What UAE businesses should know about personal data protection

Most UAE businesses now handle personal data under a federal framework. Fewer have adjusted their systems to match.

The UAE introduced a federal personal data protection framework through Federal Decree-Law No. 45 of 2021. It applies broadly to organisations processing the personal data of individuals in the UAE, alongside separate regimes that already existed in free zones such as the DIFC and ADGM.

We are an IT and security provider, not a law firm, and nothing here is legal advice. But there is a practical side to this that lands squarely in IT, and that side is often the last to get attention.

The principles, in plain terms

Strip away the legal language and the recurring themes are consistent with data protection law elsewhere: collect personal data for a clear purpose, keep only what you need, keep it accurate, keep it secure, don't hold it forever, and be able to explain what you hold and why.

Individuals also have rights over their data — broadly, to know what is held, to have it corrected, and in defined circumstances to have it deleted or restricted.

Where this becomes an IT problem

Every one of those obligations assumes something most businesses don't actually have: knowledge of where personal data lives.

You cannot secure, retain, delete or report on data you can't locate.

In a typical SME, personal data is in the CRM, in Microsoft 365 mailboxes, in shared drives, in spreadsheets on individual laptops, in a backup archive, and in at least one system nobody has thought about since the person who owned it left. Answering a deletion request across that estate is hard if you have never mapped it.

Controls that support compliance in practice

• Know what you hold. Data discovery and classification tell you where personal data actually sits, which is the prerequisite for everything else.
• Control where it goes. Data loss prevention stops personal data leaving through email, web uploads or removable media, whether by accident or intent.
• Limit who can reach it. Access control and least privilege mean fewer people and systems touch personal data than currently do.
• Protect it in storage and transit. Encryption is table stakes and easy to verify.
• Retain deliberately. Retention policies that actually delete data at the end of its life, rather than keeping everything indefinitely by default.
• Be able to detect and evidence a breach. Monitoring and logging matter because notification obligations assume you know an incident occurred and what it touched.

A sensible order to tackle it

Start with discovery. Find out where personal data is, across cloud and on-premise, and write it down. Almost every business is surprised by at least one location.

Then reduce. Delete what you have no reason to keep. This is the cheapest compliance work available and it shrinks every other problem at once.

Then apply controls to what remains — access, encryption, DLP, retention, monitoring. Finally, document what you did. Being able to demonstrate a considered approach matters, and it is much easier to write down while you're doing it than to reconstruct later.

None of this is exotic technology. It is mostly ordinary good practice, applied deliberately rather than assumed.