United Arab Emirates

The ADGM Data Protection Regulations set an explicit 72-hour breach-notification rule to the Commissioner of Data Protection, language read verbatim and drawn from the same family as General Data Protection Regulation (GDPR) Art. 33, unless the breach is unlikely to pose a risk to individuals' rights.

This is the only one of the UAE's three regimes where a specific notification window was confirmed; the federal PDPL defers its timeline to unconfirmed Executive Regulations, and the DIFC Law's own breach-notification timeline (Part 7) was not individually pulled.

Art. 9 requires the Controller to notify the Bureau of a breach that would prejudice the privacy, confidentiality, or security of personal data, at the time it becomes aware of the breach, within a period the Decree-Law itself defers to the Executive Regulations. No fixed number of hours or days is stated in the Decree-Law's own text; the timeline is not established pending the unconfirmed Executive Regulations (see the jurisdiction summary).

Data Subject notification is also required where the breach meets a threshold the Decree-Law's text does not fully set out in the provisions read.

The ADGM Data Protection Regulations are the equivalent statute of the Abu Dhabi Global Market free zone (Abu Dhabi's Al Maryah and Al Reem Island financial free zone), enforced by ADGM's own Commissioner of Data Protection under ADGM's separate court system, and apply only within that free-zone footprint, not to a UAE business operating outside it. The text relied on here is the consolidated version as amended through February 2024.

The exact original 2021 commencement date is not confirmed against primary text, so 14 February 2021 rests on the corpus's own record rather than on primary confirmation. Section 1's Biometric Data definition names facial images and dactyloscopic data as worked examples, with the same adequacy-plus-alternative-safeguards cross-border transfer structure as the federal PDPL and DIFC Law. No source-based exclusion for a recording-derived biometric identifier was found.

The DIFC Data Protection Law is a separate statute of the Dubai International Financial Centre free zone, in force since 1 July 2020, enforced by the DIFC Commissioner of Data Protection, not the federal Bureau. It applies only within the DIFC's own geographic free-zone footprint (Dubai's financial district), not to a UAE business operating onshore elsewhere. Controller and Processor are General Data Protection Regulation (GDPR)-style defined roles (Sched. 1). Sched.

1's Special Categories of Personal Data includes "genetic data and biometric data where it is used for the purpose of uniquely identifying a natural person," with no source-based exclusion for an identifier derived from a recording, so processing such data ordinarily requires explicit consent or another qualifying condition.

The DIFC framework is close to full GDPR Chapter III parity on data-subject rights (portability at Art. 37, automated decision-making and profiling safeguards at Art. 38, non-discrimination at Art. 39, confirmed by the Law's own index), and Arts. 26-27 set a near-identical adequacy-plus-alternative-safeguards structure to the federal PDPL for cross-border transfer.

The individual operative texts of these articles, and of the Part 7 breach-notification provisions and any private-right-of-action provision, were not each pulled verbatim; the structure recorded here reflects what the index confirms rather than asserting unconfirmed detail.

The federal PDPL is the UAE's onshore comprehensive personal-data statute, applying outside the DIFC and ADGM free zones. Processing requires a lawful basis, most commonly the Data Subject's consent, with Art. 4 listing alternative grounds including a consent exception at Art. 4(2) for data the Data Subject has made public by their own act. Controller and Processor are General Data Protection Regulation (GDPR)-style defined roles, with the Controller determining purposes and means and bearing primary compliance duty.

Art. 1's Biometric Data definition names facial images and fingerprints as worked examples and lists Biometric Data as a category of Sensitive Personal Data, so an identity-linked voiceprint or faceprint ordinarily requires the Data Subject's explicit consent as its legal basis; no exclusion for an identifier derived from a photo, video, or audio recording was found.

The Decree-Law's Art. 28 Executive Regulations, which would supply operative detail including the breach-notification timeline, have not been located at primary source; Cabinet Resolution No. 83 of 2022, sometimes cited as that Executive Regulation, is an unrelated vehicle speed-radar regulation.

Art. 22 permits transfer of personal data outside the UAE to a jurisdiction the Bureau (the UAE Data Office) has approved as having an adequate data-protection law and enforcement authority. Where no such adequacy finding exists, Art. 23 permits transfer under a contract binding the foreign recipient to PDPL-equivalent standards, or with the Data Subject's explicit consent provided the transfer does not contradict UAE public or security interest.

No blanket data-localization requirement was found; transfer is conditioned on one of these bases rather than prohibited outright.

The UAE Data Office ("the Bureau", established by Federal Decree-Law No. 44 of 2021) is the federal supervisory authority. A grievance against a Bureau decision goes to the Bureau itself first under Art. 25. Administrative penalty amounts are not set in the Decree-Law itself: Art. 26 requires a separate Council of Ministers decision, on the General Director's recommendation, to list violations and set administrative penalties.

No provision creating a private right of action for a Data Subject to sue a Controller directly has been located; the point is not established rather than a confirmed absence.

Article 1 defines Hacking as the unauthorized access, access in violation of the provisions of a license, or illegal access to or stay on an information system, a computer, an operating system, or an information network.

Article 2 punishes hacking a website, electronic information system, information network or piece of information technology equipment with imprisonment and a fine of not less than AED 100,000 or more than AED 300,000; the penalty rises to imprisonment of at least six months and a fine of AED 150,000 to 500,000 where the hacking causes damage, destruction, interruption, or the copying or disclosure of data, and to imprisonment of at least one year and a fine of AED 200,000 to 500,000 where it is committed to acquire data or information for illegal purposes.

The offence's definition turns on access being unauthorized, in violation of a licence, or illegal, and does not on its own terms require defeating a technical security measure. Article 3 imposes materially higher penalties, including temporary imprisonment, where the same conduct targets a government entity's systems.

Article 3 excludes ideas, procedures, mathematical concepts, official documents, news, news reports and current events that are merely media news, and works in the public domain from copyright protection, though a compilation of such material is protected where the selection or arrangement is itself an innovation.

Article 22 lets a person, after a work is published, make a single personal or non-commercial copy of it, quote short paragraphs or excerpts within reasonable limits for criticism, discussion or information with source and author credited, and make a single copy for legal proceedings or non-profit archival and research purposes. That personal-copy allowance expressly carves software, software applications and databases out of its ordinary scope.

No provision in the Decree-Law creates a text-and-data-mining exception or a machine-readable reservation mechanism of any kind.

Article 24 separately lets a newspaper, circular or broadcasting organisation copy excerpts of a work already lawfully made available to the public, published articles on subjects of current public concern (unless the author stated a publication ban), and speeches delivered at public parliamentary, judicial or public sessions when copied in the context of transmitting breaking news, provided the source and the author's name are credited. The Decree-Law creates no sui generis database right distinct from ordinary compilation copyright.

Article 4(2) provides a lawful-basis exception for processing personal data that has become available and known to all by an act of the data subject, which the jurisdiction's privacy record confirms is a consent-basis exception rather than a scope exclusion: personal data a scraper collects from a public, unauthenticated page of a UAE resident remains Personal Data for the Law's other duties, including security, purpose limitation, cross-border transfer, and breach reporting, once collected outside the narrow act that made it public.

The Law carries no publicly-available-data carve-out of the kind some jurisdictions apply to a whole category of public records, and Art. 1's Biometric Data definition names facial images and fingerprints as worked examples of Sensitive Personal Data with no exclusion for an identifier derived from a public recording, so a scraper deriving a biometric identifier from publicly posted photographs or audio faces the Law's elevated consent requirement for Sensitive Personal Data.

The Decree by Law applies to internet service providers and digital platforms operating in the UAE or directed at users in the UAE, whether natural or legal persons and whether public or private sector, whenever children use the platform or are exposed to its content or services; covered platform types are named non-exhaustively and include websites, search engines, apps, messaging services and forums, gaming platforms, social media, live-streaming, podcast platforms, streaming and video-on-demand services, and e-commerce platforms.

Article 6 requires the Cabinet to issue a risk-based classification system for digital platforms setting age-restriction controls, enforcement means, and age-verification mechanisms scaled to each platform's classification.

Article 7 prohibits a digital platform from collecting, processing, publishing, or sharing the personal data of a child under thirteen unless explicit, documented, verifiable parental consent is obtained, a rapid consent-withdrawal mechanism is provided, the data-privacy policy is disclosed, access is restricted to authorised personnel, and the data is not used for commercial purposes, targeted advertising to the child, or tracking beyond the originally authorised purpose.

Article 8 requires platforms to adopt effective and reasonable age-verification mechanisms scaled to their risk classification. Article 9 prohibits platforms from letting a child participate in, hold an account for, or access online commercial gaming, including gambling, and requires platforms and internet service providers to take technical and administrative measures, including age verification and parental controls, to prevent that access.

Article 10 requires platforms to apply default high-privacy settings for children's accounts, age-based use controls, blocking and content-filtering tools, age classification of content, regulation of targeted advertising to children, parental control tools including daily-use time limits, and reporting channels for child pornographic material and harmful content, and to report such material to the concerned authorities.

Article 11 requires the Telecommunications and Digital Government Regulatory Authority to set internet service providers' obligations, including network-level content filtering and requiring a child caregiver's signature on service terms that mandate parental-control-tool integration. Article 13 places duties on the child caregiver, including monitoring, using parental controls, and not creating accounts for a child on a platform unsuited to the child's age group.

Article 16 defers the administrative penalties for a violation to a separate Cabinet regulation, not yet located at primary source. Article 18 gives covered persons one year from the law's entry into force, extendable by Cabinet resolution, to bring themselves into compliance.

Article 3(3) of the Federal Decree-Law on Copyright and Neighbouring Rights excludes news, news reports and current events that are merely media news from copyright protection outright; the exclusion lapses only where the compilation or arrangement of that material is itself an innovation.

Article 24(1)(a) separately lets a newspaper, circular or broadcasting organisation, without the author's consent and with the source and author's name credited, copy excerpts of a work already lawfully made available to the public. Article 24(1)(b) lets the same outlets publish articles on subjects of current public concern, unless the author stated a publication ban.

Article 24(1)(c) lets them reproduce speeches delivered at public parliamentary, judicial or public sessions when copied in the context of transmitting breaking news. The exception carries no headline-length or short-extract cap distinct from the requirement that the copying stay within the limits justified by its purpose.

The Decree-Law creates no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, and no hot-news or misappropriation doctrine distinct from ordinary copyright and unfair-competition law, and it predates the concept of a machine-readable text-and-data-mining reservation, so no opt-out mechanism of that kind exists either.