Guide · 6 min read
UAE PDPL for startups: a practical personal data protection checklist
What UAE startups need to know about Federal Decree-Law No. 45 of 2021 (the PDPL): consent, data subject rights, security and cross-border transfers, with a practical checklist and official sources.
By Startup Roof Editorial ·
General information, not legal advice. Data protection rules depend on where your company is established, what data you process and where your users are. Some free zones, including DIFC and ADGM, have their own data protection laws. Take advice for your situation.
Almost every startup handles personal data: sign-up emails, customer phone numbers, employee records, analytics. In the UAE, the main federal law is Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data, known as the Personal Data Protection Law or PDPL. It came into force on 2 January 2022 (u.ae: Data protection laws; UAE Legislation).
You don't need a legal department to get the basics right. You need to know what data you hold, why, and how you protect it. This guide explains the main ideas and gives you a checklist to work through.
What the PDPL covers
According to u.ae, the PDPL:
- Applies to the processing of personal data, in full or in part, through electronic systems, inside or outside the country.
- Sets controls for processing personal data and general obligations for companies to secure it and keep it confidential and private. It prohibits processing personal data without the owner's consent, except in some cases where processing is necessary, for example to protect a public interest or to carry out legal procedures and rights.
- Gives individuals the right to request corrections of inaccurate data and to restrict or stop processing of their data.
- Sets requirements for cross-border transfer and sharing of personal data.
The UAE Data Office, affiliated with the UAE Cabinet, is described on u.ae as the federal data regulator, responsible for data protection policies and legislation, standards for monitoring the PDPL, complaints systems, and guidelines for implementing the law.
Which law applies to you?
The UAE has more than one data protection regime:
- The federal PDPL applies broadly across the UAE.
- Financial free zones have their own laws. u.ae mentions the DIFC's Data Protection Law, DIFC Law No. 5 of 2020. ADGM also has its own regulations.
- Sector rules apply on top. For example, u.ae notes that Federal Law No. 2 of 2019 regulates the use of ICT in health fields, and Federal Law No. 15 of 2020 on Consumer Protection protects consumer rights, including their data.
- Dubai has its own Dubai Data law, which u.ae notes includes data protection and privacy among its aims.
If you're in DIFC or ADGM, or in health or financial services, check those rules specifically. If you serve users abroad (for example in the EU), their laws may apply too.
We've kept this article to what's stated on official pages. The PDPL's detailed implementing rules, including any registration, breach notification timelines or penalties, should be checked on the official legislation portal and with the UAE Data Office before you rely on them.
Key ideas in plain words
Personal data is any information that identifies a person or could identify them: name, email, phone, ID number, location, photos, and often device identifiers.
Processing means almost anything you do with it: collecting, storing, using, sharing, deleting.
Consent is the starting point under the PDPL, with exceptions. Consent should be clear and specific. A pre-ticked box buried in terms of service is not a good basis.
Individuals' rights include asking you to correct their data and to restrict or stop processing it. You need a simple way to receive and handle those requests.
Security is your responsibility. You must protect the data you hold and keep it confidential.
Cross-border transfers have rules. Many startups use cloud tools hosted outside the UAE, so this matters more than founders expect.
The startup PDPL checklist
1. Map your data
You can't protect what you don't know you have. Make a simple sheet with:
- What personal data you collect (sign-ups, customers, employees, suppliers).
- Where it comes from (forms, payments, imports, WhatsApp, events).
- Why you collect it.
- Where it's stored (which tools, which countries).
- Who has access, internally and externally.
- How long you keep it.
Update it whenever you add a new tool or form.
2. Collect less
Only collect what you need for a clear purpose. Every extra field is extra risk. If you don't need a date of birth or ID copy, don't ask.
3. Get consent right
- Ask clearly, at the point of collection, in plain language.
- Separate marketing consent from service consent. Someone signing up for your product hasn't automatically agreed to a newsletter.
- Record when and how consent was given.
- Make it as easy to withdraw as to give.
4. Write a clear privacy notice
Your privacy notice should explain, in plain words: what you collect, why, who you share it with, where it's stored, how long you keep it, how people can exercise their rights, and how to contact you. Link it from every form.
5. Handle requests
Set up a simple process: one email address, one person responsible, a log of requests and what you did. Verify identity before changing or sharing data.
6. Secure the data
Practical basics that cover a lot of risk:
- Two-factor authentication on every business account.
- Access only for people who need it; remove it when they leave.
- Strong, unique passwords stored in a password manager.
- Encryption for devices and backups.
- No customer data in personal email or personal cloud drives.
- Regular backups, tested.
7. Check your vendors
Your CRM, email platform, analytics, payment provider and cloud host all process personal data for you. For each:
- Know where they store data.
- Read their data processing terms.
- Check how they handle transfers outside the UAE.
- Keep a list.
8. Plan for incidents
Decide now who does what if data is lost, leaked or accessed without permission: who investigates, who decides whether to notify, how you contact affected people and any authority. Check the current notification requirements with the UAE Data Office or your free zone regulator.
9. Employees and contractors
Employee data is personal data too. Store contracts, ID copies and payroll data securely, limit access, and include confidentiality obligations in contracts. See our guide to hiring your first employee.
10. Review regularly
Every quarter: update the data map, review access, check new tools, and confirm your privacy notice still matches what you do.
Marketing and messaging
Founders often run into trouble with marketing. Before sending marketing messages by email, SMS or WhatsApp:
- Make sure you have consent for marketing specifically.
- Don't buy or scrape contact lists.
- Include a clear way to opt out, and honour it quickly.
- Be careful with consumer data: u.ae notes the Consumer Protection Law prohibits suppliers from using consumer data for marketing.
Why it matters beyond compliance
Good data handling builds trust with customers, makes enterprise sales easier (security questionnaires get simpler), and comes up in investor due diligence. See our guide to investor readiness.
Quick-reference checklist
Where Startup Roof fits
Protecting customer data is part of building a company people trust. Startup Roof is a UAE-first founder ecosystem with source-checked guides, founder tools and templates, and a community of founders building here. Chat with our assistant on WhatsApp: wa.me/16475599949. Explore startuproof.com to see what's there. Questions or corrections: hello@startuproof.com.
Build. Scale. Grow.
Sources (checked 16 Oct 2026)
- u.ae: Data protection laws (page dated 4 Dec 2025)
- UAE Legislation portal (for the full text of Federal Decree-Law No. 45 of 2021)
Put this into practice in Founder OS.
Join free