Which UAE regulations apply to mainland, DIFC, ADGM and government entities

UAE compliance requirements come from four layers. At federal level, the UAE Information Assurance Standard Version 2.1 from the Cyber Security Council sets the national security baseline. The PDPL (Federal Decree-Law No. 45 of 2021) governs personal data on the mainland. At emirate level, Dubai Government entities must follow DESC's Information Security Regulation Version 3.1. Their cloud suppliers must follow the DESC CSP Security Standard. Any organisation handling health information in Abu Dhabi must follow ADHICS V2. Each financial free zone has its own data protection law and cyber risk rules. In the DIFC these are DIFC Law No. 5 of 2020 and DFSA GEN 5.5. In ADGM they are the ADGM Data Protection Regulations 2021 and FSRA GEN 3.5. Banks must also follow the Central Bank's Risk Management Regulation, including its technology risk articles.

The most common scoping mistake is applying the federal PDPL inside a free zone. The PDPL does not apply in free zones that have their own data protection law. It also does not apply to government entities. Consider a group with a mainland holding company, a DIFC operating company and an ADGM subsidiary. That group must comply with three privacy laws. It also has three breach reporting deadlines: 72 hours where feasible in ADGM, as soon as practicable in the DIFC, and the PDPL's own notification duty.

The second common mistake is using the wrong names. DESC ISR is Version 3.1 with thirteen domains. It is not "v3" with twelve domains. The national baseline is the IA Standard 2.1, and it should not be called "NESA". There is no document called the CBUAE Cybersecurity Framework. Assessors work from the official document, so using the wrong title or edition makes a poor first impression. The UAE regulations page on this site lists the regulations that apply to each entity type, each under its official name.

Reviewed September 2026.