UAE PDPL Compliance Checklist for Listed Companies, Banks and Insurers

How to determine applicability, organise privacy controls and build evidence of effective personal data protection.

A UAE PDPL compliance checklist for listed companies, banks and insurers should begin with applicability. Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data establishes the federal framework, but contains exclusions that matter considerably for financial institutions.

The first question is therefore: which law governs each processing activity?

Once that is clear, organisations can assess their data inventories, processing grounds, privacy communications, security controls and response procedures against the correct requirements.

Does the UAE PDPL Apply to Banks and Insurers?

Article 2 excludes personal banking and credit information, and personal health data, where legislation regulates their protection and processing. It also excludes specified government-related categories and establishments in free zones with their own data protection legislation.

These distinctions don’t justify assuming that every activity of a bank or insurer is exempt. Recruitment records, marketing databases and other information require their own applicability assessment.

Insurance data isn’t automatically excluded merely because an insurer holds it. Identify the information, its use and the applicable legislation.

For listed companies, listing status alone doesn’t determine PDPL coverage. Consider the legal entity, processing activity and relevant exclusions. Groups may need different compliance arrangements across their operations.

1. Document the Applicable Privacy Regime

Prepare a legal applicability matrix before issuing a company-wide policy.

Check whether:

• Each entity and processing activity has been assessed.

• Exclusions are supported by a documented legal basis.

• Relevant CBUAE and health-data requirements have been considered.

• Free-zone operations require separate treatment.

Evidence to retain: An applicability matrix, legal analysis and named responsibility for reviewing changes.

Don’t label everything “PDPL compliant” when different rules govern different datasets. That makes gaps harder to identify.

2. Build a Usable Personal Data Inventory

Identify where information enters the organisation, how teams use it and where it goes.

A practical inventory can cover employees, applicants, customers, individual shareholders, suppliers’ representatives and website users.

Record:

• Data categories and processing purposes.

• Systems, departments and responsible owners.

• Recipients, processors and storage locations.

• Retention periods and access arrangements.

Walk through actual workflows. A policy may describe central storage while staff routinely exchange spreadsheets by email.

The inventory should capture those practices too.

3. Review Processing Grounds and Consent

The PDPL permits processing without consent in specified circumstances, including qualifying contractual, employment and legal-obligation situations. Consent is therefore not the only possible basis.

For each activity, document why processing is permitted.

Where consent is used, check how it is obtained, recorded and withdrawn. Test the process from the individual’s perspective: can someone understand what they agreed to and change their choice?

Avoid using one broad consent statement to justify unrelated activities.

Evidence to retain: A processing-purpose register, applicable grounds assessment and relevant consent records.

4. Align Privacy Notices with Actual Practices

Review customer forms, recruitment portals, employee notices and website disclosures.

Do they explain the organisation’s practices accurately? Are recipients and overseas processing arrangements reflected where relevant?

Compare published wording with the data inventory. A notice stating that information is never shared may conflict with routine processing by payroll, cloud or customer-support providers.

Assign ownership for updates whenever a service changes.

Evidence to retain: Approved notices, publication records and change-control documentation.

5. Establish Privacy Ownership and Assess DPO Requirements

Article 10 sets conditional Data Protection Officer requirements, including specified high-risk processing and large-scale sensitive-data scenarios. Appointment shouldn’t be assumed mandatory solely because a company is listed.

Assess the relevant criteria and record the conclusion.

Regardless of the outcome, assign internal responsibility for coordinating privacy work. Define how legal, compliance, HR, technology and business teams contribute.

Also screen new projects for privacy risks before launch. Biometric access, automated profiling and extensive customer analytics deserve early scrutiny.

Evidence to retain: The DPO assessment, responsibility matrix and project-review records.

6. Review Processors and International Data Flows

A vendor contract should match the information handling involved.

Check instructions, confidentiality, security responsibilities, incident escalation, subcontracting and return or deletion arrangements.

Then map overseas hosting, support access and group sharing. The PDPL addresses cross-border processing; applicable banking or health-data rules may impose separate restrictions.

Don’t assume that selecting a UAE cloud region resolves every transfer question. Support personnel or integrated services may operate elsewhere.

Evidence to retain: Processing agreements, transfer assessments and approved data-flow maps.

7. Test Rights Handling and Retention

Create a workable route for privacy requests.

Test identity verification, routing, record searches and responses across connected systems. Where information must be retained for another legal obligation, obtain appropriate review before promising deletion.

A practical retention schedule should distinguish business convenience from justified retention.

Include shared drives, archives, backups and service-provider copies in implementation planning.

Evidence to retain: Request logs, decision records, retention schedules and deletion evidence.

8. Prepare Security and Breach Procedures

Privacy controls need operational support: appropriate access restrictions, secure sharing, reliable backups and prompt escalation.

Article 9 addresses breach reporting. Verify applicable notification triggers, procedures and timelines rather than importing GDPR’s 72-hour rule into every UAE incident.

Run an exercise involving a misdirected customer file or compromised account. Can teams identify affected information, preserve evidence and escalate quickly?

Evidence to retain: Incident procedures, exercise results and corrective-action records.

How ASC Global UAE Can Help

ASC Global UAE can support UAE data protection compliance through applicability reviews, privacy gap assessments, data mapping, notice reviews and implementation roadmaps.

Support can also include processor-contract assessments, DPO requirement reviews, rights-handling procedures and staff awareness sessions.

Discuss your requirements with ASC Global UAE to prioritise gaps, assign owners and establish evidence that privacy controls operate effectively.

Frequently Asked Questions

Are Banks Completely Exempt from the PDPL?

No blanket conclusion should be made. Assess the statutory exclusions against each dataset and processing activity.

Does PDPL Require All Personal Data to Stay in the UAE?

It provides cross-border processing routes. Separate sector requirements may impose additional restrictions.

Is There One Universal Compliance Deadline?

Article 29 links the adjustment period to Executive Regulations. Verify current implementing measures before publishing a deadline.