Compliance conversations in the UAE usually start in one of two places: a client contract that mentions a standard, or a tender that requires one. Rarely does a regulator arrive first. That matters, because it means the honest first question is not what is best practice but what someone is actually asking you for.
Get this confirmed properly
This is an orientation guide, not legal advice. Confirm your specific obligations with a qualified legal or compliance advisor, because they turn on your sector, your jurisdiction and your contracts.
Start with jurisdiction
Where your entity is registered changes which data protection regime applies, and this catches out businesses that assume one federal rule covers everything.
| Where you are registered | Data protection regime |
|---|---|
| UAE mainland | Federal personal data protection law (PDPL) |
| DIFC | DIFC's own data protection regulations |
| ADGM | ADGM's own data protection regulations |
| Other free zones | Generally the federal regime, but confirm with the zone authority |
DIFC and ADGM operate their own frameworks rather than deferring to the federal law. If you are registered there, that is your starting point, and advice written for mainland businesses may not apply cleanly.
Then ask what you actually handle
- Personal data of individuals: a data protection regime applies, and which one depends on jurisdiction above
- Cardholder data that you store, process or transmit: PCI DSS applies, and its scope depends heavily on how payments are taken
- Health information in Abu Dhabi: sector-specific healthcare requirements apply on top
- Government or critical infrastructure contracts: expect additional sector requirements in the contract itself
- None of the above, but enterprise clients: you are probably being asked for ISO 27001
ISO 27001 is contractual, not legal
This is the one businesses most often misunderstand. ISO 27001 is not required by UAE law. It is demanded by clients, particularly large enterprises and government buyers, as a condition of doing business. That makes it a commercial decision rather than a regulatory one, and it should be evaluated as such.
If one client is asking and the contract is large enough to justify it, pursue it. If nobody is asking, the money is usually better spent on the controls themselves than on certifying them.
PCI DSS scope is the whole game
PCI DSS applies if you touch cardholder data, and the amount of work depends enormously on how you take payment. A business using a hosted payment page where card details never reach its systems carries a fraction of the obligation of one storing card numbers. Reducing scope is almost always cheaper than complying with a large one.
The practical order to work through
- 1Read your client contracts and tender documents. Most compliance requirements arrive there first
- 2Confirm your registration jurisdiction and which data protection regime follows from it
- 3Map what categories of data you actually hold, rather than what you assume you hold
- 4Establish whether payments bring you into PCI scope, and whether that scope can be reduced
- 5Only then decide whether a certification such as ISO 27001 is commercially worth pursuing
What compliance work actually looks like
Whichever standard applies, the work divides into the same three parts: a gap assessment measuring where you are, technical remediation fixing what is missing, and building an evidence trail that shows controls operating over time. Most first-time audits struggle on the third, not the second.
Not sure which applies to you?
Tell us your sector, where you are registered and what your clients are asking for. We will help establish the applicable standard before anyone quotes you a programme.
