Jurisdiction-specific data protection, defamation law, and removal process information for United Arab Emirates. Last reviewed 2025.
UAE Digital Government Authority Data Office (federal); DIFC Data Protection Commissioner (for DIFC entities); ADGM Commissioner of Data Protection (for ADGM entities) is the supervisory authority for data protection in United Arab Emirates. Individuals can file erasure and data-related complaints directly with this authority.
Federal Decree-Law No. 45 of 2021 on Personal Data Protection (UAE PDPL); DIFC Data Protection Law 2020; ADGM Data Protection Regulations 2021
The UAE PDPL (Federal Law No. 45 of 2021) includes a right to erasure. The UAE operates a dual onshore/offshore framework: onshore UAE law governs most businesses, while DIFC and ADGM free zones have their own GDPR-aligned regimes often preferred by international businesses.
UAE Cybercrime Law (Federal Decree-Law No. 34 of 2021) criminalises online defamation and content harming reputation, privacy, or public morals. Penalties include fines and imprisonment. The law applies to content published anywhere if accessible in the UAE.
The Telecommunications Regulatory Authority (TRA) can block access to online content in the UAE. For search result removal, Google's global delisting process is available. Formal complaints can be filed with the UAE Cybercrime Unit. DIFC and ADGM entities can file complaints with their respective Data Protection Commissioners.
Common UAE and regional sources requiring removal include Gulf News, Khaleej Times, The National, Arabian Business, Al Bayan, and Arabic-language regional outlets accessible across the Gulf.
The UAE's DIFC and ADGM free zones have GDPR-aligned data protection laws that are often more practically aligned with international norms than the federal UAE PDPL. Businesses incorporated in these zones face a distinct, often stricter, data protection regime â relevant for international companies with UAE free zone operations.