UAE Data Protection and the IT Auditor's Role

For years, data protection in the UAE meant the financial free zones. DIFC and ADGM had their own modern laws and regulators, while most onshore organisations relied on sector rules and contracts. That changed with Federal Decree Law No. 45 of 2021 on the Protection of Personal Data, usually called the PDPL. It gives individuals rights over their data and places clear duties on the organisations that collect and use it.

At the time of writing, the executive regulations that will set out details such as breach notification timelines are still awaited, and the UAE Data Office is still being set up. Many organisations have read that as a reason to wait. It is the opposite. The core principles are already law, and the work needed to comply takes far longer than any grace period is likely to allow.

This is where IT audit earns its place. Lawyers can explain what the law requires. Auditors can show whether the organisation can actually do it.

Three regimes, one organisation

Groups operating across the UAE may sit under more than one regime. The federal PDPL covers onshore processing, while DIFC Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021 apply in those free zones, and sector rules for health and banking data continue alongside them. A useful first audit question is simply: which law applies to which entity and which dataset, and has anyone written that down?

Where IT audit adds value

1. Do we know what personal data we hold?

Every privacy obligation depends on a record of processing: what data, about whom, why, where it is stored and who it is shared with. Many organisations have a version prepared once by a consultant. Test it against reality. Pick a few systems and compare what the record says with what the database actually contains. Customer data copied into test environments, analytics platforms and spreadsheets is a common gap.

2. Is retention enforced, or only written?

Policies often say personal data is kept only as long as necessary. Systems usually keep it forever, because deletion was never built. Check whether any automated deletion or archiving exists, and look for the oldest records in key systems. Data that no longer has a purpose is pure risk.

3. Can we honour individual rights?

The PDPL gives individuals rights such as access, correction and erasure. Each request needs a process that finds the person's data across every system within a set time. Ask the team to walk through a test request. If finding one customer's data takes weeks of manual searching, the organisation is not ready.

Lawyers explain what the law requires. Auditors show whether the organisation can actually do it.

4. Would we know about a breach, and could we report it?

Breach notification depends on detection. Review whether logging and monitoring cover the systems holding personal data, whether the incident response plan includes a privacy assessment, and whether someone is clearly responsible for deciding when to notify the regulator and the people affected.

5. What leaves the country, and through whom?

Cross border transfers are restricted under all three regimes. Cloud services, offshore support teams and software vendors often move data abroad without anyone treating it as a transfer. Map where vendors host and access personal data, and check that contracts and approvals match.

6. Is privacy designed in?

Look at a recent project that handled personal data. Was there a privacy impact assessment before go live, or was privacy raised for the first time at the security review? Privacy built in at design is cheaper and far more effective than privacy bolted on afterwards.

Four questions for leadership

Which data protection laws apply to each of our entities, and who owns compliance?
Do we have a current, tested record of the personal data we hold?
How long would it take us to answer a request from a customer to delete their data?
If personal data were exposed tomorrow, who decides whether we notify, and how quickly?

Data protection is not a document exercise. It is the ability to know, protect, retrieve and delete personal data on demand. That ability lives in systems and processes, which is exactly what IT auditors test every day. Organisations that start now, while the detailed rules are still being finalised, will meet them calmly rather than in a rush.

This article is general commentary, not legal advice. Check the current text of the law and any regulations with qualified counsel.