UAE Data Transfers: Which Countries Are 'Adequate' Under the PDPL?

What Does 'Adequate' Mean Under the UAE PDPL?

The UAE Personal Data Protection Law (PDPL) requires that personal data transferred outside the UAE must have a level of protection 'essentially equivalent' to that provided under UAE law. The UAE Data Office is expected to issue a list of 'adequate' countries, but until then, companies must rely on other transfer mechanisms like Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs).

Current List of Adequate Countries

As of now, the UAE has not officially published a list of adequate jurisdictions. However, based on the law's criteria and international precedents, countries with comprehensive data protection laws (e.g., EU member states, UK, Japan, South Korea) are likely candidates. The UAE may also recognize countries with which it has reciprocal agreements.

How to Prepare for Transfers

Until the list is released, businesses should implement SCCs approved by the UAE Data Office or obtain explicit consent from data subjects. Conduct a Data Protection Impact Assessment (DPIA) for high-risk transfers. Check the official UAE data protection portal for updates.

Featured Snippet: Which countries are considered 'adequate' for UAE data transfers?

While no official list exists yet, the UAE PDPL suggests that countries with robust data protection laws—such as EU/EEA states, the UK, Japan, and South Korea—are likely to be deemed adequate. The UAE may also add nations with bilateral data protection agreements.

Practical Steps for Compliance

• Map all cross-border data flows.
• Review and update privacy notices to include transfer mechanisms.
• Implement SCCs or BCRs as a fallback.
• Monitor the UAE Data Office for the official adequacy list.

FAQ