The UAE's Federal Decree-Law No. 45 of 2021 (the Personal Data Protection Law, or PDPL) is deceptively short. Its brevity has been mistaken for permissiveness, when in fact its silences are where the practical risk lives — particularly around lawful bases for processing.
In practice, most Dubai and Abu Dhabi controllers still default to consent as a universal ground. This is a mistake. Consent under Article 6 requires a positive, specific, informed and unambiguous indication — the same standard the GDPR applies. Buried pre-ticked checkboxes, implied consent from continued browsing, or blanket consent obtained at onboarding for future, unspecified processing will not survive first review.
The under-used ground is legitimate interests. It requires a written balancing test — three parts: (i) the interest pursued, (ii) the necessity of the processing to pursue it, and (iii) whether the data subject's rights override that interest. Well-drafted, this ground unlocks a large portion of routine analytics, fraud prevention, direct marketing to existing customers, and network security processing without recourse to consent.
A note on cross-border transfers. The PDPL's transfer regime (Articles 22-23) is a two-tier model: transfers to jurisdictions on the UAE's adequacy list are permissible without further mechanism; transfers elsewhere require appropriate safeguards. As of Q4 2025, the UAE has not published a formal adequacy list — meaning, in practice, that most transfers require Standard Contractual Clauses. Draft your DPAs accordingly.
Finally, a word on DPO appointment. Article 10 requires designation where processing is 'high risk'. The Executive Regulations, still awaited at the time of writing, will clarify. Until then, err on the side of designation for any controller processing sensitive categories at scale, or engaging in large-scale profiling.
For advisors, the correct posture is not to answer every PDPL question with 'obtain consent' — it is to map each processing activity to the most defensible lawful basis, document the choice, and revisit it annually. That is the file a regulator will ask for.