Records / Laws and rulings

UAE Personal Data Protection Law, Articles 2(2)(g) and 28: free zones with their own data law are outside, Executive Regulations due within six months (Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data, Arts. 2(2)(g) and 28)

The federal law does not apply to companies in free zones that have their own data protection legislation, so a holder based in a free zone such as the DIFC or the ADGM follows that zone's law, which I did not read. The same law told the Cabinet to issue Executive Regulations within six months of its promulgation (Art. 28) and gave companies six months after them to comply (Art. 29); I could not confirm from a primary source that the Executive Regulations have been issued.

Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text

In the source's own words
“Companies and establishments located in free zones in the Country and have special ... legislations regarding Personal Data protection. ... shall issue the Executive Regulations of this Decree by Law within six (6) months as of the date on which the Decree by Law is promulgated.”
Also read from the same source
Figures it counts in

It is shown on its own, not counted into a figure.

UAE Personal Data Protection Law, Articles 2(2)(g) and 28: free zones with their own… | AIData.Broker