The PDPL and your vendors

Most vendors touch personal data: payroll providers, call centres, cloud hosts, card processors. The UAE's Personal Data Protection Law, Federal Decree-Law 45 of 2021, has applied since 2 January 2022. Almost five years on, its Executive Regulations have still not been issued according to the latest sources, and the UAE Data Office is not yet fully operational. That makes the law easy to underrate. It should not be.

Check which law applies first

The PDPL covers processing onshore and in non-financial free zones. It does not apply where another law governs: the DIFC and ADGM have their own data protection laws, and health data and banking or credit data with their own legislation are excluded (Art. 2(2)). A transfer between onshore and the DIFC or ADGM counts as a cross-border transfer.

What it asks of your vendors

• Processors act on your instructions, and both sides apply technical and organisational security measures. The article number is believed to be Art. 8 but was not verified.
• You report a breach that harms privacy, confidentiality or security to the Data Office on becoming aware of it (Art. 9). The exact period awaits the Executive Regulations, so your contract should make the vendor tell you without delay.
• Transfers abroad go to jurisdictions the Data Office approves as adequate, or where there is a treaty (Art. 22). Otherwise only limited derogations apply, such as contractual undertakings or explicit consent (Art. 23).

Record where each vendor stores and processes data, and which law governs it.

Sector rules can be stricter

For CBUAE institutions, the Master System of Record for Critical Operations must stay in the UAE, including when activities are outsourced (C 1/2026 Art. 8.9). Banks need CBUAE approval and the customer's prior written consent before sharing Confidential Data abroad (C 14/2021 Art. 6.3). Health data for services provided in the UAE may not leave the country except in cases set by the health authorities (Federal Law 2 of 2019 Art. 13), and Abu Dhabi's ADHICS requires a Department of Health exemption. In the DIFC, a documented assessment of the recipient country has been required since July 2025.

What to do now

• Add data location, processing location and the governing data law to every vendor record.
• Put processor terms, breach notice and sub-processor approval into contracts now, rather than waiting for the Executive Regulations.
• Plan for the six-month compliance window that starts once the Executive Regulations are issued.

NexaPair can be deployed in a UAE cloud region today, and it assesses each vendor's cross-border transfers under the PDPL, or under the DIFC or ADGM law for firms in those free zones.