Federal Decree-Law 45 of 2021 has been in force since 2 January 2022. The Executive Regulations are still pending, and once they issue you get six months.
Updated 13 Oct 2026. General information, not legal advice.
No. As of late September 2026 they were not listed on the UAE legislation portal. The claim that 'Cabinet Decision No. 33 of 2024' is the Executive Regulation is a copied error.
Yes. The Decree-Law has been in force since 2 January 2022: lawful processing, transparency, data-subject rights, security, breach notification, impact assessments for high-risk processing, and transfer limits (Arts. 22–23).
Article 29 gives controllers and processors six months from issuance to comply, and the Cabinet can extend it. Building a record of processing from zero takes most small firms longer.
On 14 June 2026 the UAE approved an Artificial Intelligence and Data Authority that brings together the UAE Data Office, the AI Office and parts of the TDRA. DIFC and ADGM keep their own data protection laws.
Get a free 1-page record-of-processing draft for your AI tool
Team Unadhi