Data Processing Agreement (UAE)

A Data Processing Agreement (DPA) in the United Arab Emirates is a legally binding contract between a data controller and a data processor that governs how the processor may handle personal data on behalf of the controller, in compliance with the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). The PDPL — the UAE's primary data protection statute, administered by the UAE Data Office — was enacted in November 2021 and applies to the processing of personal data by any person or entity subject to UAE law, including mainland UAE companies, government entities, and businesses in most UAE free zones. The DIFC and the ADGM maintain their own data protection regimes — the DIFC Data Protection Law (DIFC Law No. 5 of 2020) and the ADGM Data Protection Regulations 2021 — which are broadly aligned with the EU's General Data Protection Regulation (GDPR) and impose similar processor agreement requirements for entities established in those financial free zones.

Personal data under Article 1 of the PDPL means any data relating to an identified or identifiable natural person. This definition is broad and captures names, Emirates ID numbers, passport numbers, email addresses, phone numbers, financial data, health records, IP addresses, location data, and any other data that can be linked to a natural person. Processing means any operation performed on personal data, whether or not by automated means, including collection, storage, use, disclosure, combination, and deletion.

The PDPL distinguishes between the data controller — the person who determines the purposes and means of processing — and the data processor — the person who processes data on behalf of and under the instructions of the controller. The controller bears primary regulatory responsibility to the UAE Data Office and to data subjects. The processor, however, is not merely a passive tool: the PDPL imposes direct obligations on processors in relation to security, breach notification, sub-processing, and cross-border data transfers. Article 18 of the PDPL makes the controller liable for a processor's violations unless the controller demonstrates it took reasonable steps to select a compliant processor and monitor its performance. A well-drafted DPA is the primary mechanism by which the controller exercises that oversight and allocates compliance responsibility appropriately.

UAE enterprises that process personal data through third-party service providers — including SaaS platforms, cloud infrastructure, payroll bureaux, call centres, marketing analytics firms, IT service providers, and logistics companies — are required by the PDPL to execute a DPA with each service provider that acts as a processor. A DPA supplements the main services agreement and prevails over it on data protection matters. The UAE Data Office has powers to request DPAs from regulated entities during investigations and to impose penalties on controllers that engage processors without an adequate written agreement.

The PDPL's cross-border transfer regime in Chapter 7 adds a further dimension to UAE data processing agreements. Where a processor processes data outside the UAE — for example, through a cloud platform hosted in Europe, the United States, or Asia — the DPA must document the transfer mechanism: adequacy (for countries assessed by the UAE Data Office as providing equivalent protection), standard contractual clauses approved by the UAE Data Office, binding corporate rules for intra-group transfers, or another recognised basis. The Federal Tax Authority's five-year record retention requirement under Federal Decree-Law No. 8 of 2017 creates a regulatory minimum that interacts with the PDPL's data minimisation principle, requiring DPAs to address retention periods for tax-relevant personal data carefully.

A Data Processing Agreement in the UAE is required under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) whenever a data controller engages a data processor to process personal data on its behalf.

Cloud and SaaS services are the most common trigger. Any UAE business that uses a third-party cloud platform — whether for HR management, payroll (with MOHRE Wage Protection System compliance), customer relationship management, email hosting, accounting, document storage, or business intelligence — and that platform processes personal data of UAE residents, requires a DPA with the cloud or SaaS provider. The UAE Data Office has published guidance confirming that a DPA must be in place before processing begins.

Outsourced HR and payroll processing involves the processing of employee personal data including Emirates ID numbers, bank account details, salary information, and leave records. Payroll bureaux and HR outsourcing firms operating in the UAE are data processors under the PDPL and must have a signed DPA with each client employer.

Marketing analytics and customer data services involve the processing of customer personal data by advertising technology companies, data brokers, and analytics firms. Retailers, banks, and telecom operators that share customer data with analytics partners require a DPA governing the analytics firm's use of that data.

Call centre and contact centre outsourcing involves processing customer personal data by a third-party call centre. UAE businesses operating across the telecommunications, banking, insurance, and e-commerce sectors that outsource customer contact operations to a UAE or international call centre require a DPA.

IT managed services and security operations centres (SOCs) that access production systems containing personal data as part of their monitoring and management services act as processors under the PDPL. Banks and government entities regulated by the Central Bank of the UAE or the Abu Dhabi Judicial Department that outsource IT services require DPAs as part of their vendor management frameworks.

Healthcare data processing by third-party software providers, laboratories, telehealth platforms, and insurance claims processors involves sensitive personal data under Article 4 of the PDPL, which heightens the DPA requirements.

A UAE Data Processing Agreement compliant with the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) must contain the following elements. The forms-legal.com UAE DPA template addresses each component required by the UAE Data Office and the PDPL's executive regulations.

Party identification must record the full legal name, trade licence number, and address of the data controller and data processor. The roles of controller and processor must be explicitly stated, because the PDPL's obligations are role-specific.

Processing scope must specify: the purpose and nature of processing; the categories of personal data processed (ordinary and sensitive); the categories of data subjects; the duration of processing; and any specific processing activities that are permitted or prohibited.

Instruction clause must confirm that the processor will only process personal data on the controller's documented instructions and will notify the controller if it believes an instruction violates the PDPL.

Security obligations must require the processor to implement appropriate technical and organisational security measures, aligned with the risk to data subjects. The PDPL and the UAE Data Office's guidance specify security standards that must be addressed.

Confidentiality must require authorised personnel to be bound by confidentiality duties.

Data subject rights assistance must require the processor to assist the controller in responding to data subject requests under Articles 7 to 14 of the PDPL, including access, rectification, erasure, and restriction requests.

Data breach notification must require the processor to notify the controller without undue delay — and within 72 hours where possible — upon discovering a personal data breach, with sufficient detail for the controller to meet its PDPL notification obligations to the UAE Data Office under Article 17.

Sub-processor provisions must require the controller's prior written consent for sub-processor engagement and impose equivalent obligations on sub-processors. The processor remains fully responsible for sub-processor compliance.

Cross-border transfer rules must state where the data will be processed and confirm that any transfer outside the UAE complies with Chapter 7 of the PDPL, through adequacy, standard contractual clauses, binding corporate rules, or another lawful basis.

Return or deletion must require the processor to return or delete all personal data within 30 days of termination and certify deletion in writing.

Audit rights must allow the controller to verify compliance through information requests and third-party audits at reasonable notice.

Governing law and forum must identify UAE law and the competent court — the Dubai Courts, Abu Dhabi Judicial Department, DIFC Courts, or ADGM Courts — or an arbitral institution such as the Dubai International Arbitration Centre (DIAC) under the Federal Arbitration Law (Federal Law No. 6 of 2018).

Completing a UAE Data Processing Agreement under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) requires the parties to map the personal data flows between them and agree the processing parameters. Follow these steps.

Begin with the parties. Enter the data controller's full legal name, trade licence number, and registered address. The controller is the business that owns the personal data and determines why it is processed. Enter the data processor's full legal name and trade licence. The processor is the service provider that will act on the controller's instructions. Confirm that both signatories hold board authorisation or a power of attorney under the Commercial Companies Law (Federal Decree-Law No. 32 of 2021).

Enter the date in DD/MM/YYYY format.

Describe the processing purpose precisely. A vague purpose such as 'providing IT services' does not satisfy the PDPL's specificity requirement. Write the purpose in terms of the concrete processing operation: for example, 'providing cloud-based payroll processing services to the Controller, including calculating monthly salaries, generating WPS transfer files for the Ministry of Human Resources and Emiratisation, and archiving payroll records for tax purposes.'

List all categories of personal data. Separate ordinary personal data from sensitive personal data as defined in Article 4 of the PDPL. If health, biometric, or financial data is included, note that and confirm the legal basis under which the controller authorises processing of sensitive data.

State the categories of data subjects clearly: for example, 'employees and former employees of the Controller, and their dependants.'

Set the processing duration. Link this to the term of the main services agreement and add any required regulatory tail period for record-keeping purposes under the Federal Tax Authority's five-year records retention requirement.

Choose the data hosting location. UAE-only hosting is the simplest PDPL-compliant option. Cross-border hosting requires identification of the applicable transfer mechanism, which should be documented in a Cross-Border Transfer Schedule attached to the DPA.

Select the governing forum. For enterprise DPAs where the processor is a DIFC or ADGM entity, the DIFC Courts or ADGM Courts are common choices. For purely mainland arrangements, the Dubai Courts or Abu Dhabi Judicial Department are the standard forums.

A UAE Data Processing Agreement must satisfy the requirements of the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and its executive regulations issued by the UAE Cabinet, enforced by the UAE Data Office.

Article 18 of the PDPL requires that a controller only engage a processor that provides sufficient guarantees about implementing appropriate technical and organisational measures to ensure processing complies with the PDPL. The controller must document these guarantees in a written DPA.

The DPA must be in writing and must specify the subject matter, duration, nature, and purpose of the processing, the type of personal data, the categories of data subjects, and the obligations and rights of the controller.

The processor must process personal data only on the controller's documented instructions under Article 18(4) of the PDPL. Processing beyond those instructions, unless required by UAE law, constitutes a violation.

Security measures must be implemented under Article 16 of the PDPL and the UAE Data Office's technical security guidance. Measures must be appropriate to the risk, taking into account the nature of the data and the likelihood and severity of harm to data subjects.

Data breach notification must follow the timeline and content requirements of Article 17 of the PDPL. The controller must notify the UAE Data Office of breaches affecting data subjects' rights and interests within 72 hours of becoming aware, and must notify affected data subjects where the breach is likely to result in high risk to them.

Cross-border transfers must comply with Chapter 7 of the PDPL. The UAE Data Office's list of adequate countries must be checked, and standard contractual clauses or binding corporate rules must be in place for transfers to non-adequate countries.

Retention and deletion obligations must reflect both the PDPL's data minimisation principle and any UAE sector-specific retention requirements, including the Federal Tax Authority's five-year record-keeping obligation under Federal Decree-Law No. 8 of 2017 and the Labour Law (Federal Decree-Law No. 33 of 2021) requirements for employment records.

For DIFC and ADGM entities, the DIFC Data Protection Law (DIFC Law No. 5 of 2020) and the ADGM Data Protection Regulations 2021 apply instead of the federal PDPL and impose equivalent DPA requirements.

UAE Data Processing Agreements frequently fail to protect the parties or comply with the PDPL because of the following errors.

1. No DPA in place at all. The most serious error is engaging a data processor without any written agreement, in direct violation of Article 18 of the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). The UAE Data Office may impose penalties on the controller and the processor. Execute a DPA before processing begins.

2. Vague processing purpose. A DPA stating 'IT services' or 'data management' as the processing purpose fails the PDPL's specificity requirement. Define the purpose in concrete operational terms aligned with the services agreement.

3. Missing sensitive data provisions. Where the processor handles health, biometric, or financial personal data, the DPA must identify the sensitive data categories and confirm the legal basis. An agreement silent on sensitive data creates regulatory and liability exposure under Article 4 of the PDPL.

4. No sub-processor controls. Allowing the processor to engage sub-processors without the controller's prior written consent undermines the controller's ability to maintain oversight of its data. Require written consent and equivalent DPA obligations for every sub-processor.

5. No data breach notification timeline. A DPA without a specific breach notification obligation — requiring the processor to notify the controller within 72 hours of discovering a breach — prevents the controller from meeting its own notification obligations to the UAE Data Office under Article 17 of the PDPL.

6. Vague cross-border transfer provisions. A DPA that permits transfer 'to our global infrastructure' without specifying the countries, the data categories transferred, and the applicable transfer mechanism violates the PDPL's Chapter 7 requirements and may expose both parties to penalties.

7. No deletion certification obligation. A DPA without a requirement to certify deletion of personal data within a defined period after termination leaves the controller unable to demonstrate PDPL compliance in an audit, and leaves residual personal data in the processor's systems beyond the lawful retention period.

8. Applying GDPR templates without UAE-specific adaptation. Many UAE businesses use GDPR-based DPA templates without adapting them to the PDPL framework. While the PDPL and GDPR are broadly aligned, they differ on transfer mechanisms, the UAE Data Office's role, specific penalty provisions, and enforcement procedures. A GDPR-only DPA may not satisfy a UAE Data Office audit.