Article

The UAE Cabinet ('the Cabinet') announced, on 28 November 2021, that it had enacted Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data, as issued on 20 September 2021 and as part of its comprehensive Year of the 50th legislative reform which either amends or enacts over 40 further laws. In particular, the Law applies to the processing of personal data, by wholly or partly automated means, or any other means, by every data controller or data processor in the UAE processing the personal data of data subjects within or outside the UAE. Moreover, the Law also applies to every data controller or data processor established outside the UAE carrying out processing activities in relation to data subjects in the UAE. Furthermore, the Law makes particular reference to the establishment of the UAE Data Office ('the Office') pursuant to Federal Decree-Law No. 44 of 2021, and notes that the Cabinet, based on suggestions of the Director of the Office, will issue decisions to determine whether actions constitute a breach of the Law, based on the Law and the Executive Regulations, and determine the appropriate sanctions thereof.

Furthermore, the Law outlines that executive regulations to the Law shall be published by the Prime Minister within six months of the date of publication of the same, and provides for an implementation period of 12 months from the date of publication of the Law for entities governed by the same. However, this date may be extended at the discretion of the Cabinet.