Privacy & data protection
PDPL
Personal Data Protection Law (UAE & Saudi Arabia)
PDPL refers to the Personal Data Protection Laws of the UAE and Saudi Arabia, which set out how personal data must be collected, processed and transferred. We help you map your data, close the gaps and demonstrate compliance.
What PDPL is
The Personal Data Protection Laws of the United Arab Emirates and the Kingdom of Saudi Arabia govern how organisations collect, process, store and transfer the personal data of individuals. They set out lawful bases for processing, individual rights, security obligations and rules on cross-border transfers, administered by the respective national data protection authorities.
PDPL is a legal obligation you demonstrate compliance with rather than a standard an accredited body certifies you against. The two regimes share familiar data protection principles but differ in detail, and they can apply to organisations outside the region where they process the personal data of individuals there.
The anatomy of the two laws
Principles · lawful and fair processing
Both laws require that personal data be processed lawfully, fairly and transparently, for specified purposes and limited to what is necessary.
Lawful basis · grounds for processing
Processing must rest on a recognised legal ground such as consent or another basis set out in the applicable law.
Data subject rights · control for individuals
Individuals are granted rights including access, correction, deletion and objection, which the controller must be able to action within set periods.
Controller obligations · accountability
Organisations must keep records of processing, apply security measures, assess risk and, in defined cases, appoint a data protection officer or equivalent role.
Breach notification · incident reporting
Personal data breaches that meet the defined threshold must be notified to the relevant national authority, and to affected individuals where required.
Cross-border transfer · moving data out
Transfers of personal data outside the jurisdiction are permitted only to adequate destinations or under approved safeguards and conditions.
Supervisory authority · enforcement
Each law is administered by a national data protection authority with powers to investigate, direct remediation and impose penalties.
Who needs it
- Organisations established in the UAE or Saudi Arabia that process personal data
- Companies outside the region that handle the personal data of individuals there
- Businesses expanding into the Gulf that need a defensible data protection posture
What you get
- A data map and gap assessment against the applicable PDPL requirements
- Policies, notices and lawful-basis or consent records
- Individual rights, breach response and records of processing procedures
- A compliance evidence pack and cross-border transfer documentation
Timelines depend on which regime applies, how much personal data you process and how it flows across borders. We scope it honestly up front rather than promise a fixed number of weeks.
Current version
In the UAE, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data is the current federal regime, overseen by the UAE Data Office. In Saudi Arabia, the Personal Data Protection Law issued under Royal Decree M/19 of 2021, as amended in 2023, is in force with its Implementing Regulations and the regulations on transfer of personal data, enforced by the Saudi Data and AI Authority. Both regimes continue to publish and update executive and implementing rules, so the detailed obligations evolve over time. Treat current guidance from each authority as the reference point and revisit your controls as further regulations are issued.
What it costs
PDPL is a legal obligation, not a certifiable standard, so there is no certificate to buy and no accredited body to pay for a stamp. The costs are our scoped advisory and implementation fee, quoted up front once we understand your size, which regime applies and your starting point, plus any independent assessment, external audit, or data protection officer and local legal input you choose to engage, which those parties charge separately on their own terms. tr3labs is never the certifier, auditor or regulator; the national data protection authority holds that role. We scope the work with you rather than quote blind.
How tr3labs gets you there
Scope and data mapping
We establish which regime applies, map what personal data you hold and how it flows, and measure your current practices against the applicable PDPL requirements.
Build the controls
We help you put the policies, notices, consent and lawful-basis records, and data protection processes in place to meet the law, including cross-border transfer requirements.
Rights and governance
We implement the processes for handling individual rights requests, breach response and records of processing, and run an internal review to confirm they operate.
Readiness and evidence
We assemble the evidence that demonstrates compliance to the relevant authority and to customers, and keep you aligned as the regulations and their executive rules develop.
PDPL and GDPR side by side
The two get confused because the Gulf PDPL regimes borrow much of their structure and vocabulary from GDPR, yet differ in jurisdiction and detail.
| PDPL (UAE & Saudi Arabia) | GDPR | |
|---|---|---|
| Covers | Personal data in the UAE and Saudi Arabia | Personal data in the EU and EEA |
| Who asks for it | UAE Data Office and Saudi SDAIA | EU and national data protection authorities |
| Core idea | Lawful, secure processing of personal data | Lawful, secure processing of personal data |
| Audit model | Compliance demonstrated to the authority, no certificate | Compliance demonstrated to the authority, no certificate |
| Transfer rules | Region-specific adequacy and safeguards | Adequacy decisions and standard safeguards |
| Often held with | DIFC law and ISO 27001 | ISO 27001 and SOC 2 |
PDPL FAQ
- How much does PDPL compliance cost?
- PDPL is a legal obligation, not a certifiable standard, so there is no certificate to buy. You pay our scoped advisory and implementation fee, quoted up front, plus any independent assessment, external audit, or DPO and local legal input you choose to engage.
- How long does PDPL compliance take?
- It depends on which regime applies, how much personal data you process and how it flows across borders. We scope the timeline honestly up front rather than promise a fixed number of weeks.
- Does the UAE or Saudi PDPL apply to us if we are based elsewhere?
- It can. The laws can reach organisations outside the region where they process the personal data of individuals there. We help you determine whether and how each regime applies during scoping.
- How does PDPL compare to GDPR?
- The UAE and Saudi laws share familiar data protection principles with GDPR, such as lawful bases, individual rights and security obligations, but differ in detail and in their transfer rules. Existing GDPR work gives you a strong head start.
- Is PDPL a certification?
- No. It is a legal obligation you demonstrate compliance with to the relevant authority, not a certifiable standard. We build the controls and evidence that support and demonstrate your compliance.
Related standards
Related reading
India's DPDP Act: A Practical Compliance Guide (2025)
What India's Digital Personal Data Protection (DPDP) Act requires, who counts as a data fiduciary, what the 2025 Rules add, the penalties, and a practical path to compliance.
9 min read
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read