United Arab Emirates

Standard 2.1.1.26 of the Consumer Protection Standards of the Central Bank of the UAE requires a Licensed Financial Institution that rejects a Consumer's application for a Financial Product and/or Service to disclose the reason for rejection to the applicant, except where the reason of rejection is related to Financial Crime Compliance risks or as may be prohibited by law.

Standard 7.1.3.6 allows a Licensed Financial Institution to decrease the credit limit on a card or close the card due to business reasons, and requires that the Consumer be provided a notice and the reason for the limit decrease or closure.

Standard 8.1.1.4 requires the Complaint Management function to ensure that a written response is provided to the Consumer on the decision of the Licensed Financial Institution regarding the Complaint, including full and complete reasons for the decision, subject to lawful obligations.

Standard 8.1.2.1 requires a Licensed Financial Institution to inform a Consumer of the right to file a written Complaint through its Complaint management process when the Consumer has verbally expressed dissatisfaction with a Financial Product and/or Service and the matter cannot be resolved by frontline staff to the Consumer's satisfaction.

Standards 8.1.1.1 and 8.1.1.2 require a Licensed Financial Institution to have in place a Consumer Complaint Management function situated in the UAE that is independent of the management of Retail Operations. Standard 8.1.1.4 also requires the Complaint Management function to ensure that the timed performance standards of the Complaint process are monitored and reported quarterly to Senior Management on the adequacy of the actual performance.

The Standards state that all Licensed Financial Institutions must comply with them when the Licensed Financial Institution carries out licensed financial activities. The Standards state that they are mandatory and enforceable in the same manner as the Regulation.

The Consumer Protection Regulation and the accompanying Standards apply to all Licensed Financial Institutions licensed by the Central Bank in relation to their activities specified in Article 65 of Decretal Law 14 of 2018 regarding the Central Bank and the organization of financial institutions and activities, in the provision of Financial Products and/or Services to Consumers that are Natural Persons and Sole Proprietorships.

The Regulation defines Licensed Financial Institutions as banks and other financial institutions licensed in accordance with the provisions of the Decretal Federal Law 14 of 2018 to carry on a Licensed Financial Activity or more, including those which carry on the whole or a part of their business in compliance with the provisions of Islamic Shari'ah.

The Regulation defines a Consumer as a Customer, meaning any Natural Person or Sole Proprietor who obtains or may prospectively obtain Financial Services and/or Products, with or without charge, to satisfy his or her personal need or others' needs. The Regulation and the accompanying Standards are issued pursuant to the powers vested in the Central Bank according to Article 121 of the Decretal Federal Law 14 of 2018.

Article 13 of the Regulation provides that violation of any provision of the Regulation and the accompanying Standards may be subject to supervisory action, sanctions and penalties as deemed appropriate by the Central Bank.

Article 137 of the Central Bank Law provides that, on establishment of a violation by a Licensed Financial Institution of the regulations, decisions, rules, standards or instructions issued by the Central Bank in implementation of the Law, the Central Bank decides at its own discretion to impose one or more sanctions, which include a fine on the violating Licensed Financial Institution not exceeding 200,000,000 Dirhams.

Article 137 of the Central Bank Law also provides for a fine of between one time and ten times the value of the unjust enrichment, and for withdrawal of the license of the violating Licensed Financial Institution and striking off its name from the Register. The rulebook of the Central Bank lists the Consumer Protection Regulation, C 8/2020, as effective from December 25, 2020, with the status In-Force.

Article 15 of the Regulation provides that the Regulation and the accompanying Standards are to be published in the Official Gazette and are considered effective one month from the date of publication. The rulebook of the Central Bank lists the Consumer Protection Standards as N 1158/2021 with the status In-Force.

The Model Management Standards of the Central Bank of the UAE and the accompanying Model Management Guidance apply to all licensed banks in the UAE, which they call institutions, and the scope covers Islamic institutions. The Standards state that UAE branches or subsidiaries of foreign institutions must at a minimum apply them.

The Standards state that, throughout the document, the requirements associated with must are mandatory, while those associated with should are strongly recommended as robust modelling practice. The Standards apply to all types of models employed by institutions to support decision-making, and Table 1 of the Standards, a non-exhaustive list of the most commonly employed model types in UAE institutions, includes Artificial Intelligence.

The Standards state that they are effective one day after their publication date. The Standards require all institutions to submit the outcome of a self-assessment of the gaps between their practice and the Standards, and the plan to meet the requirements, to the CBUAE no later than six months from the effective date of the Standards.

The Standards state that institutions which repeatedly fall short of the requirements and do not demonstrate continuous improvement will face greater scrutiny and could be subject to formal enforcement action by the CBUAE.

Article 137 of the Central Bank Law provides that, on establishment of a violation by a Licensed Financial Institution of the regulations, decisions, rules, standards or instructions issued by the Central Bank in implementation of the Law, the Central Bank decides at its own discretion to impose one or more sanctions, which include a fine on the violating Licensed Financial Institution not exceeding 200,000,000 Dirhams.

The Standards require institutions to define a comprehensive model management framework to ensure that models are used effectively for decision-making and that Model Risk is appropriately understood and mitigated, covering all models used to make decisions within the institution. The Standards require Model Risk to be incorporated in the risk framework of institutions and managed through a formal process that identifies, measures, monitors, reports and mitigates this risk.

The Standards require institutions to establish a Model Oversight Committee accountable for all significant modelling decisions related to each step of the model life-cycle. The Standards state that the Board bears the responsibility of all modelling decisions with material implications for the institution and must define the appetite of the institution for Model Risk.

The Standards require institutions to take responsibility for all modelling decisions, model outputs and related financial consequences, even if third parties are involved. The Standards require the internal audit function to assess the regulatory compliance and the overall effectiveness of the model management framework as part of its regular auditing process.

The Standards require institutions to establish a clear, approved and controlled policy to govern overrides of model results, and the requirement applies to all models. The Standards require institutions to implement a process to monitor the performance of their models on a regular basis, and to present monitoring reports to the Model Oversight Committee on a regular basis, at least every quarter.

The Standards state that, on the production of monitoring reports, a clear process must be followed to decide whether to continue using a model with further monitoring or suspend it and work on remediation, and that the Model Oversight Committee must make this decision. The Standards require institutions to implement a process to validate independently all their models on a regular basis based on model types.

The Standards state that validation must be independent by virtue of excluding the development team from involvement in the assessment of the model, and that validation teams must not report to the business lines. The Standards state that the validation scope must cover both a qualitative validation and a quantitative validation. The Standards require validation findings across all models to be documented, recorded, tracked and reported to Senior Management and the Board at least once a year.

The ADGM Data Protection Regulations set an explicit 72-hour breach-notification rule to the Commissioner of Data Protection, language read verbatim and drawn from the same family as General Data Protection Regulation (GDPR) Art. 33, unless the breach is unlikely to pose a risk to individuals' rights.

This is the only one of the UAE's three regimes where a specific notification window was confirmed; the federal PDPL defers its timeline to unconfirmed Executive Regulations, and the DIFC Law's own breach-notification timeline (Part 7) was not individually pulled.

Art. 9 requires the Controller to notify the Bureau of a breach that would prejudice the privacy, confidentiality, or security of personal data, at the time it becomes aware of the breach, within a period the Decree-Law itself defers to the Executive Regulations. No fixed number of hours or days is stated in the Decree-Law's own text; the timeline is not established pending the unconfirmed Executive Regulations (see the jurisdiction summary).

Data Subject notification is also required where the breach meets a threshold the Decree-Law's text does not fully set out in the provisions read.

The ADGM Data Protection Regulations are the equivalent statute of the Abu Dhabi Global Market free zone (Abu Dhabi's Al Maryah and Al Reem Island financial free zone), enforced by ADGM's own Commissioner of Data Protection under ADGM's separate court system, and apply only within that free-zone footprint, not to a UAE business operating outside it. The text relied on here is the consolidated version as amended through February 2024.

The exact original 2021 commencement date is not confirmed against primary text, so 14 February 2021 rests on the corpus's own record rather than on primary confirmation. Section 1's Biometric Data definition names facial images and dactyloscopic data as worked examples, with the same adequacy-plus-alternative-safeguards cross-border transfer structure as the federal PDPL and DIFC Law. No source-based exclusion for a recording-derived biometric identifier was found.

The DIFC Data Protection Law is a separate statute of the Dubai International Financial Centre free zone, in force since 1 July 2020 and administered by the DIFC Commissioner.

Article 6 applies it in the jurisdiction of the DIFC, to the Processing of Personal Data by a Controller or Processor incorporated in the DIFC whether or not the Processing takes place in the DIFC, and to Processing in the DIFC by a Controller or Processor of any place of incorporation as part of stable arrangements, including transfers of Personal Data out of the DIFC. Controller and Processor are General Data Protection Regulation (GDPR)-style defined roles (Schedule 1).

Schedule 1's Special Categories of Personal Data includes "genetic data and biometric data where it is used for the purpose of uniquely identifying a natural person," with no source-based exclusion for an identifier derived from a recording, and Article 11 bars the Processing of Special Categories of Personal Data unless a listed condition applies, the first being the Data Subject's explicit consent.

Part 6 gives a Data Subject the rights to withdraw consent, to access, rectification and erasure, to object to Processing, to restriction of Processing, to data portability (Article 37), to object to a decision based solely on automated Processing, including Profiling, and to require manual review of it (Article 38), and to non-discrimination for exercising those rights (Article 39).

Articles 26 and 27 allow a transfer out of the DIFC only where the destination ensures an adequate level of protection or the transfer rests on appropriate safeguards, a specific derogation or the limited circumstances in Article 27(4).

A Controller must notify the Commissioner as soon as practicable of a Personal Data Breach that compromises a Data Subject's confidentiality, security or privacy (Article 41), and must communicate the breach to an affected Data Subject when it is likely to result in a high risk to the Data Subject's security or rights (Article 42).

Article 64A gives a Data Subject who suffers damage by reason of a contravention of the Law the right to apply to the Court for compensation from the Controller or the Processor. This row follows the consolidated version of July 2025, as amended by DIFC Laws Amendment Law No. 1 of 2025.

The federal PDPL is the UAE's onshore comprehensive personal-data statute, applying outside the DIFC and ADGM free zones. Processing requires a lawful basis, most commonly the Data Subject's consent, with Art. 4 listing alternative grounds including a consent exception at Art. 4(2) for data the Data Subject has made public by their own act. Controller and Processor are General Data Protection Regulation (GDPR)-style defined roles, with the Controller determining purposes and means and bearing primary compliance duty.

Art. 1's Biometric Data definition names facial images and fingerprints as worked examples and lists Biometric Data as a category of Sensitive Personal Data, so an identity-linked voiceprint or faceprint ordinarily requires the Data Subject's explicit consent as its legal basis; no exclusion for an identifier derived from a photo, video, or audio recording was found.

The Decree-Law's Art. 28 Executive Regulations, which would supply operative detail including the breach-notification timeline, have not been located at primary source; Cabinet Resolution No. 83 of 2022, sometimes cited as that Executive Regulation, is an unrelated vehicle speed-radar regulation.

Art. 22 permits transfer of personal data outside the UAE to a jurisdiction the Bureau (the UAE Data Office) has approved as having an adequate data-protection law and enforcement authority. Where no such adequacy finding exists, Art. 23 permits transfer under a contract binding the foreign recipient to PDPL-equivalent standards, or with the Data Subject's explicit consent provided the transfer does not contradict UAE public or security interest.

No blanket data-localization requirement was found; transfer is conditioned on one of these bases rather than prohibited outright.

The UAE Data Office ("the Bureau", established by Federal Decree-Law No. 44 of 2021) is the federal supervisory authority. A grievance against a Bureau decision goes to the Bureau itself first under Art. 25. Administrative penalty amounts are not set in the Decree-Law itself: Art. 26 requires a separate Council of Ministers decision, on the General Director's recommendation, to list violations and set administrative penalties.

No provision creating a private right of action for a Data Subject to sue a Controller directly has been located; the point is not established rather than a confirmed absence.

Article 1 defines Hacking as the unauthorized access, access in violation of the provisions of a license, or illegal access to or stay on an information system, a computer, an operating system, or an information network.

Article 2 punishes hacking a website, electronic information system, information network or piece of information technology equipment with imprisonment and a fine of not less than AED 100,000 or more than AED 300,000; the penalty rises to imprisonment of at least six months and a fine of AED 150,000 to 500,000 where the hacking causes damage, destruction, interruption, or the copying or disclosure of data, and to imprisonment of at least one year and a fine of AED 200,000 to 500,000 where it is committed to acquire data or information for illegal purposes.

The offence's definition turns on access being unauthorized, in violation of a licence, or illegal, and does not on its own terms require defeating a technical security measure. Article 3 imposes materially higher penalties, including temporary imprisonment, where the same conduct targets a government entity's systems.

Article 3 excludes ideas, procedures, mathematical concepts, official documents, news, news reports and current events that are merely media news, and works in the public domain from copyright protection, though a compilation of such material is protected where the selection or arrangement is itself an innovation.

Article 22 lets a person, after a work is published, make a single personal or non-commercial copy of it, quote short paragraphs or excerpts within reasonable limits for criticism, discussion or information with source and author credited, and make a single copy for legal proceedings or non-profit archival and research purposes. That personal-copy allowance expressly carves software, software applications and databases out of its ordinary scope.

No provision in the Decree-Law creates a text-and-data-mining exception or a machine-readable reservation mechanism of any kind.

Article 24 separately lets a newspaper, circular or broadcasting organisation copy excerpts of a work already lawfully made available to the public, published articles on subjects of current public concern (unless the author stated a publication ban), and speeches delivered at public parliamentary, judicial or public sessions when copied in the context of transmitting breaking news, provided the source and the author's name are credited. The Decree-Law creates no sui generis database right distinct from ordinary compilation copyright.

Article 4(2) provides a lawful-basis exception for processing personal data that has become available and known to all by an act of the data subject, which the jurisdiction's privacy record confirms is a consent-basis exception rather than a scope exclusion: personal data a scraper collects from a public, unauthenticated page of a UAE resident remains Personal Data for the Law's other duties, including security, purpose limitation, cross-border transfer, and breach reporting, once collected outside the narrow act that made it public.

The Law carries no publicly-available-data carve-out of the kind some jurisdictions apply to a whole category of public records, and Art. 1's Biometric Data definition names facial images and fingerprints as worked examples of Sensitive Personal Data with no exclusion for an identifier derived from a public recording, so a scraper deriving a biometric identifier from publicly posted photographs or audio faces the Law's elevated consent requirement for Sensitive Personal Data.

Rule 3.5.1 of the ADGM General Rulebook requires an Authorised Person to establish and maintain a Cyber Risk Management Framework to identify, assess and manage its Cyber Risks effectively. Rule 3.5.1 also requires the framework to be in writing and approved by the Governing Body of the Authorised Person. Rule 3.5.4 requires an Authorised Person to carry out an assessment of the Cyber Risk associated with its ICT Assets regularly and no less than annually.

Rule 3.5.10 requires an Authorised Person to establish a process for the management of software updates that addresses security vulnerabilities in its ICT Assets. Rule 3.5.11 requires an Authorised Person to implement appropriate encryption techniques to protect the confidentiality and integrity of information in transit, at rest, and at end of life.

Rule 3.5.14 requires an Authorised Person to have a comprehensive programme to test the resilience of its IT Systems and Networks, carried out regularly and, for internet-facing systems, at least annually. Rule 3.5.16 requires an Authorised Person to establish and maintain a robust Cyber Incident Response Plan providing for measures to respond to and limit the consequences of a Cyber Incident.

The ADGM Financial Services Regulatory Authority states that the Cyber Risk Management Rules under GEN 3.5 come into effect on 31 January 2026.

The DFSA states that its cyber supervision applies to all DFSA Authorised Firms, Registered Auditors, Credit Rating Agencies and Authorised Market Institutions. The DFSA states that Firms are required to follow the Cyber Risk Management Rules set out in the General Module of the DFSA Rulebook.

Rule 5.5.2 of the DFSA General Module requires an Authorised Person to establish and maintain a Cyber Risk Management Framework to identify, assess and manage Cyber Risk effectively in an integrated and comprehensive manner. Rule 5.5.2 also requires the framework to be in writing and approved by the Governing Body of the Authorised Person. Rule 5.5.2 requires an Authorised Person to review its Cyber Risk Management Framework periodically and at least annually.

Rule 5.5.3 requires an Authorised Person to manage Third-Party Cyber Risk as an integral part of its Cyber Risk Management Framework. Rule 5.5.11 requires an Authorised Person to establish a process for the management of software updates that addresses security vulnerabilities in its ICT Assets. Rule 5.5.16 requires an Authorised Person to monitor its IT Systems and Networks continuously with a view to detecting Cyber Incidents and anomalies.

Rule 5.5.17 requires an Authorised Person to draw up and maintain a robust Cyber Incident Response Plan. Rule 5.5.18 requires an Authorised Person to investigate a detected potential or actual Cyber Incident to determine its nature and extent.

Rule 3.5.18 requires an Authorised Person to notify the Regulator immediately, and in any event no later than 24 hours, after it becomes aware or has information which reasonably suggests that a material Cyber Incident has occurred. Rule 3.5.18 states that notification to the Regulator should use the prescribed incident reporting form available on the relevant electronic portal.

Rule 3.5.16 requires an Authorised Person to review its Cyber Incident Response Plan after the occurrence of a material Cyber Incident that is reportable under Rule 3.5.18. The FSRA notice of 29 January 2026 states that Authorised Persons must notify the FSRA immediately upon discovery of a suspected material cyber incident and, in any event, no later than 24-hours after they become aware of information that reasonably suggests such an incident has occurred.

The ADGM Financial Services Regulatory Authority states that the Cyber Risk Management Rules under GEN 3.5 come into effect on 31 January 2026.

The DFSA states that its cyber supervision applies to all DFSA Authorised Firms, Registered Auditors, Credit Rating Agencies and Authorised Market Institutions. Rule 5.5.19 requires an Authorised Person to notify the DFSA of a material Cyber Incident as soon as reasonably practicable and in any event no later than 72 hours after becoming aware. Rule 5.5.18 requires an Authorised Person to investigate a detected potential or actual Cyber Incident to determine its nature and extent.

The Decree by Law applies to internet service providers and digital platforms operating in the UAE or directed at users in the UAE, whether natural or legal persons and whether public or private sector, whenever children use the platform or are exposed to its content or services; covered platform types are named non-exhaustively and include websites, search engines, apps, messaging services and forums, gaming platforms, social media, live-streaming, podcast platforms, streaming and video-on-demand services, and e-commerce platforms.

Article 6 requires the Cabinet to issue a risk-based classification system for digital platforms setting age-restriction controls, enforcement means, and age-verification mechanisms scaled to each platform's classification.

Article 7 prohibits a digital platform from collecting, processing, publishing, or sharing the personal data of a child under thirteen unless explicit, documented, verifiable parental consent is obtained, a rapid consent-withdrawal mechanism is provided, the data-privacy policy is disclosed, access is restricted to authorised personnel, and the data is not used for commercial purposes, targeted advertising to the child, or tracking beyond the originally authorised purpose.

Article 8 requires platforms to adopt effective and reasonable age-verification mechanisms scaled to their risk classification. Article 9 prohibits platforms from letting a child participate in, hold an account for, or access online commercial gaming, including gambling, and requires platforms and internet service providers to take technical and administrative measures, including age verification and parental controls, to prevent that access.

Article 10 requires platforms to apply default high-privacy settings for children's accounts, age-based use controls, blocking and content-filtering tools, age classification of content, regulation of targeted advertising to children, parental control tools including daily-use time limits, and reporting channels for child pornographic material and harmful content, and to report such material to the concerned authorities.

Article 11 requires the Telecommunications and Digital Government Regulatory Authority to set internet service providers' obligations, including network-level content filtering and requiring a child caregiver's signature on service terms that mandate parental-control-tool integration. Article 13 places duties on the child caregiver, including monitoring, using parental controls, and not creating accounts for a child on a platform unsuited to the child's age group.

Article 16 defers the administrative penalties for a violation to a separate Cabinet regulation, not yet located at primary source. Article 18 gives covered persons one year from the law's entry into force, extendable by Cabinet resolution, to bring themselves into compliance.

Article 3(3) of the Federal Decree-Law on Copyright and Neighbouring Rights excludes news, news reports and current events that are merely media news from copyright protection outright; the exclusion lapses only where the compilation or arrangement of that material is itself an innovation.

Article 24(1)(a) separately lets a newspaper, circular or broadcasting organisation, without the author's consent and with the source and author's name credited, copy excerpts of a work already lawfully made available to the public. Article 24(1)(b) lets the same outlets publish articles on subjects of current public concern, unless the author stated a publication ban.

Article 24(1)(c) lets them reproduce speeches delivered at public parliamentary, judicial or public sessions when copied in the context of transmitting breaking news. The exception carries no headline-length or short-extract cap distinct from the requirement that the copying stay within the limits justified by its purpose.

The Decree-Law creates no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, and no hot-news or misappropriation doctrine distinct from ordinary copyright and unfair-competition law, and it predates the concept of a machine-readable text-and-data-mining reservation, so no opt-out mechanism of that kind exists either.