United Arab EmiratesFederal Decree-Law on the Protection of Personal Data, cross-border transfer
Federal Decree-Law No. 45 of 2021, Arts. 22-23
In force since .
A cross border transfer rule binding private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of an individual in the onshore UAE to a recipient outside the UAE must rely on a Bureau adequacy determination for the destination, or on a PDPL-equivalent contractual safeguard, or on the Data Subject's explicit consent where the transfer does not contradict UAE public or security interest.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Must the Bureau approve a destination State or Province before Personal Data may be transferred under Article 22, which permits transfer 'in the following cases approved by the Bureau', and where does the Bureau publish the destinations it has approved?
What it makes you log
Logging duty
Articles 22 and 23 allow a transfer of personal data out of the State to a destination the Bureau has approved as adequate, or under a contract, the data subject's explicit consent or another listed ground. They require no log or record of a transfer. The controller's record of cross-border movement (Article 7(4)) is in an article this row does not cite, so it is not borrowed.
- Kind
- None
- As of
What this law does
Art. 22 permits transfer of personal data outside the UAE to a jurisdiction the Bureau (the UAE Data Office) has approved as having an adequate data-protection law and enforcement authority. Where no such adequacy finding exists, Art. 23 permits transfer under a contract binding the foreign recipient to PDPL-equivalent standards, or with the Data Subject's explicit consent provided the transfer does not contradict UAE public or security interest.
No blanket data-localization requirement was found; transfer is conditioned on one of these bases rather than prohibited outright.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .