UAE Personal Data Protection Law, Articles 22 and 23: sending personal data outside the UAE (Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data, Arts. 22(1) and 23(1)(a)-(b))
Personal data may leave the UAE to a country the UAE Data Office has approved as having a data protection law and a regulator (Art. 22), or, where the country has no such law, under a contract binding the recipient to the UAE law's standards, or with the person's explicit consent (Art. 23). I found no approval or list naming the United States, and the Executive Regulations that are to set the controls for transfers (Art. 23(2)) were not found, so for a US buyer the practical routes are explicit consent or a contract. The transfer cannot contradict the public or security interest of the State.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“Personal Data may be transferred to outside of the State in the following cases approved by the Bureau: 1. The State or Province to which the Personal Data is transferred shall have legislations addressing Personal Data Protection. ... Companies, operating in countries where there are no laws for Data Protection, may transfer data under a contract or agreement obligating the companies in such countries ... to adopt measures, controls and requirements set out in this Decree by Law ... If there is an explicit consent granted by the Data Subject to transfer his/her Personal Data outside the State, provided that such transfer shall not contradict the public or security interest of the State.”
Where it was read
Also read from the same source
- UAE Personal Data Protection Law, Article 4: no processing without the owner's consent, with a closed list of exceptions (Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data, Art. 4)
- UAE Personal Data Protection Law, Article 5: collect for a specific purpose, no incompatible later use, keep only if anonymised (Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data, Art. 5(2) and 5(7))
- UAE Personal Data Protection Law, Article 1: what personal data is (voice included) and what anonymization means (Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data, Art. 1 (definitions of Personal Data and Anonymization))
- UAE Personal Data Protection Law, Articles 2(2)(g) and 28: free zones with their own data law are outside, Executive Regulations due within six months (Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data, Arts. 2(2)(g) and 28)
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides