Compliance Colleague · Standards · Arab Gulf States

UAE: PDPL, DIFC, ADGM, CBUAE and IA Standard: cited answers and gap reviews

An AI compliance assistant for organizations onshore and in the UAE's financial free zones · updated 2026-10-03

The UAE runs separate data protection regimes onshore and in the DIFC and ADGM, alongside sector and cybersecurity rules. Compliance Colleague starts by working out which regime applies, then covers the Federal PDPL, DIFC and ADGM data protection law, health data localization, the IA Standard and CBUAE rules.

Try it on your own UAE work: one document review or two questions, free for 30 days, no card required. Start free →

What it covers

Federal PDPL (Decree-Law 45/2021) and the UAE Data Office
DIFC Data Protection Law No. 5 of 2020 (as amended in 2025), including Regulation 10 on AI
ADGM Data Protection Regulations 2021 and 2025 rules
Health data localization (Federal Law 2/2019) and ADHICS
Cyber Security Council IA Standard v2, Dubai DESC ISR and CBUAE rules

Questions you can ask

“We're in the DIFC. Which data protection law applies to us, and to our onshore branch?”
“Can UAE health data be stored outside the country?”
“What does DIFC Regulation 10 require for AI systems?”

Every answer cites the UAE requirement, article or control it rests on, so you can check it in seconds.

What you can upload for review

Your privacy notice checked against the regime that applies
A data-flow diagram checked for cross-border transfers and localization
An IA Standard control tracker (Excel) checked for gaps

Files: PDF, Word, Excel or CSV, Visio (.vsdx), draw.io, or an image such as a screenshot. Choose a full review, a prioritized fix list (each gap with its fix and the evidence an assessor will expect) or a short summary, and download the result as Word or PDF.

Crosswalk UAE to other standards

With UAE in your plan you can compare it against any standard in the library and see where they align and exactly where they don’t. Common pairings:

What it’s built from

Compliance Colleague works from our own clause-referenced material, checked against: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) (UAE Government (UAE Legislation portal)); DIFC Data Protection Law No. 5 of 2020 (consolidated) (Dubai International Financial Centre (DIFC)); DIFC Data Protection Regulations (Dubai International Financial Centre (DIFC)). It cites the clause so you can check it against your own copy.

Re-checked every month for new versions, deadlines and penalty changes. Full list on the sources page.

More Arab Gulf States standards

Saudi Arabia · Qatar · Bahrain · Oman · Kuwait

Compliance Colleague covers 30+ security, privacy and AI governance standards. It reviews policies, spreadsheets and diagrams and answers questions with the clause cited; your judgment and sign-off stay with you. Try it free, no card required →

Research aid, not legal or audit advice, and not an audit opinion or certification. Verify findings against the official text before relying on them.