you receive
- Personal data inventory and data-flow map across systems and vendors
- Privacy notice drafts for review by your legal advisers
- Data subject request procedure with templates and a request log
- Personal data breach response procedure and contact list
- Security controls report linking technical measures to the data they protect
What affects the cost
- Number of entities, systems and processing activities
- Volume of personal data and how sensitive it is
- Number of vendors and cross-border transfers to review
- Amount of technical control implementation required
UAE PDPL Compliance: project phases
- 01Discover data
We identify what personal data you hold, where it sits and who receives it.
- 02Assess gaps
Current practice is compared with the obligations your advisers confirm apply.
- 03Build processes
Notices, request handling, breach response and vendor terms are put in place.
- 04Secure and maintain
Technical controls are applied and records are kept current as systems change.
Common UAE PDPL Compliance mistakes
DIFC and ADGM have their own data-protection laws, so confirm which rules apply to each entity.
Employee and candidate records are personal data too, so include HR and payroll systems.
Cloud apps and outsourced services process your data, so review their contracts and locations.
Policies without access control, encryption and logging leave real risk, so pair them with technical measures.
UAE PDPL Compliance terms explained
- Personal data
- Any information that identifies, or can be used to identify, a living individual.
- Controller
- The organisation that decides why and how personal data is processed.
- Processor
- An organisation that processes personal data on behalf of a controller.
- Data subject request
- A request from an individual to exercise a right, such as access to or correction of their data.
The difference you will notice
- 01Clear data inventory
You know what personal data you hold and where.
- 02Working processes
Requests and incidents handled consistently.
- 03Protected data
Security measures that match the sensitivity of the data.
Five steps from assessment to always-on support
- STEP 01Assess
We review your infrastructure, security posture, assets and support model, and agree priorities.
- STEP 02Design
A clear architecture and plan, with scope, timeline and a fixed quote before work starts.
- STEP 03Deploy
We supply, install, configure and migrate, then document everything we build.
- STEP 04Manage
Ongoing support, monitoring and maintenance under agreed SLAs.
- STEP 05Improve
Regular reviews, reports and recommendations as your business grows.
UAE PDPL Compliance in the UAE and Saudi Arabia
Local offices in Ras Al Khaimah and Riyadh, remote support around the clock and on-site visits where your project needs them.
UAE PDPL Compliance in the UAE
Shyphan AI Technology LLC, RAK Free Trade Zone, Ras Al KhaimahUAE groups often combine mainland companies covered by the federal PDPL with entities in DIFC or ADGM that follow their own data-protection laws, so we map each entity to the regime your advisers confirm. Where Microsoft 365 or Azure is used, data can be kept in the UAE North and UAE Central regions, which simplifies transfer questions. We support the Emirates from our Ras Al Khaimah office, remotely around the clock and on site where needed.
- Data handled in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), and the separate DIFC and ADGM regimes where they apply.
UAE PDPL Compliance in Saudi Arabia
Shyphan AI Technologies LLC, Malaz, King Abdulaziz Road, RiyadhOrganisations operating in both the UAE and Saudi Arabia must meet the UAE PDPL and the Saudi PDPL, overseen by SDAIA, which differ in detail. We build one data inventory and set of processes that can be mapped to both laws, with Riyadh-based support for the Saudi side and legal review by your advisers. Our Riyadh office leads this work in the Kingdom.
- Work aligned with the Saudi Personal Data Protection Law (SDAIA) and, for government and critical infrastructure, the NCA Essential Cybersecurity Controls.
More in Cybersecurity & Compliance Services
Core serviceCompliance & Data PrivacyMap your controls to the frameworks and data-protection laws you must meet, and keep the evidence ready.Service overview 
Compliance & Data PrivacyISO/IEC 27001 ConsultingGap assessment, ISMS build and audit preparation for ISO/IEC 27001 certification.Explore service 
Compliance & Data PrivacySaudi PDPL ComplianceReadiness support for Saudi Arabia's Personal Data Protection Law, overseen by SDAIA.Explore service Compliance & Data PrivacyNCA ECC Compliance (Saudi Arabia)Gap assessment and remediation against the NCA Essential Cybersecurity Controls.Explore service 
Compliance & Data PrivacyIndia DPDP Act ComplianceReadiness support for India's Digital Personal Data Protection Act, 2023.Explore service Compliance & Data PrivacyUK GDPR CompliancePractical UK GDPR and Data Protection Act 2018 readiness, from records to security.Explore service UAE PDPL Compliance: common questions
Does the UAE PDPL apply to companies in DIFC or ADGM?
The DIFC and ADGM financial free zones have their own data-protection laws. Groups with entities inside and outside those zones may need to address more than one regime.
Are you a law firm?
No. We provide data mapping, process design and security controls. Legal advice should come from qualified legal advisers, whom we work alongside.
Who oversees the UAE PDPL?
The law is overseen by the UAE Data Office, a federal authority set up for personal data protection.
Can Zoho or Microsoft 365 settings help?
Yes. Access controls, audit logs, retention policies and data residency options in these platforms support your obligations when they are configured properly.
Can the UAE PDPL apply to a company serving UAE customers from abroad?
The law can reach some processing outside the UAE that relates to people in the country. Your legal advisers should confirm how it applies, and we can then build the processes and controls.
What technical controls support UAE PDPL compliance?
Common measures include access control, MFA, encryption, logging, data loss prevention and tested backups. The right mix depends on the data you hold and the risks involved.
Do you provide UAE PDPL Compliance in Dubai and Riyadh?
Yes. We deliver UAE PDPL Compliance across the UAE from our Ras Al Khaimah office and across Saudi Arabia from our Riyadh office, with remote support 24/7 and on-site visits in cities such as Dubai, Abu Dhabi, Riyadh, Jeddah and Dammam where your project needs them.
Talk to us about UAE PDPL Compliance
Book a consultation or request a quote. A consultant replies with scope, timeline and a fixed price.
Prefer to talk?