UAE cyber, data and AI regulation: what to expect to October 2027

The United Arab Emirates (UAE) does not have one rulebook. It has several, depending on where a firm is licensed. The federal Personal Data Protection Law (PDPL) has been in force since January 2022, but its Executive Regulations have never been issued, so its breach deadline and fines are still blank [1][2]. In June 2026 the government created an Artificial Intelligence and Data Authority that takes over the dormant UAE Data Office [3]. Meanwhile the real enforcement comes from the Central Bank and the two financial free zones, DIFC and ADGM. Boards should map which regime applies to each entity and not wait for the federal law to bite.

At a glance

• Federal privacy law with no teeth yet. No PDPL Executive Regulations appear on the official legislation portal (checked 8 Oct 2026) [2].
• New super-regulator. The AI and Data Authority, approved on 14 June 2026, merges the AI Office, the UAE Data Office and the Telecommunications and Digital Government Regulatory Authority's (TDRA's) digital-government arm [3].
• Bigger stick for finance. Federal Decree-Law No. 6 of 2025 allows Central Bank fines of up to AED 1bn. Its one-year transition ended on 16 September 2026 [7].
• Free zones enforce. The Dubai International Financial Centre (DIFC) issued 717 preliminary fine notices in 2025 [13]. Abu Dhabi Global Market (ADGM) fines can reach USD 28m [16].
• Children online. The Child Digital Safety Law has applied since 1 January 2026. Platforms have until January 2027 to comply [5][6].

The rulebook now

Federal data protection. Federal Decree-Law No. 45 of 2021 has been in force since 2 January 2022 [1]. Article 9 requires controllers to report breaches to the regulator. But the deadline and procedure are left to Executive Regulations that do not yet exist [1][2]. Once issued, firms get six months to comply (Art. 29) [1][24].

Cyber security. There is no single federal cyber security law. The UAE Cyber Security Council (CSC) works through national policy instead. A five-year National Cybersecurity Strategy was approved by the Cabinet and announced in February 2025 [18]. On 27 November 2025 the National Encryption Policy and its executive regulation were approved. Government bodies must plan a move to post-quantum cryptography [19]. Criminal offences sit in Federal Decree-Law No. 34 of 2021 on cybercrime [23].

Financial services. Federal Decree-Law No. 6 of 2025 took effect on 16 September 2025 and brought banking and insurance under one Central Bank of the UAE (CBUAE) framework [7][8]. Article 168 allows fines of up to AED 1bn, or ten times the sum involved [7]. On 23 February 2026 the CBUAE issued guidance on artificial intelligence (AI) for all licensed firms. It covers governance, fairness, explainability, human oversight and data [9].

Children's online safety. Federal Decree-Law No. 26 of 2025 was issued on 1 October 2025 and applied from 1 January 2026, with one year to comply [5]. Platforms and internet providers that target UAE users are covered. They need parental consent to process data of children under 13, and TDRA enforces [6].

Free zones. The DIFC Data Protection Law (DIFC Law No. 5 of 2020) was amended by DIFC Law No. 1 of 2025, enacted on 8 July 2025 [12]. It now gives individuals a private right to sue for compensation (Art. 64A). Breaches must go to the Commissioner "as soon as practicable" [11]. Schedule fines reach USD 100,000 per breach, and general fines are uncapped [11]. Regulation 10, enacted in September 2023, governs personal data in AI and autonomous systems [11]. ADGM's Data Protection Regulations 2021 require breach notice within 72 hours where feasible [17].

Health (Abu Dhabi). Version 2 of the Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS) took effect in August 2024. It requires a breach form to the Department of Health within 72 hours [21].

The regulators and how they behave

Central Bank (CBUAE): active and visible. Its sanctions are mostly for anti-money-laundering failures, not cyber, but they are large. One example is AED 200m on an exchange house in May 2025 [10]. Expect the same approach under the new law. Posture: strict.

DIFC Commissioner of Data Protection: the most active privacy enforcer. In 2025 it ran 1,297 thematic assessments and issued 717 preliminary and 273 final administrative fine notices. It fined 246 firms for ignoring a Regulation 9 assessment [13]. Its decision notices name firms, including Careem Group (2024) and Dalma Capital (2025) [13]. Posture: strict on process, guidance-led on substance.

ADGM Office of Data Protection: quieter. It lists two public actions: a direction against VentureRock Global for security failings (June 2023) and a penalty notice against Okadoc Technologies (May 2024) [15]. Posture: cooperative.

Cyber Security Council (CSC): a policy-maker and incident responder, not a fining body. Since the regional conflict of 2026 it has been on a war footing. Its head said on 15 September 2026 that 640,000 attacks had been seen in one day, many linked to Iran's Revolutionary Guard [20]. Posture: security-led, publishes policy, not penalties.

Federal privacy regulator: has not acted. The UAE Data Office never became fully operational [4]. Its functions now pass to the new AI and Data Authority [3]. Posture: slow.

Dubai Electronic Security Center (DESC): sets binding security standards for Dubai government and critical infrastructure under Dubai Law No. 11 of 2014. It publishes no penalties [22].

What's coming in the next 12 months

• Now – 2027 (expected, no date): the AI and Data Authority sets up. Its remit covers proposing legislation and setting data and AI standards [3]. Whether it issues the PDPL Executive Regulations, and when, is not public [4]. [CHECK: decree or legal instrument creating the Authority not yet located]
• Late 2026 onwards: CBUAE enforcement under Decree-Law No. 6 of 2025, now the transition has ended (16 Sep 2026) [7].
• Expected late 2026 / 2027: final DIFC amendments after Consultation Paper No. 3 of 2026 (closed 18 July 2026). They would tighten Regulation 10 and add a Regulation 11 on certification schemes [14].
• January 2027: the Child Digital Safety Law becomes fully enforceable. Rules on platform risk tiers and sanctions are still awaited [5][6].
• May 2027: ADHICS v2 is due for revision [21].
• Through 2027 (expected): more CSC standards and policies under the national strategy, including follow-up on AI security and encryption [18][19]. [CHECK: no dated CSC pipeline published]

What it means for organisations

• Map the regime by entity. Mainland, DIFC, ADGM and sector rules differ on breach deadlines and fines. A group with a DIFC or ADGM entity is already under active enforcement.
• Plan for a federal breach deadline. Assume a short window when the PDPL Executive Regulations arrive, and budget for the six-month compliance period that follows [24].
• Financial firms: treat the new law as live. Check technology-risk and AI governance against the CBUAE Rulebook and the February 2026 AI guidance [9].
• DIFC firms using AI: prepare for Regulation 10 certification and assume private claims are possible [11][14].
• Consumer platforms: check age assurance and parental consent before January 2027 [5][6].
• Raise threat readiness. Attack volumes against UAE targets stay high, with state-linked actors named by the CSC [20].

This article is general information, not legal advice.

Sources

1. UAE Legislation portal, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data: https://uaelegislation.gov.ae/en/legislations/1972
2. UAE Legislation portal, PDPL related legislation (no executive regulation listed, 8 Oct 2026): https://uaelegislation.gov.ae/en/legislations/1972/related-legislations
3. WAM, "Mohammed bin Rashid approves establishing Artificial Intelligence and Data Authority", 14 Jun 2026: https://www.wam.ae/en/article/c0pz7ku-mohammed-bin-rashid-approves-establishing
4. Morgan Lewis, "UAE Establishes Federal Authority for Artificial Intelligence and Data", Jun 2026: https://www.morganlewis.com/pubs/2026/06/uae-establishes-federal-authority-for-artificial-intelligence-and-data
5. UAE Legislation portal, Federal Decree-Law No. 26 of 2025 on Child Digital Safety: https://uaelegislation.gov.ae/en/legislations/3912
6. Baker McKenzie, "UAE issues new Child Digital Safety Law", Jan 2026: https://www.bakermckenzie.com/en/insight/publications/2026/01/uae-issues-new-child-digital-safety-law
7. CBUAE Rulebook, Federal Decree-Law No. 6 of 2025 (Arts. 168, 184): https://rulebook.centralbank.ae/en/rulebook/federal-decree-law-no-6-2025-regarding-central-bank-regulation-financial-institutions-and
8. UAE Legislation portal news, Federal Decree-Law on the Central Bank, 10 Oct 2025: https://uaelegislation.gov.ae/en/news/uae-president-issues-federal-decree-law-on-central-bank-regulation-of-financial-institutions-insurance-activities
9. CBUAE, AI guidance note press release, 23 Feb 2026: https://centralbank.ae/media/41gjisn4/cbuae-issues-guidance-note-to-protect-consumers-and-ensure-responsible-use-of-artificial-intelligence-in-the-financial-sector-en.pdf
10. CBUAE, Enforcement page and sanction releases: https://centralbank.ae/en/our-operations/enforcement/
11. DIFC, Data Protection Law No. 5 of 2020, consolidated July 2025: https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-law.pdf
12. DIFC, Enactment Notice, DIFC Law No. 1 of 2025 (8 Jul 2025): https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/difc-laws-amendment-law-no-1-of-2025.pdf
13. DIFC Commissioner of Data Protection, Supervision & Enforcement: https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection/supervision-enforcement
14. DIFC press release via Mondo Visione, "DIFC announces consultation of amended DIFC Data Protection Regulations", 18 Jun 2026: https://mondovisione.com/media-and-resources/news/difc-announces-consultation-of-amended-difc-data-protection-regulations-2026618/
15. ADGM Office of Data Protection, Regulatory Actions: https://www.adgm.com/operating-in-adgm/office-of-data-protection/regulatory-actions
16. ADGM, "Penalties of Non-Compliance with the DPR 2021": https://assets.adgm.com/download/assets/ADGM+Penalties+of+Non-compliance+Infographic.pdf/07c1a10858a811efb9d15e7c57113ad4
17. DLA Piper, Data Protection Laws of the World: UAE – ADGM: https://www.dlapiperdataprotection.com/countries/uae-abu-dhabi-global-market-free-zone/law.html
18. WAM, "UAE to launch National Cybersecurity Strategy", 11 Feb 2025: https://www.wam.ae/en/article/bi5dfsr-uae-launch-national-cybersecurity-strategy
19. WAM, "UAE announces approval of National Encryption Policy, issuance of executive regulation", 27 Nov 2025: https://www.wam.ae/en/article/15w563h-uae-announces-approval-national-encryption-policy
20. The National, "Iran's IRGC behind many cyber attacks on UAE, says security chief", 16 Sep 2026: https://www.thenationalnews.com/news/uae/2026/09/16/irans-irgc-behind-many-cyberattacks-on-uae-says-security-chief/
21. Department of Health – Abu Dhabi, ADHICS Version 2 (DOH/SD/ICSO/ADHICS/V2/2024): https://www.doh.gov.ae/-/media/78A323607B4C4ACAA58D0C9ACCFB3D59.ashx
22. DESC, Standards & Policies: https://www.desc.gov.ae/regulations/standards-policies/
23. UAE Government portal (u.ae), "Data protection laws" (updated 4 Dec 2025): https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws
24. DLA Piper, Data Protection Laws of the World: UAE – General: https://www.dlapiperdataprotection.com/countries/uae-general/law.html