Privacy,operationalised.

The PDPL applies to controllers and processors established in the UAE (outside the DIFC and ADGM, which have their own laws) and to those outside the UAE processing personal data of UAE residents. Government entities, personal data held by security authorities and certain health and banking data governed by sector laws are carved out. Most private businesses onshore are within scope, and most free-zone businesses are within either the PDPL or a free-zone regime.

They are three separate regimes with three regulators. The PDPL, supervised by the UAE Data Office, governs onshore and most free zones. The DIFC Data Protection Law 2020 and the ADGM Data Protection Regulations 2021 govern entities in those financial free zones, require registration and annual assessments, and are actively enforced with fines. A group with entities in Dubai mainland, DIFC and ADGM must comply with all three; we build one programme that satisfies each.

Under the PDPL, a DPO is required where processing is high-risk, large-scale or involves sensitive data or systematic monitoring; the DIFC and ADGM regimes have similar triggers, and the DIFC requires a DPO for high-risk processing and for certain regulated entities. The DPDP Act requires Significant Data Fiduciaries to appoint an India-based DPO. Many clients appoint RPLC as an outsourced DPO to meet the requirement with a named, accountable professional.

Yes, with the right mechanism. The PDPL permits transfers to jurisdictions with adequate protection and otherwise requires appropriate safeguards, in practice contractual clauses. The DIFC and ADGM publish adequacy lists and standard contractual clauses. The DPDP Act allows transfers except to countries the Indian government restricts. We map each data flow and put the correct mechanism, and the paperwork behind it, in place.

The PDPL requires notification to the UAE Data Office without undue delay where a breach risks individuals' privacy or security, and to affected individuals where the risk is high. The DIFC and ADGM require notification as soon as practicable, generally within 72 hours. India's DPDP Act requires notification to the Data Protection Board and to affected individuals. Regulated financial institutions have shorter sector deadlines. A tested playbook is the only way to meet all of them at once.

If you process personal data of individuals in India in connection with offering goods or services to them, the DPDP Act applies regardless of where you are established. You need compliant notices and consent, a grievance mechanism, breach procedures and, if designated as a Significant Data Fiduciary, an India-based DPO, audits and DPIAs. Penalties reach INR 250 crore per breach category. We run DPDP readiness for Gulf-headquartered businesses regularly.

It is an excellent start; the PDPL and free-zone laws were modelled on the GDPR. But the differences matter: consent standards, DPO triggers, transfer mechanisms, breach-notification timing and registration duties differ, and the UAE laws do not recognise EU adequacy decisions. A GDPR programme typically needs a targeted UAE overlay rather than a rebuild; we scope exactly what that overlay is.

Gap assessments and DPIAs are fixed-fee. Full compliance programmes are staged with a fixed fee per phase. Outsourced DPO services run on monthly retainers scaled to processing volume and regulator exposure. Breach response is charged on time, with a pre-agreed retainer for clients who want a guaranteed same-day response.