Privacy policy under Federal Decree-Law No. 45/2021 on the Protection of Personal Data ("PDPL") — legal basis for processing, data subject rights, breach notification, and cross-border transfer restrictions, ahead of the 1 January 2027 full-compliance deadline.
⚠️ This is a blank template, not legal advice: check the wording with a lawyer and adapt it to your jurisdiction and your case.
This template has no optional clauses: the text is the same for everyone.
Required fields not filled: 9. The PDF will have blank lines in their place to fill in by hand.
Click a field label in the text and type, or use the form. Empty fields become blank lines in the PDF.
PRIVACY POLICY (PDPL)
(Trade Licence No. )
This policy is issued under Federal Decree-Law No. 45/2021 on the Protection of Personal Data ("PDPL") and its executive regulations. Full compliance is required by 1 January 2027 under the transitional deadline; this policy documents the legal basis for processing (consent is the default basis), the data subjects' rights, breach notification to the UAE Data Office, DPIAs where required, and restrictions on cross-border transfer.
1. DATA WE COLLECT 1.1.
2. WHY WE COLLECT IT 2.1. 2.2. Legal basis: .
3. RETENTION 3.1.
4. THIRD PARTIES AND PROCESSORS 4.1.
5. CROSS-BORDER TRANSFER 5.1.
6. DATA PROTECTION CONTACT 6.1. . A dedicated Data Protection Officer is mandatory only for large-scale processing of sensitive data, systematic monitoring, or high-risk profiling — a smaller business needs only a contact person.
7. YOUR RIGHTS 7.1.
8. SCOPE 8.1. This policy is written for UAE mainland entities under the PDPL. DIFC and ADGM apply their own data protection laws, not the PDPL — confirm which regime applies before use.
Version date:
This is a boilerplate template, not legal advice. It is written for UAE MAINLAND businesses under MOHRE (Federal Decree-Law No. 33/2021 and its executive regulations); free zones (DMCC, JAFZA, and others) have their own labour contract portals and forms, and DIFC/ADGM are separate common-law jurisdictions with their own employment law and data-protection law (DIFC Employment Law, DEWS instead of gratuity, and data-protection rules other than the PDPL) — confirm which regime applies before use. Emirate-level rules (Dubai DET/DM, Abu Dhabi ADDED/DCT/ADAFSA, Sharjah SEDD, and others) also diverge. Have this template reviewed by a UAE-qualified lawyer and verified against the current MOHRE, WPS, PDPL, and emirate-specific requirements before use.
Documents that are usually drawn up in the same process.
Online-trading terms and conditions under Federal Decree-Law No. 14/2023 on Trading by Modern Technological Means — covers websites, apps, and social-media trading (Instagram Shop, WhatsApp Business)…
Refund and exchange policy that must be displayed at the point of sale in Arabic and English under the Consumer Protection Law — a blanket "no refund / no exchange" notice is unlawful against defecti…
Annual trade licence renewal checklist — late renewal is subject to a fine of around AED 250 per month and blocks visa-related transactions, and prolonged non-renewal can lead to administrative closu…
1 of 11 fields are taken from the company, employee or counterparty record, the questionnaire can be dictated to the AI, and the finished document comes with a number, a PDF and an acknowledgement record.