[Home](/)/[Resources](/resources)/UAE Data Protection (PDPL) UAEData Protection # UAE Personal Data Protection Law (PDPL): Obligations for Connected Product Makers Every connected device sold in the UAE collects personal data — and every piece of that data is now subject to Federal Decree-Law No. 45 of 2021. The UAE PDPL applies to companies outside the UAE as well as those inside it. This guide covers what connected hardware makers must do: data mapping, lawful bases, privacy notices in Arabic, and cross-border transfer mechanisms. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fuae-data-protection-pdpl) At a glance Law Federal Decree-Law No. 45 of 2021 Regulator UAE Data Office Scope Personal data of UAE residents Cross-border Adequacy or safeguards required ## What the UAE PDPL requires from connected product makers ### PDPL scope and personal data definition Federal Decree-Law No. 45 of 2021 (UAE PDPL) applies to any processing of personal data relating to individuals in the UAE, regardless of where the data controller or processor is established. For connected hardware makers, personal data includes any information that identifies or can identify a device user — names, email addresses, device identifiers, IP addresses, location data, usage telemetry, and biometric data. The law applies extraterritorially: a company outside the UAE that sells connected products to UAE residents and collects their data is within PDPL scope. ### Lawful bases for processing — consent, contract, legal obligation, legitimate interest PDPL requires that every data processing activity rests on a defined lawful basis. The recognised bases are: the data subject's explicit consent; the necessity of processing to perform a contract with the data subject; compliance with a legal obligation; protection of the vital interests of the data subject; performance of a task carried out in the public interest; and legitimate interests of the controller, provided they do not override the data subject's rights. For connected products, the most commonly applicable bases are consent (for non-essential telemetry and analytics) and contract (for data necessary to operate the product's core functionality). ### Data subject rights — access, correction, deletion, portability UAE PDPL grants data subjects a suite of rights: the right to access their personal data and obtain a copy; the right to correct inaccurate data; the right to request erasure of data where retention is no longer justified; the right to restrict or object to processing; and the right to data portability (receiving data in a structured, machine-readable format). Connected hardware makers must implement processes to receive, verify, and respond to data subject rights requests within the timeframes set by the UAE Data Office. Failure to respond to legitimate requests is a compliance failure that can be reported to the regulator. ### Cross-border data transfer restrictions and mechanisms Transferring personal data of UAE residents outside the UAE requires either that the destination country has been determined by the UAE Data Office to provide an adequate level of protection, or that the controller implements appropriate safeguards — such as standard contractual clauses approved by the Data Office, binding corporate rules, or explicit data subject consent for the specific transfer. Cloud-hosted connected product backends that process UAE resident data outside the UAE must have a documented transfer mechanism in place. The UAE Data Office has not yet published a comprehensive adequacy list, so most transfers rely on contractual safeguards. ## PDPL compliance steps for hardware companies 01 Map all personal data collected by the connected product and its associated mobile app, cloud backend, and support systems. Document what data is collected, why it is collected, where it is stored, who can access it, and how long it is retained. This data inventory is the foundation of PDPL compliance. 02 Identify the lawful basis for each distinct data processing activity. Distinguish between data necessary to operate the product (contract basis), data used for analytics or product improvement (likely requires consent), and data shared with third parties (requires its own basis and, if shared cross-border, a transfer mechanism). 03 Prepare a PDPL-compliant privacy notice in both Arabic and English. The notice must explain: what data is collected, the lawful basis for each processing activity, data retention periods, data subject rights and how to exercise them, cross-border transfer destinations and safeguards, and contact details for the data controller. 04 Implement a data subject rights response process. This includes an intake channel (email, in-app form, or web form), identity verification steps to prevent fraudulent requests, and a workflow that can deliver a response — access copy, correction, erasure, or portability export — within the UAE Data Office's stipulated timeframe. 05 Assess all cross-border data transfers involving UAE resident data. For each transfer destination that lacks a UAE Data Office adequacy determination, put in place standard contractual clauses or obtain explicit data subject consent for the transfer. Document the transfer mechanism in your records of processing activities. ## Frequently asked questions ### Does PDPL apply to companies outside the UAE? Yes. UAE Federal Decree-Law No. 45 of 2021 applies extraterritorially to any controller or processor that processes personal data of individuals in the UAE, regardless of where the controller is established. A hardware company headquartered in Europe or the US that sells connected products to UAE residents and collects their usage data is within PDPL scope. The practical enforcement reach of the UAE Data Office against foreign companies without a UAE presence is still developing, but the legal obligation exists regardless of physical location. ### What data from a connected device counts as personal data? Under the UAE PDPL, personal data is any information that relates to an identified or identifiable natural person. For connected hardware, this includes: user account information (name, email, phone number); device identifiers (MAC addresses, serial numbers linked to a registered user); location data (GPS coordinates, network-derived location); usage telemetry (when the device is used, what features are accessed); biometric data (fingerprints, voice patterns used for authentication); and IP addresses. Aggregated or genuinely anonymised data that cannot be re-linked to an individual falls outside the definition, but anonymisation must be robust — pseudonymous data remains personal data. ### How do UAE PDPL requirements compare with GDPR? The UAE PDPL is structurally similar to the GDPR: it uses the same core concepts of data controllers and processors, lawful bases for processing, data subject rights, and cross-border transfer restrictions. Key differences include: the UAE Data Office is still building its regulatory infrastructure and enforcement track record; the UAE PDPL does not yet have a formal adequacy mechanism equivalent to the EU adequacy decision list; maximum fines under PDPL are lower than GDPR's 4% of global turnover cap; and the UAE PDPL has specific provisions aligned with GCC-region regulatory culture. Companies already GDPR-compliant will find significant overlap, but UAE-specific requirements — particularly the Arabic privacy notice requirement and the absence of an adequacy list — require dedicated attention. ### What penalties apply for PDPL violations? The UAE PDPL provides for administrative penalties issued by the UAE Data Office, with fines scaling according to the severity of the violation. Serious violations — such as unlawful cross-border transfers, failure to implement security measures resulting in a breach, or processing sensitive personal data without required consent — carry higher penalties. Criminal penalties, including imprisonment, can apply to the most serious violations involving intentional breach of data subject rights or unlawful disclosure. The UAE Data Office can also order suspension of data processing activities, which for a connected product maker would be operationally severe. **Disclaimer:** Educational resource only. Regulatory requirements change and vary by product category. Consult an accredited test laboratory or qualified compliance engineer before making certification decisions. 🇦🇪 UAE roadmap for your product Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take your product through 🇦🇪 UAE compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course — $149](/courses/51-uae-moiat-ecas-conformity-consumer-electronics)[Prefer to read? Get the book — $24.99](/books/51-uae-moiat-ecas-conformity-consumer-electronics) Related guides * [UAE Compliance OverviewComplete guide to UAE product compliance: TDRA telecom type approval, MOIAT ECAS certification, EDE medical device registrati…](/guides/uae-compliance-overview) * [Canada Privacy Law for Connected DevicesPIPEDA and incoming Bill C-27/CPPA privacy obligations for connected devices sold in Canada: consent, breach notification, and IoT data mapping.](/guides/canada-privacy-law-connected-devices) * [Hong Kong PDPOHong Kong PDPO Cap. 486 for connected hardware: the six Data Protection Principles, direct marketing restrictions, and cross-border transfer obligations.](/guides/hong-kong-data-privacy-pdpo) * [Australia Privacy Act for Connected DevicesAustralia Privacy Act 1988 for connected devices: the 13 APPs, NDB 30-day breach notification, and 2024 reform obligations for IoT product makers.](/guides/australia-privacy-act-connected-devices)