UAE PDPL Awareness Training

Opens by asking whose personal details went through your hands today, then has you trace where one customer's data sits: systems, inboxes, phones, suppliers and countries. Shows personal data in every team, from booking systems to HR, payroll, visa records and cookies, with extra care for sensitive data such as a medical note. Introduces Federal Decree-Law No. 45 of 2021, in force under Article 31 from 2 January 2022. Cites the DIFC Commissioner of Data Protection's 2025 figures: 1,297 thematic assessments, 717 preliminary notices of fines and 273 fine decisions for basic failures. Summarises the duties and rights, then introduces GHK Travel LLC, a worked example of a 900-staff online travel agency on the Dubai mainland with a cloud booking platform and a support partner in Manila. Closes with the eleven modules, practice questions and the 30-question final exam.

What you will be able to do

• Explain why personal data protection under the UAE PDPL concerns every team, not only IT
• Trace where one customer's personal data sits across systems, suppliers and countries
• Describe what DIFC enforcement figures show about regulators checking the basics

Why it matters

Shows staff and managers why the UAE PDPL applies to their daily work, and builds the habit of knowing where data sits before protecting it.

Practice: Practice: Why the UAE PDPL matters · 3 questions

Starts with a DIFC bank joining GHK Travel's corporate travel desk and its lawyer asking which law applies to what. Introduces the UAE Data Office, set up by Federal Decree-Law No. 44 of 2021. Covers the status: in force since 2 January 2022, Executive Regulations under Article 28 still not issued as of September 2026, and Article 29's six months to comply once they are, extendable by six more. Walks through the 31 articles, the Article 3 exemption that still awaits its standards, and the details left to the regulations and to an Article 26 Cabinet decision on penalties. Notes the federal authority for AI and data announced on 14 June 2026. Maps the federal PDPL, DIFC Law No. 5 of 2020 and the ADGM regulations, plus sector laws for health, banking and consumers. Ends with the mistake of waiting for the regulations.

What you will be able to do

• Explain the current status of the UAE PDPL and why the Executive Regulations matter
• Distinguish the federal PDPL from the DIFC and ADGM data protection regimes
• Apply the licensing location test to decide which regime governs a company

Why it matters

Helps teams answer clients on which UAE data protection law applies, and prepare now for the six-month window that follows the regulations.

Practice: Practice: The law, its status and the three regimes · 3 questions

Begins at GHK Travel's visa desk, where an officer scans passports from twelve countries, including visitors and a company group from Hong Kong. Explains Article 2 scope: people living or doing business in the UAE, every controller or processor in the UAE whoever the data subjects are, and organisations abroad processing data of people in the UAE. Lists the narrow exclusions, including government data, personal use, health and banking data under their own laws, and DIFC and ADGM. Defines personal data by whether a person can be identified, with examples such as a frequent flyer number. Covers sensitive personal data, a wheelchair request at the airport, and biometric data from fingerprint clocks and face scans. Separates controller from processor using the support partner and an airline, and defines data subject, automated processing, profiling and anonymised data. Closes on giving tourists' passports less care.

What you will be able to do

• Explain the three groups of people and organisations the UAE PDPL covers
• Identify personal, sensitive and biometric data in everyday work records
• Distinguish a controller from a processor among your own suppliers and partners

Why it matters

Lets employees spot personal and sensitive data, protect visitors' data like residents', and know whether they act as controller or processor.

Practice: Practice: Who and what it covers · 3 questions

Opens with two marketing ideas: passport-expiry offers and selling the list to a travel insurer. Explains the Article 5 controls: fair, transparent and lawful processing, a specific purpose, limited and accurate data, secure storage, and no keeping data once its purpose is met unless anonymised. Uses the purpose control to separate a related expiry reminder from a sale to the insurer, and shows how a misspelt name can stop a traveller at the gate. Defines consent, notes that silence and pre-ticked boxes are not consent, and sets out the Article 6 conditions, including proof and easy withdrawal. Recommends a consent log of time, channel, wording and choice. Lists the Article 4 cases for processing without consent, with performing a contract doing most of the work, then applies the rules to a medical help request. Ends on consent hidden in booking terms.

What you will be able to do

• Apply the Article 5 processing controls to a new use of existing customer data
• Assess whether a consent is clear, provable and easy to withdraw under Article 6
• Identify the Article 4 cases where processing may go ahead without consent

Why it matters

Helps marketing and service teams avoid reusing data for conflicting purposes and keep a consent record they can show if asked.

Practice: Practice: Processing rules and consent · 3 questions

Starts with an e-mail from a frequent traveller who asks what GHK Travel holds about him, who it was shared with, and for his profile to go to his new agent. Covers Article 13: the free right to information, the three items given before processing starts, and the limited grounds for refusal. Explains Article 14 portability in a machine-readable format, limited to the data the person provided. Covers Article 15 correction of inaccurate or incomplete data, checked against the passport, and erasure in four situations, with limits for investigations, legal claims and other laws such as financial record rules. Shows how Articles 19 and 12 require clear contact routes and direct access to the DPO. Sets out a good-practice flow: forward the same day, log it, verify identity, answer and record. Warns against e-mailing a full profile to an impostor using a look-alike address.

What you will be able to do

• Recognise a rights request under Articles 13, 14 or 15 even when no article is named
• Apply the four erasure situations and the limits other laws place on erasure
• Follow a request flow that verifies identity before any personal data is sent

Why it matters

Prepares staff to route and answer rights requests correctly, avoid sending data to impostors, and keep a log the regulator can see.

Practice: Practice: Rights: information, transfer and correction · 3 questions

Opens with an angry call from a customer whose booking was cancelled when the fraud system scored her payment as high risk with no human check. Explains Article 16 restriction in three situations, flagging a disputed record across every system, the right to ask for data to be kept for a legal claim, and what a controller may still do. Covers Article 17 objection to direct marketing, including profiling into segments such as luxury traveller or late booker, statistical surveys and breaches of Article 5, and contrasts a half-done opt-out with one that reaches every channel. Sets out Article 18 on automated decisions with legal or serious effects, its three exceptions, and the protections that remain, above all a human review on request. Shows GHK Travel's fix: a human check before cancelling and a clearer privacy notice. Ends on the agent who says the system decided.

What you will be able to do

• Explain when a person can require processing to be restricted under Article 16
• Apply a marketing objection across every channel, including marketing profiling
• Route a request for a human review of an automated decision to the right team

Why it matters

Helps service, marketing and risk teams respond lawfully when customers dispute data, opt out or challenge an automated decision.

Practice: Practice: Rights: restriction, objection, automation · 3 questions

Begins at the procurement desk with two contracts: a new cloud booking platform and the overnight support partner's renewal. Covers Article 7: technical and organisational measures matched to risk, privacy by design and by default, pseudonymisation, and masking passport numbers except for the visa desk. Lists the contents of the controller's special record and the duty to choose processors with sufficient technical and organisational measures. Covers Article 8: processing only on instructions, within the agreed purpose and period, erasing data at the end, not disclosing it and protecting devices, with a Mumbai software company copying live data to a laptop as the warning. Explains the processor's record and joint responsibility where several processors lack a written contract. Shows how to keep records current and what GHK Travel's two contracts should cover. Ends on signing standard terms unchecked.

What you will be able to do

• Explain the general duties of a controller under Article 7 of the UAE PDPL
• List what the special record of processing must hold for the regulator
• Check a supplier contract's data terms against Articles 7 and 8 before signing

Why it matters

Equips procurement and IT to sign supplier contracts with the right data terms and keep processing records current for the regulator.

Practice: Practice: Controllers, processors and records · 3 questions

Starts at half past two in the morning, when GHK Travel's support partner finds a stolen password was used to export about 2,000 chat transcripts with passport numbers and travel dates. Explains Article 20 for controllers and processors alike: encryption and pseudonymisation, resilient systems, prompt restoration and regular testing, weighed against the risks of the processing. Suggests masking passport numbers in chat and gives four daily habits, from checking links to using approved tools only. Defines a data breach broadly, with examples such as a misdirected e-mail or a visa file left in a taxi. Covers Article 9: notifying the UAE Data Office, with the time limit left to the awaited regulations, the notice contents, telling affected customers, and the processor's duty to inform the controller as soon as possible. Ends with each employee's part in reporting.

What you will be able to do

• Explain the four kinds of security measure that Article 20 names
• Describe what an Article 9 breach notice to the UAE Data Office contains
• Report a suspected breach at once while keeping the evidence intact

Why it matters

Builds the security habits and fast reporting that limit breach damage, and readies the organisation to give the regulator the facts.

Practice: Practice: Security and data breaches · 3 questions

Opens with GHK Travel's innovation team planning a profiling engine to score customers, six weeks from launch, with no DPO involved. Explains the three Article 10 situations that require a data protection officer, for processors as well as controllers, and who can hold the role. Covers the DPO's Article 11 tasks, from checking procedures and handling requests to liaising with the regulator, and the Article 12 protections: early involvement, resources and no dismissal for doing the job. Gives four moments when staff should call the DPO. Sets out the Article 21 impact assessment before high-risk processing, the two required cases, its minimum contents, the regulator's list of exempt processing and regular review. Shows the assessment changing the engine so scores choose offers, not prices, with an opt-out and human review. Ends on a DPO hearing of a system at launch.

What you will be able to do

• Identify the three situations in which Article 10 requires a data protection officer
• Plan a data protection impact assessment before launching high-risk profiling
• Recognise the four moments when an employee should contact the DPO

Why it matters

Helps product and management teams involve the DPO at the idea stage and run impact assessments before building, avoiding costly rework.

Practice: Practice: Data protection officers and impact assessments · 3 questions

Starts with a corporate client's review asking where its employees' data goes when they travel. Defines cross-border processing as any handling outside the UAE, including viewing data held in Dubai. Covers Article 22 transfers in cases approved by the regulator, where the destination has adequate legislation or the UAE has a data protection agreement with it. Lists the Article 23 routes where protection is not adequate, including a binding contract, explicit consent and a contract made for the person, with details left to the Executive Regulations. Shows the contract route for hotel bookings, sending only the minimum, and for the support partner. Explains when consent suits occasional transfers. Cites Ireland's Data Protection Commission fine on Meta in May 2023 under EU law. Gives four questions to ask before data leaves the UAE, and warns that hosting abroad is a transfer too.

What you will be able to do

• Explain what counts as cross-border processing, including storage abroad
• Distinguish the Article 22 adequacy route from the routes in Article 23
• Apply four questions before personal data leaves the UAE for a supplier

Why it matters

Gives teams a practical check before data goes to suppliers, cloud tools or offices abroad, so each transfer has a lawful route.

Practice: Practice: Transfers outside the UAE · 3 questions

Opens at GHK Travel's year-end briefing, where the CEO asks what happens if a customer complains to the regulator. Covers Article 24 complaints and regulator examination, the Article 25 grievance to the Director General within thirty days, decided within thirty days, and Article 26, which leaves penalties to a Cabinet decision, so the course states no amounts. Shows how to handle complaints internally and why records of consent, notices and replies are the best defence. Lists what is still to come: the Executive Regulations, the penalties decision and the mandate of the federal authority for AI and data. Sets out duties for front-line, marketing, HR, visa desk, IT and procurement staff, and four everyday habits. Follows a new airport assistance service for travellers with health needs from idea to daily running. Closes with a recap and the 30-question scenario-based exam.

What you will be able to do

• Explain how a complaint to the regulator is examined and a grievance filed
• Describe what is still to come under the UAE PDPL and why acting now matters
• Apply the four everyday data protection habits in your own role

Why it matters

Leaves every employee ready to apply the UAE PDPL in their own job and to handle complaints well before they reach the regulator.

Practice: Practice: Complaints, what is to come, and your role · 3 questions