Stratgik — technology strategy and business systems engineering.
Delivery across the USA, UK, UAE and India.
UAE data protectionFederal PDPL, DIFC and ADGM
The UAE has three data protection regimes, and which one applies depends on where you are licensed. The federal PDPL is law and its executive regulations are still awaited; DIFC and ADGM already enforce theirs. We work out what applies to you and build it into your systems before it becomes urgent.
What is at stake
Sector rules also apply: healthcare data, telecoms and financial services carry their own localisation and security requirements.
ADGM Data Protection Regulations 2021 maximum fine
DIFC Data Protection Law fines per contravention, plus individual claims in DIFC Courts
Federal PDPL administrative penalties, to be set by Cabinet decision
What the law asks, in plain words
Mainland companies fall under the federal PDPL; DIFC and ADGM entities follow their own laws. Many groups are subject to more than one.
Tell people what you process and why, and rely on consent or another permitted basis.
ADGM requires notification within 72 hours; DIFC without undue delay; the federal PDPL requires notifying the Data Office and affected people.
Access, correction, erasure, restriction, objection and portability, depending on the regime.
Technical and organisational measures proportionate to the risk, with impact assessments for high-risk processing.
Records of processing, and a data protection officer where processing is large-scale or sensitive.
Transfers only to jurisdictions with adequate protection or under approved safeguards.
Health data localisation, TDRA and Central Bank requirements can go further than the general laws.
Free self-check
Ten questions, two minutes. Nothing is sent anywhere unless you ask for help.
How we get you compliant
Discover
Website, apps, CRM, ERP, spreadsheets, messaging tools and vendors.
Decide
Each gap scored against enforcement exposure and effort, so the serious ones get fixed first.
Implement
Notices, consent, request workflows, access controls, retention and vendor terms.
Hand over
A live session for the staff who handle data and a practice run of breach reporting.
Pricing
For organisations with one website or product and up to five systems holding personal data. Larger scope is quoted in writing before you pay anything.
Know which rules apply and where the gaps are.
AED6,500one-time
+ VAT
Report in 7 working days
Choose Readiness AuditRecommended
We implement the controls in your systems.
AED19,500one-time
+ VAT
Typically 4 to 6 weeks
Choose Compliance SetupStay ready as regulations are issued.
AED2,450per month
+ VAT
Cancel any month
Choose Data Protection CareA clear line: Stratgik is a technology firm, not a law firm. We implement and operate compliance in your systems. Where you need a legal opinion, we work alongside your lawyer.
Free readiness call
An engineer replies within one working day with a suggested approach and a fixed quote.
Questions
Also see how Stratgik works with United Arab Emirates businesses.
The law has been in force since January 2022, but its executive regulations had not been issued as of 2026, and penalties are to be set by Cabinet decision. Preparing now avoids a rushed programme when the grace period starts.
Entities in DIFC and ADGM are governed by their own data protection laws, which are already enforced. Groups with mainland entities usually need to meet both.
ADGM can fine up to US$28 million. DIFC sets fines per contravention in a schedule to its law, and since 2025 individuals can bring claims directly in DIFC Courts.
Not generally, but sector rules do. Health data, for example, is subject to localisation requirements.
No. Stratgik is a technology firm. We implement the controls and records in your systems and work with your legal counsel for legal opinions.
Yes, for organisations with up to five systems holding personal data. Larger scope is quoted in writing first. VAT is added where applicable.
A readiness audit takes 7 working days and gives you a ranked, costed plan.
The Stratgik model
Four stages, in order. Most businesses need them one at a time.
