Buyer Guides · 6 MIN
UAE PDPL and software projects: what to put in the contract
How Federal Decree-Law 45 of 2021 affects software and AI projects: roles, cross-border transfers, breach duties, free zones, and contract clauses to request.
The UAE Personal Data Protection Law is Federal Decree-Law No. 45 of 2021. For a software or AI project it means you should know your role as controller or processor, document where personal data goes, set breach and security duties in the contract, and check whether you sit in a free zone with its own regime. This guide lists the clauses to request and the questions to take to counsel.
- The federal law covers processing of personal data of individuals, and the UAE government says it applies to processing inside and outside the country.
- Free zones such as DIFC and ADGM have their own data protection laws, so the right regime depends on where your entity sits.
- The law has rules for transferring personal data outside the UAE, so a vendor working from another country needs a transfer basis written into the contract.
- A development vendor that handles your customer data is normally a processor, which should be reflected in a data processing clause.
- Check the status of the executive regulations and any Data Office guidance with UAE counsel, because the picture can change.
- Nactore is an AI-native technology and growth company in Mumbai that builds with data minimization and written data terms from the first sprint.
What is the UAE PDPL?
It is Federal Decree-Law No. 45 of 2021 on the protection of personal data, in force since 2 January 2022. The UAE government describes it as an integrated framework that sets rights and duties for everyone involved, and its scope covers processing through electronic systems inside or outside the country. Read the government summary and the official text on the UAE legislation portal.
The UAE Data Office is the federal regulator the law refers to. Executive regulations and guidance fill in detail, so ask your counsel which instruments are in force on the day you sign.
Which regime applies to you?
The federal law does not cover everything. Article 2 excludes, among others, government data, health and banking or credit data that have their own legislation, and companies in free zones with special data protection laws. DIFC in Dubai and ADGM in Abu Dhabi are the best-known examples, each with its own law and regulator.
| Where your entity sits | Likely regime | What to confirm |
|---|---|---|
| Mainland UAE company | Federal Decree-Law 45 of 2021 | Executive regulations and Data Office guidance |
| DIFC entity | DIFC data protection law | DIFC Commissioner requirements |
| ADGM entity | ADGM data protection regulations | Office of Data Protection requirements |
| Health or banking data | Sector legislation, where it regulates that data | Whether the PDPL exclusion in Article 2 applies to you |
What roles do you and your vendor play?
The law distinguishes the party that decides why and how data is processed (the controller) from the party that processes it on the controller's behalf (the processor). When a development team builds your customer app and touches production data, it is typically a processor and you are the controller.
That has a direct effect on the contract. Article 8 says the processor must follow your instructions and the contract, protect the data, and erase it when the processing period ends. Article 9 says it must tell you about a breach as soon as it becomes aware of it. Write each of those into the contract, and add help with data subject requests.
Can a vendor outside the UAE handle your data?
The law sets conditions for moving personal data out of the UAE. Article 22 allows transfers, in cases approved by the Data Office, to countries that have personal data protection laws and a regulator, or where the UAE has a data protection agreement with them. Article 23 adds other routes, including a contract that obliges a recipient in a country without data protection laws to apply the law's requirements, and the data subject's explicit consent. Confirm with counsel which transfer basis fits your case.
For a software project there are three practical moves.
- Minimize. Build and test with synthetic or masked data so most work involves no personal data at all.
- Keep production data in the UAE. Host production in a UAE cloud region where your risk assessment says to, and give the vendor access through controlled, logged sessions.
- Paper the transfer. If the vendor needs access from India or elsewhere, put the transfer basis, access limits and deletion duties in the contract.
What breach and security terms should the contract include?
The law expects controllers to protect data and to report certain breaches to the regulator and affected individuals. Your contract should push the same duties down to the vendor in plain terms.
- Notice. The vendor tells you without delay, with a stated outer limit in hours.
- Cooperation. The vendor supplies logs, scope and containment steps so you can meet your own reporting duty.
- Access control. Named staff only, multi-factor sign-in, no shared accounts.
- Subprocessors. The vendor lists every cloud and AI provider that sees your data, and asks before adding one.
- Return and deletion. Data is returned or deleted when the engagement ends, with written confirmation.
For AI projects add the model provider to that list and decide whether prompts and outputs are stored. The overlap with intellectual property is covered in IP and data terms for AI projects.
How does this affect a typical project?
- A website with forms. Forms collect names and phone numbers. Add a privacy notice in the languages your users read, a clear purpose, and a retention period.
- A mobile app. Map each data field to a purpose before launch. Remove fields you cannot justify.
- An AI chatbot. Decide what the bot may store, mask identifiers in logs, and keep a human escalation route. See human-in-the-loop automation.
- An internal tool. Employee data is personal data too, so access controls apply.
Ask your vendor for a one-page data map before development starts. It should list every data type, where it is stored, who can access it and when it is deleted.
Frequently asked questions
Does the UAE PDPL apply to a vendor outside the UAE?
The government describes the law as applying to processing inside or outside the country, so a foreign vendor working on UAE personal data should assume it is in play. Your counsel can confirm how it applies to your arrangement.
Is consent always required?
No. The law lists several lawful bases beyond consent. Which one fits depends on the purpose, so decide it per use case with counsel.
Do we need a data protection officer?
Article 10 requires one in defined cases, such as processing that causes a high risk to privacy, or processing a large volume of sensitive personal data. Check the current rules for your activity.
Is this legal advice?
No. It is a buyer's orientation to help you ask better questions. Confirm all legal points with qualified UAE counsel.
Write the data rules before the first sprint
A short data map, a processor clause and a clear transfer basis cost little at the start and are painful to add later. Nactore builds, ships, ranks and grows as one partner, with data terms agreed before the work begins.
Want this built for your team? Book a free 30-minute call.
Want to apply this to your business?
Book a free 30-minute call. We will tell you what we would do first.