Law note · United Arab Emirates
Federal Decree-Law on the Protection of Personal Data, enforcement and supervision
cite Federal Decree-Law No. 45 of 2021, Arts. 25-26
stage IN FORCE in force since 2022-01-02
kind Enforcement supervision
binds public and private bodies
reviewed 2026-08-29
What it requires
- An app processing the personal data of an individual in the onshore UAE must be prepared to answer to the Bureau's supervisory powers; administrative penalty amounts are set by a separate Council of Ministers decision rather than the Decree-Law itself.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
What we found
The UAE Data Office ("the Bureau", established by Federal Decree-Law No. 44 of 2021) is the federal supervisory authority. A grievance against a Bureau decision goes to the Bureau itself first under Art. 25. Administrative penalty amounts are not set in the Decree-Law itself: Art. 26 requires a separate Council of Ministers decision, on the General Director's recommendation, to list violations and set administrative penalties.
No provision creating a private right of action for a Data Subject to sue a Controller directly was found in the articles read; this is recorded as not established rather than a confirmed absence, since the full Act was not read in its entirety.