Federal Decree-Law No. 45/2021 On the Protection of Personal Data, while establishing parameters for transferring personal data overseas, has adopted a very cautious approach. Article 22 of Federal Decree-Law No. 45/2021 has provided for the modes allowed for cross-border transfer of personal data (adequate level of protection and existence of a bilateral or multilateral agreement between the UAE and the another country) as approved by the Data Office. Article 23 of Federal Decree-Law No. 45/2021, however, provides alternate modes (or exceptions) for making cross-border transfers in the absence of adequate protection or non-existence of a bilateral or multilateral agreement.

• Personal data: Any data relating to an identified natural person, or one who can be identified directly or indirectly by way of linking data, using identifiers such as name, voice, picture, identification number, online identifier, geographic location, or one or more special features that express the physical, psychological, economic, cultural or social identity of such person. It also includes sensitive personal data and biometric data.