Skip to content
    English | العربية

    DPO as a Service / the UAE

    DPO as a Service in the UAE

    White Label Consultancy (WLC) acts as the appointed Data Protection Officer for organisations subject to the UAE Federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). The service is led by Simon Leadbetter, Associate Partner for the GCC, and delivered with WLC's Dubai office and our privacy team in Europe.

    § 01Key facts

    Key facts: DPO requirements in the UAE

    Law
    Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)
    Regulator
    UAE Data Office, established by Federal Decree-Law No. 44 of 2021
    Where it applies
    Mainland UAE and free zones without their own data protection law. The DIFC and ADGM have separate regimes.
    When a DPO is mandatory
    High risk processing because of new technology or volume, systematic and comprehensive assessment of sensitive personal data including profiling, or processing a large volume of sensitive personal data (Article 10)
    Can the DPO be external
    Yes. The DPO may be an employee or a person authorised by the controller or processor (Article 10)
    Residency requirement
    None. Article 10 allows the DPO to be inside or outside the UAE
    Executive Regulations
    Detailed rules are to be set by Executive Regulations. Check their status before relying on dates or thresholds
    WLC lead DPO
    Simon Leadbetter, Associate Partner, GCC
    Local office
    Dubai
    § 02The legal test

    Do we need a DPO under the UAE PDPL?

    The UAE Federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, applies to processing in the UAE and to controllers outside the UAE that process the personal data of people in the UAE. It does not apply in free zones with their own data protection law, such as the DIFC and ADGM, or to data already covered by specific laws, for example certain health and banking data.

    Under Article 10, a controller or processor must appoint a DPO where the processing creates a high risk to privacy because of new technology or the volume of data, where it involves a systematic and comprehensive assessment of sensitive personal data, including profiling and automated processing, or where it involves a large volume of sensitive personal data.

    The DPO can be an employee or someone authorised by the organisation, and can be based inside or outside the UAE. The organisation must give the DPO the resources and independence the role needs, and publish the DPO's contact details.

    Official source: UAE Government portal: data protection laws.

    § 03The service

    What WLC does as your DPO

    • Appointment and registration with the regulator
    • Records of processing activities
    • Data protection impact assessments (DPIAs)
    • Handling data subject requests
    • Personal data breach response
    • Transfer assessments for data leaving the jurisdiction
    • Staff training
    • Liaison with the regulator
    • Reporting to the board

    Your first 90 days

    1. Formal appointment, registration of the DPO's contact details and a kick-off with your key stakeholders.
    2. Review of current processing, records of processing and existing policies.
    3. Gap assessment against the law and a prioritised remediation plan.
    4. First board report and an agreed routine for DPIAs, requests and breaches.
    § 04Your named DPO

    Who your DPO is

    01
    Simon Leadbetter, Associate Partner, GCC, White Label Consultancy

    GCC

    Simon Leadbetter

    Associate Partner, GCC

    Simon is a lawyer and digital trust, governance and transformation programme director with 20 years of GRC experience across the UK and the GCC, spanning data protection, AI governance and regulatory frameworks. Before joining WLC, he served six years as Director of Personal Data Protection at NEOM, where he led enterprise privacy governance and PDPL compliance and helped define NEOM's AI Ethics Council, after leading the development of a draft data protection law, regulation and operating model for a new Saudi regulator. He previously spent 20 years at Accenture across the UK and the UAE, including building its data privacy centre of excellence for GDPR.

    Credentials: FIP, CIPP/E, CIPM.

    Meet the full team or see Simon's LinkedIn profile.

    § 05How we work

    Engagement models

    a

    WLC as your appointed DPO

    WLC is formally appointed as your Data Protection Officer. A named senior consultant holds the role, supported by the wider WLC team.
    b

    Support for an internal or group DPO

    You keep your own DPO. WLC provides advice, capacity and local regulatory knowledge when your DPO needs it.
    c

    Group DPO in Europe, local lead in the Gulf

    Your group DPO stays in Europe. WLC acts as the local data protection lead in the Gulf, so one programme covers both regions.
    § 06Why WLC

    Why organisations choose WLC

    • A named DPO lead with six years leading data protection compliance at NEOM and 20 years at Accenture across the UK and the UAE.
    • A Dubai office, so the UAE federal regime, the DIFC and ADGM are handled by one team.
    • One programme across the UAE, Saudi Arabia and the GDPR for groups operating in several jurisdictions.

    Proof

    Acting as DPO for a global technology provider

    Case study: WLC as appointed DPO across hospitality, retail and entertainment.

    case study →

    Client names are shared on request, subject to client approval.

    § 07Questions

    Frequently asked questions

    Do we need a DPO under the UAE PDPL?

    Article 10 of Federal Decree-Law No. 45 of 2021 requires a DPO where processing creates a high risk to privacy because of new technology or volume, where it involves a systematic and comprehensive assessment of sensitive personal data, including profiling, or where it involves a large volume of sensitive personal data. Outside these cases a DPO is optional, but often useful.

    Does the UAE PDPL apply in the DIFC or ADGM?

    No. The DIFC and ADGM have their own data protection laws and regulators, and the federal law does not apply to them. A group with entities on the mainland and in a financial free zone may need to comply with two regimes. WLC covers all three.

    Can an external provider act as our DPO in the UAE?

    Yes. Article 10 allows the DPO to be an employee or a person authorised by the controller or processor. WLC can be appointed under a written agreement, with Simon Leadbetter as the lead.

    Does our DPO need to be based in the UAE?

    No. Article 10 allows the DPO to be inside or outside the UAE. WLC has an office in Dubai, so local presence is available if you want it.

    Who regulates data protection in the UAE?

    The UAE Data Office, set up by Federal Decree-Law No. 44 of 2021, oversees the federal PDPL. The DIFC Commissioner of Data Protection and the ADGM Office of Data Protection regulate their own free zones.

    Have the Executive Regulations been issued?

    The PDPL leaves several details, including timelines and some thresholds, to Executive Regulations. Check the current status before relying on specific dates. WLC tracks these developments and updates your programme when they change.

    What does the DPO do under the UAE PDPL?

    The DPO checks that processing complies with the law, advises on DPIAs and data subject requests, supports breach response, works with the UAE Data Office and reports to management. WLC also keeps your records of processing and trains your staff.

    Does appointing an external DPO transfer our legal responsibility?

    No. The controller remains responsible for complying with the PDPL. The DPO advises and monitors, while decisions about processing stay with your organisation.

    § 08Sources and further reading

    Legal sources

    Related reading and services

    § 09Get in touch

    Talk to our UAE DPO team

    Last reviewed: by Simon Leadbetter, Associate Partner, GCC