Law note · United Arab Emirates

Federal Decree-Law on the Protection of Personal Data, cross-border transfer

cite Federal Decree-Law No. 45 of 2021, Arts. 22-23 stage IN FORCE in force since 2022-01-02 kind Cross border transfer binds public and private bodies reviewed 2026-08-29

What it requires

An app transferring the personal data of an individual in the onshore UAE to a recipient outside the UAE must rely on a Bureau adequacy determination for the destination, or on a PDPL-equivalent contractual safeguard, or on the Data Subject's explicit consent where the transfer does not contradict UAE public or security interest.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
processes_voice

What we found

Art. 22 permits transfer of personal data outside the UAE to a jurisdiction the Bureau (the UAE Data Office) has approved as having an adequate data-protection law and enforcement authority. Where no such adequacy finding exists, Art. 23 permits transfer under a contract binding the foreign recipient to PDPL-equivalent standards, or with the Data Subject's explicit consent provided the transfer does not contradict UAE public or security interest.

No blanket data-localization requirement was found; transfer is conditioned on one of these bases rather than prohibited outright.

Primary source

official statute text, UAE Legislation portal

← Back to the example · Lint your app →