UAE PDPL Compliance: 30 Days to Readiness for Dubai SMEs

Federal Decree-Law 45 of 2021 (the UAE Personal Data Protection Law, or PDPL) applies to almost every Dubai business that handles personal data about UAE residents. Most SMEs we speak to have heard of it but have not started. This guide is a 30-day plan to reach baseline compliance without specialist consultancy fees, written for the operations manager or owner who has to drive the work.

What "baseline compliance" means here: data mapping done, lawful basis documented, privacy notice published, subject rights process defined, breach response runbook in place, key controls implemented. That is not the same as a Big Four PDPL audit. It is the level at which you can answer a regulator's first question honestly and have the records to back up the answer.

Who PDPL applies to

If your business processes the personal data of any individual in the UAE, PDPL applies. There is no SME exemption. "Personal data" includes names, contact details, ID numbers, employment records, customer transaction history, CCTV footage, and anything else that identifies a living person.

Some businesses are also covered by sector-specific data laws (DIFC DPL 5/2020, ADGM DPR 2021, sector regulators like DHA or DFSA). Where multiple regimes apply, comply with the strictest. PDPL is the federal baseline, not the ceiling.

Week 1: discover what you process

You cannot protect what you have not catalogued. The week 1 deliverable is a Record of Processing Activities (RoPA).

Day 1-2: data inventory workshop

Get every department head into a room (or a Teams call) for two hours. Walk through, for each business process:

• What personal data is collected?
• From whom (customer, employee, supplier, contractor, visitor)?
• For what purpose?
• Where is it stored (M365, CRM, HR system, paper file, network drive)?
• Who has access?
• How long is it retained?
• Is it shared with third parties (auditors, payroll providers, marketing platforms)?
• Is it transferred outside the UAE?

Day 3-4: write the RoPA

One row per process. Microsoft Excel is enough; you do not need GRC software for an SME at this stage. The RoPA is your single source of truth and the document the regulator will ask for first if anything goes wrong.

Day 5: identify the gaps

Walk through the RoPA looking for: data with no documented purpose, processes with no retention period, third-party transfers without contracts, cross-border transfers without safeguards. These are the gaps to close in weeks 2 and 3.

Week 2: lawful basis and consent

For every processing activity, you need a documented lawful basis. PDPL recognizes several: consent, contractual necessity, legal obligation, vital interests, legitimate interests, and a few others specific to public-interest functions.

Day 6-7: assign lawful basis

For each RoPA row, document which lawful basis applies. Most SME processing is one of three: contractual necessity (you need the data to deliver the service the customer asked for), legal obligation (employment records, AML/KYC), or legitimate interest (low-risk marketing of similar products to existing customers).

Day 8-9: clean up consent flows

Where consent is the lawful basis, it must be freely given, specific, informed, and unambiguous. Pre-ticked boxes and "by using this site you agree" banners do not meet PDPL. Audit your website, contact forms, and marketing signup flows; replace any non-compliant consent capture with explicit opt-in.

Day 10: publish the privacy notice

The privacy notice is the public-facing summary of your RoPA. It explains, in plain language, what data you collect, why, on what lawful basis, who you share it with, how long you keep it, and what rights data subjects have. Most SME privacy notices are 1,000 to 1,500 words. Publish it on your website and link to it from every form that collects personal data.

Week 3: rights, breaches, and controls

Day 11-13: data subject rights process

PDPL gives data subjects rights to: access their data, correct it, erase it, restrict processing, port it, object to processing, and withdraw consent. You need a process to handle a rights request within the regulator's timelines (typically one calendar month for access).

For an SME, this is usually a dedicated email address (privacy@yourdomain.ae) that routes to a named owner. The owner has a checklist: verify identity, scope the request, retrieve the data, redact third-party information, send within the deadline. Document the process; do not improvise on the day a request arrives.

Day 14-16: breach response runbook

PDPL requires notification of "high-risk" breaches to the UAE Data Office and, in some cases, to affected individuals. Write a one-page runbook:

• How a suspected breach is reported internally (within 1 hour of discovery)
• Who is on the incident response team (named, with backups)
• How severity is assessed (use the regulator's risk-based criteria)
• Decision tree for regulator notification (within 72 hours of confirmed breach)
• Communications template for affected individuals
• Post-incident review process

Day 17-20: technical and organizational measures

PDPL Article 20 requires "appropriate technical and organizational measures" to protect personal data. For an SME, this is:

• MFA on every account that touches personal data (especially M365, CRM, HR)
• Defender for Business or equivalent endpoint protection
• Email anti-phishing and anti-impersonation (Defender for Office 365)
• Encryption at rest (BitLocker on laptops, default in M365 and Azure)
• Encryption in transit (TLS for email and web)
• Backup and recovery tested at least quarterly
• Access reviews quarterly (who has access to what, and is it still needed?)
• Vendor due diligence for any third party that processes data on your behalf

Week 4: third parties and cross-border

Day 21-24: data processing agreements

Every third party that processes personal data on your behalf needs a Data Processing Agreement (DPA). This applies to your payroll provider, your IT provider, your cloud storage, your email marketing platform, your accountant if they hold employee records, and so on.

Standard DPA templates are available from the UAE Data Office and from law firms; the major SaaS providers (Microsoft, Google, Salesforce) publish their DPAs and will sign on request. The work here is identifying which vendors need them, sending the templates, chasing signatures, and filing the executed copies.

Day 25-27: cross-border transfers

If you transfer personal data outside the UAE, PDPL requires an appropriate safeguard: an adequacy decision (only a handful of jurisdictions have one), Standard Contractual Clauses, Binding Corporate Rules, or explicit consent. For most SMEs using Microsoft 365 or Google Workspace with data residency in the UAE or EU, the safeguards are built into the vendor's DPA. Verify and document; do not assume.

Day 28-30: tabletop exercise and sign-off

Run a 90-minute tabletop exercise: simulate a data subject access request and a breach. Walk the team through the runbooks. Identify where the process is unclear or slow. Refine.

End-of-month deliverable: a packaged PDPL evidence file containing the RoPA, lawful basis register, privacy notice, rights process, breach runbook, security controls list, DPAs, and tabletop exercise notes. This is the file you hand to a regulator or auditor on request.

What you have not done in 30 days

Be honest about the limits. Thirty days gets you a baseline. You have not:

• Conducted a Data Protection Impact Assessment for high-risk processing (required for some activities)
• Appointed a Data Protection Officer (required for some businesses)
• Completed an ISO 27001 or ISO 27701 certification (separate, longer programme)
• Achieved DIFC DPL 5/2020 or ADGM DPR 2021 compliance (separate regimes, additional work)
• Built sector-specific compliance (DHA for healthcare, DFSA for finance, etc.)

These are the next 90 days, not the next 30.

FAQs

What is UAE PDPL?

UAE Personal Data Protection Law, Federal Decree-Law 45 of 2021, regulates how personal data is collected, processed, and protected in the UAE. It is enforced by the UAE Data Office. Penalties for non-compliance can include significant fines and reputational harm.

Does PDPL apply to my Dubai SME?

Almost certainly yes. If you process the personal data of any individual in the UAE (customers, employees, suppliers), PDPL applies. There is no SME size exemption.

Do I need a Data Protection Officer?

A DPO is required if your core processing is large-scale monitoring or large-scale processing of sensitive data, or if you are a public authority. Most SMEs are not required to appoint a DPO but are required to assign accountability for data protection internally.

How does PDPL relate to DIFC and ADGM data laws?

PDPL is the federal baseline. DIFC has its own Data Protection Law 5/2020 and ADGM has its own Data Protection Regulations 2021. Businesses in DIFC or ADGM comply with the financial free zone's law; businesses in the mainland comply with PDPL. Where the laws differ, the financial free zone law typically aligns more closely with GDPR.

What happens if we have a breach?

High-risk breaches must be notified to the UAE Data Office within 72 hours of confirmation. Affected individuals may also need to be notified, depending on severity. The breach response runbook in week 3 is what makes this manageable on the day.

If you would rather have a specialist walk through your environment, our UAE PDPL compliance service covers all of the above, plus DPIA, DPO-as-a-service, and Microsoft Purview implementation. The first scoping call is free.