Key takeaways
- Know what personal data you hold and where it is stored
- Limit access to the people who need it
- Encrypt devices and back up data securely
- Have a plan for reporting and handling a data breach
The UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data sets rules for how businesses handle information about customers, staff and suppliers. Free zones such as DIFC and ADGM have their own data protection laws too. Legal advice should guide your obligations, but much of the practical work falls to IT.
Map your data
Start by listing what personal data you hold, why you hold it and where it lives. Common places include email, shared drives, CRM and HR systems, accounting software, CCTV recordings and paper files that have been scanned. You can't protect data you don't know about.
Control access
Give each person access only to the data their role needs. Remove accounts promptly when staff leave, review shared folders regularly and use multi-factor authentication on every system that holds personal data.
Core security controls
These measures cover most of the technical expectations:
- Full-disk encryption on laptops and mobile devices
- Up-to-date firewalls, antivirus and patching
- Secure, tested backups stored separately from live data
- Email security to block phishing and malware
- Logging so you can see who accessed what
Keep only what you need
Holding data forever increases risk. Set retention periods for different types of records and delete or anonymise data when it is no longer needed. Old CCTV footage and former employee files are common examples.
Plan for a breach
Decide in advance who investigates, who contacts affected people and authorities, and how systems are restored. A written incident plan, tested once a year, saves critical time when something goes wrong.
How we help
We run IT security assessments, set up access controls, encryption, backups and monitoring, and document what is in place. We work alongside your legal adviser so the technical side matches your obligations.
Frequently asked questions
It applies broadly to organisations processing personal data in the UAE, with some exceptions. Confirm your position with a legal adviser.
Companies in DIFC and ADGM follow their own data protection regulations, which have similar principles.
Generally yes, with appropriate safeguards. Some sectors have extra rules on where data is stored.
A data map and a basic security review are the most useful first steps.
