Book a PDPL assessment. We'll map your personal data and show you where to start.
PDPL compliance, ensuring your data remains sovereign
We help organizations comply with the UAE Personal Data Protection Law and the Saudi PDPL: we map the personal data you hold, close the gaps, and host it in-country on secure cloud infrastructure you control.
What is the PDPL?
Data protection is now the law across the Gulf
The UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) is the country's first federal data protection law. It applies to any organization that processes personal data of people in the UAE, whether the organization is based in the country or abroad. Financial free zones keep their own laws: the DIFC Data Protection Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021.
Saudi Arabia's Personal Data Protection Law, enforced by SDAIA since September 2024, applies similar rules to data about people in the Kingdom, with fines of up to SAR 5 million. Both laws require consent and a lawful purpose, give individuals rights over their data, demand strong security and breach reporting, and restrict sending personal data abroad.
What the PDPL asks of your organization
A lawful basis for every use
Collect personal data only with clear consent or another legal basis, and only for a specific, stated purpose.
Rights for every individual
People can ask to see, correct, delete, restrict or move their data, and object to automated decisions.
Security by design
Protect data with encryption, access control and logging that match the risk of what you hold.
Breach notification
Detect personal data breaches and report them to the regulator and affected people without delay.
Controlled cross-border transfers
Send personal data abroad only to countries with adequate protection, or under the conditions the law allows.
Records and accountability
Keep a record of processing, assess high-risk processing, and appoint a data protection officer where required.
Our PDPL compliance services
From the first data map to day-to-day operations. We combine legal-grade documentation with the engineering to put it into practice.
Data discovery and mapping
We find the personal data in your systems, files, email and cloud apps, and record where it lives, who uses it and where it goes.
Gap assessment
We measure your current practices against the UAE PDPL, Saudi PDPL, DIFC or ADGM rules and give you a prioritized remediation plan.
Policies and notices
Privacy policies, consent wording, records of processing, retention schedules and data processing agreements with your vendors.
In-country data hosting
Move personal data to UAE cloud regions on AWS or Microsoft Azure, so it is stored and processed inside the country.
Encryption and access control
Encryption at rest and in transit with keys you hold, single sign-on, least-privilege access and audit logs.
Data subject request handling
A simple process and tooling to receive, verify and answer access, correction and deletion requests on time.
Breach response
Monitoring, an incident response plan and notification templates, tested before you need them.
Vendor and transfer review
We review the third parties and SaaS tools that receive your data, and the legal basis for any transfer abroad.
Training and ongoing support
Staff awareness training, periodic reviews and updates as regulators publish new rules and guidance.
Data sovereignty
Your data, in your country, under your control
Data sovereignty means your customers' and employees' personal data is stored and processed under the laws of the country it belongs to, and that you decide who can reach it.
We design cloud environments in the AWS Middle East (UAE) region and the Microsoft Azure UAE North and UAE Central regions, with encryption keys you own, access limited to your people, and clear records of every system that touches personal data. Combined with our ISO 27001 on AWS and cybersecurity compliance services, it gives you one security and privacy programme instead of several.
How we deliver PDPL compliance
Discover
Workshops with your teams and a scan of your systems to build a complete map of the personal data you hold.
Assess
A gap report against the laws that apply to you, ranked by risk and effort.
Remediate
We update policies and contracts, and fix the technical gaps, from hosting and encryption to access control.
Operate
Request handling, breach response and records of processing become part of daily work.
Review
Regular reviews keep you compliant as your business, your systems and the regulations change.
PDPL compliance FAQs
Does the UAE PDPL apply to my business?
If you collect or use personal data about people in the UAE, such as customers, employees or website visitors, it most likely does, even if your company is based outside the UAE. Companies in the DIFC and ADGM follow their own free zone data protection laws instead, and some data types, such as health and banking data, are also covered by sector rules.
What is the difference between the UAE PDPL and the Saudi PDPL?
They share the same principles, including consent, individual rights, security, breach reporting and limits on transfers abroad. They are separate laws with their own regulators, the UAE Data Office and SDAIA in Saudi Arabia. A business with customers in both countries needs to meet both, and we assess them together.
Do I have to store personal data inside the UAE?
The PDPL does not ban storage abroad, but it restricts transfers to countries without adequate protection, and sector rules for government, health and financial data can require local hosting. Hosting in UAE cloud regions is the simplest way to meet these rules and keep your data sovereign.
How is the PDPL different from GDPR?
The PDPL is modelled on many of the same ideas as the EU GDPR, but its legal bases, transfer rules and regulator differ. Being GDPR compliant is a good start, not a guarantee of PDPL compliance.
How long does PDPL compliance take?
A data map and gap assessment for a mid-sized company usually takes a few weeks. Remediation depends on the gaps we find. We start with the highest risks, so the most important protections are in place first.
Are the PDPL rules final?
The law is in force, and the UAE Data Office continues to issue implementing rules and guidance. We follow these updates and adjust your programme as they are published.