Last review date: 18 December 2024

☒ Yes

Personal data may only be transferred outside of the UAE in the following cases:

1. the country to which the personal data will be transferred has special legislation in place for the protection of personal data, which includes the most important provisions, measures, controls, conditions and rules for protecting the privacy and confidentiality of the data subject's personal data and his/her ability to exercise his/her rights, as well as provisions that enable the application of appropriate measures to the controller or processor through a supervisory or judicial entity; and
2. if there is a bilateral or multilateral treaty concerning data protection signed between the UAE and the country to which the personal data is to be transferred.

In addition, a data transfer may be made to a jurisdiction which does not satisfy the requirements outlined above where: (i) the transfer is made under a contract that obligates the recipient to implement the most important provisions, measures, controls, conditions and rules to protect the privacy and confidentiality of the data subject's personal data and their ability to exercise the rights afforded by the PDPL; (ii) the data subject has given his/her express consent to transfer personal data outside the UAE in a manner that does not conflict with the public and security interest of the country; (iii) the transfer is necessary for the implementation of obligations and the establishment, exercise or defense of rights before the judicial entities; (iv) the transfer is necessary for the conclusion or execution of a contract concluded between the controller and the data subject or between the controller and a third party in pursuit of the data subject's interests; (v) the transfer is necessary to perform a procedure relating to international judicial cooperation; and (vi) the transfer is necessary for the protection of the public interest. The implementing regulations will set out further details on these controls regarding the cross border transfer of personal data.

Transfers of personal data to third countries are permissible only, if there is a legal basis for the processing/transfer and one of the following applies:

☒    approved adequate/whitelisted jurisdictions
☒    derogations, such as consent, contract performance, necessity to establish, exercise or defend legal claims
☒    other solutions

Please see separate question for information on data localization provisions that are not restricted to personal data.