Training data residency in the UAE is governed by Federal Decree-Law No. 45 of 2021, the Personal Data Protection Law, and the practical problem for anyone buying a training platform is that the law restricts cross-border transfer while the UAE Data Office has not published an adequacy list, which leaves contractual safeguards and documented assessments doing the work. Learner records are personal data, so this applies to your training stack the same as any other system, and it is worth asking where compliance training records physically sit before a client’s legal team asks you.
Key Takeaways
- UAE PDPL is Federal Decree-Law No. 45 of 2021, in force since 2 January 2022, and it has explicit extraterritorial reach: it applies to any entity processing the personal data of individuals in the UAE regardless of where that entity is established.
- Cross-border transfer is governed by Articles 22 and 23, with the primary mechanism being an adequacy determination. As of early 2026 the UAE Data Office had not published an adequacy list, so organisations rely on contractual safeguards and documented impact assessments instead.
- Sources conflict on the status of the Executive Regulations. Some cite Cabinet Decision No. 33 of 2024 as in force; others state the Executive Regulations remain unpublished. This needs checking with counsel rather than resolving from published summaries.
- DIFC and ADGM operate separate regimes. DIFC Data Protection Law No. 5 of 2020 as amended is a distinct framework, and mainland UAE is not on DIFC’s adequacy list, so DIFC-to-mainland transfers need their own safeguards.
- Learner records are personal data. A training platform is in scope, and “it is in the cloud” is not an answer to where your data sits.
🖥️ Sign In to Access Your Dashboard
Why This Reaches Your Training Stack
Learner names, employer, progress records, assessment results, and support conversations are all personal data. A learning platform processes it, usually as a processor on your behalf, which makes you the controller and puts the obligation with you.
That has an uncomfortable implication for training providers: your client’s compliance exposure runs through your platform choice. If a corporate client carries residency obligations and your delivery system stores learner data somewhere that cannot satisfy them, you have created a problem for a client who assumed you had checked.
This is increasingly being caught in procurement rather than after the fact, which is better for everyone and slower for deals where the vendor cannot answer.
What the Law Actually Says
Scope: The PDPL applies to controllers and processors in the UAE processing personal data, and to entities established outside the UAE processing the data of data subjects in the UAE. The practical trigger is whether you are targeting UAE residents or systematically processing their data, not whether you have a UAE office.
Core obligations: Controllers and processors must meet general obligations, report breaches, appoint a Data Protection Officer where defined triggers apply, honour data subject rights including information, portability, correction and erasure, secure personal data, run data protection impact assessments, and control cross-border transfer and sharing.
Cross-border transfer: Under Articles 22 and 23, data may only move abroad under specific lawful conditions, with adequacy the primary mechanism, and in the absence of a published adequacy list businesses rely on data transfer agreements and documented impact assessments.
Exclusions: The PDPL does not apply to government data, personal data held by security and judicial authorities, health data and financial or credit data governed by their own legislation, or entities in free zones with their own data protection regimes.
That last exclusion matters for training providers with financial services clients, because DIFC and ADGM entities sit under separate frameworks.
Position as at September 2026. Verify with counsel before relying on any of this.
The Open Question Worth Being Honest About
Published sources disagree on whether the PDPL Executive Regulations are in force.
Some report Cabinet Decision No. 33 of 2024 as the implementing regulation, in force since 2024, providing detail on data subject rights procedures, consent, cross-border safeguards, and breach notification timelines. Others state that the Executive Regulations, due within six months of the law’s publication, remained unpublished as of early 2026, with the UAE Data Office not yet fully operational and full compliance required by 1 January 2027.
Sources also differ on which instrument is the operative one, with Cabinet Decision No. 111 of 2023 cited elsewhere.
We are not going to pretend to resolve that. The practical position is the same under either reading: implement based on the PDPL text and international best practice, use contractual safeguards for transfers, document your reasoning, and get a qualified view on your specific circumstances. If regulations are issued or clarified, expect an adjustment window.
The Frameworks Are Not One Framework
| Regime | Applies to | Note |
| UAE PDPL (Federal Decree-Law 45/2021) | Mainland UAE and most free zones | No published adequacy list as of early 2026 |
| DIFC Data Protection Law No. 5 of 2020, as amended | DIFC-registered entities | Separate adequacy list; mainland UAE not on it |
| ADGM Data Protection Regulations 2021 | ADGM entities | Separate regime |
| Sectoral rules | Health, banking and credit data | Governed by their own legislation |
The row that surprises people: a transfer from DIFC to mainland Dubai is a cross-border transfer requiring safeguards. If you deliver training to a DIFC client, that is worth knowing before you design the data flow.
📄 Generate a Free PDF Sample Course in Your Cloned Voice
What to Ask a Training Vendor
These are the questions that produce useful answers rather than reassurance:
- Where is our learner data physically stored, by country?
- Which sub-processors touch it, and in which jurisdictions?
- Do you offer a data processing agreement, and does it address PDPL specifically or only GDPR?
- What is the retention period, and can we shorten it?
- Does our content or learner data train your models?
- Can we export all learner records in a standard format at any time?
- What is your breach notification commitment, in hours?
- Have you documented a transfer impact assessment we can review?
Question 3 catches a common gap. A GDPR-drafted DPA is a reasonable starting point and is not the same as addressing PDPL, particularly on transfer mechanisms where the UAE position differs. The wider vendor evaluation checklist covers the commercial and capability side.
A Note on Scope of This Post
Saudi Arabia operates its own personal data protection framework under SDAIA, with its own transfer rules and its own timelines. It is a genuinely separate analysis and it deserves its own post rather than a paragraph here, so we have kept this one to the UAE rather than summarise Saudi law badly.
If you operate in both markets, treat them as two compliance programmes. The schemes are parallel, not shared, in the same way Nafis and HRDF are parallel rather than shared.
Frequently Asked Questions
Yes. Federal Decree-Law No. 45 of 2021 has extraterritorial scope and applies to any entity processing the personal data of individuals in the UAE regardless of where that entity is established. A platform hosted in the EU or US that processes UAE learner data is in scope, and the practical trigger is whether UAE residents’ data is being systematically processed rather than whether the vendor has a UAE office.
Only under the lawful conditions in Articles 22 and 23. The primary mechanism is an adequacy determination, but as of early 2026 the UAE Data Office had not published an adequacy list, so organisations rely on contractual safeguards such as data transfer agreements plus documented data protection impact assessments. Confirm the current position with counsel, since this is the part most likely to have changed.
It does not impose blanket localisation. It restricts cross-border transfer to lawful conditions, which is a different obligation. In practice, some clients, particularly public sector and regulated entities, impose their own residency requirements that go beyond the law, so your client contracts may be stricter than the statute.
Not automatically. The frameworks are broadly aligned in principle, and PDPL includes GDPR-like requirements on consent, data subject rights, DPIAs, and breach reporting. But transfer mechanisms differ, notably the absence of a published UAE adequacy list, so a GDPR-drafted data processing agreement may not address the UAE position. Ask for PDPL to be addressed specifically.
No. Both operate separate regimes: DIFC under Data Protection Law No. 5 of 2020 as amended, and ADGM under its own 2021 regulations. Mainland UAE is not on DIFC’s adequacy list, so a DIFC-to-mainland transfer requires its own safeguards.
If your training vendor answers the data location question with “the cloud”, that is the answer you needed. Ask for the country, the sub-processors, and the transfer assessment in writing, then hand it to whoever signs off your client contracts.
