United Arab Emirates · PDPL

UAE PDPL readiness for small businesses

The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies to any organisation that processes the personal data of people in the UAE. The Executive Regulations were issued in 2026, and compliance is mandatory by 1 January 2027. Mainland businesses fall under the federal PDPL, while ADGM and DIFC entities follow their own data protection regimes. MapleNorthIT runs remote PDPL readiness audits for businesses with 5 to 100 employees and sells a self-serve UAE compliance kit covering the policies, registers, and breach response steps the law expects.

Last updated: June 2026 · MapleNorthIT

PDPL compliance deadline: 1 January 2027

With the Executive Regulations issued in 2026, the enforcement clock is running. Organisations handling personal data of UAE residents need their compliance program in place by 1 January 2027. Local providers quote AED 50,000 to 150,000 for full SME compliance programs, so knowing your actual gaps before you spend matters.

What United Arab Emirates businesses need to know

  • The PDPL applies to controllers and processors in the UAE and to any entity worldwide that handles the data of people in the UAE.
  • ADGM and DIFC free zones run separate data protection laws. A mainland-plus-free-zone business may face two regimes at once.
  • Full SME compliance programs from local providers are commonly quoted at AED 50,000 to 150,000.
  • A readiness audit first means you fix the gaps the law actually requires instead of buying a one-size program.

Two ways to get compliant

Compliance Readiness Audit

A one-hour remote call plus a review of your setup. Written report within 48 hours, with every gap ranked Critical, Important, or Recommended and a rough cost to fix each one.

Book an audit

UAE PDPL Compliance Starter Kit

A self-serve bundle with the policies, registers, and breach response templates the PDPL expects, written in plain language your team can adopt this week.

View the kit

Pay in CAD by card via Stripe. A $400 CAD audit is roughly AED 1,080.

Common questions

Does the UAE PDPL apply to my small business?

If you process personal data of people in the UAE, yes. That includes customer lists, employee records, and marketing databases. Mainland companies fall under the federal PDPL. Companies registered in ADGM or DIFC follow those zones' own data protection laws instead, which are similar in spirit but separately enforced.

When does PDPL enforcement start?

The Executive Regulations were issued in 2026 and compliance is mandatory by 1 January 2027. Waiting until late 2026 to start means competing with every other late mover for the same consultants and paying rush rates.

What does a PDPL readiness audit check?

It maps what personal data you hold and where, checks whether you have a lawful basis recorded for processing it, reviews your security controls (MFA, access rights, backups, email authentication), and confirms you could detect and report a breach. You get a written report in 48 hours with gaps ranked by risk and rough cost to fix.

Is a remote audit accepted for PDPL preparation?

Yes. PDPL readiness is about policies, records, and security configuration, all of which can be reviewed remotely. Vancouver mornings line up with UAE evenings, so calls are easy to schedule. The audit report gives you the evidence trail an inspector or enterprise customer would ask for.