United Arab EmiratesFederal Decree-Law on the Protection of Personal Data, enforcement and supervision
Federal Decree-Law No. 45 of 2021, Arts. 25-26
In force since .
An enforcement supervision rule binding private bodies.
- Audit expectation
- none
What it requires
- An app processing the personal data of an individual in the onshore UAE must be prepared to answer to the Bureau's supervisory powers; administrative penalty amounts are set by a separate Council of Ministers decision rather than the Decree-Law itself.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Which actions are violations, and what administrative penalties apply, under the decision that Article 26 says the Council of Ministers 'shall issue a decision to limit the actions which constitute a violation of this Decree by Law and its Executive Regulations', and has that decision been issued?
What it makes you log
Logging duty
Article 25 lets a stakeholder submit a written grievance to the Bureau's General Director against a Bureau decision, and Article 26 leaves the violations and administrative penalties to a Council of Ministers decision. Neither requires a controller to make, keep or produce a log or record, and neither sets out a power to demand records or to audit. The controller's duty to submit its record to the Bureau on request (Article 7(4)) is in an article this row does not cite, so it is not borrowed.
- Kind
- None
- As of
What this law does
The UAE Data Office ("the Bureau", established by Federal Decree-Law No. 44 of 2021) is the federal supervisory authority. A grievance against a Bureau decision goes to the Bureau itself first under Art. 25. Administrative penalty amounts are not set in the Decree-Law itself: Art. 26 requires a separate Council of Ministers decision, on the General Director's recommendation, to list violations and set administrative penalties.
No provision creating a private right of action for a Data Subject to sue a Controller directly has been located; the point is not established rather than a confirmed absence.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .