On 14 June 2026, Sheikh Mohammed bin Rashid approved a new Artificial Intelligence and Data Authority that takes over the functions of three bodies, one of them the UAE Data Office. On paper, that office was the regulator for the federal Personal Data Protection Law. Four days later, DIFC opened a consultation on amended data protection regulations aimed at AI systems. Neither announcement changes what your IT team has to do on Monday morning. Both are a reminder that "UAE data protection" means three separate rulebooks, and the one that governs your mailboxes and ticket queue depends on where your company is licensed.
This article puts those rules side by side for the two systems that hold the most personal data in a typical small or mid-sized firm: business email and the helpdesk. It is a practical reading of the texts, not legal advice. For a decision that carries real risk, ask a lawyer licensed in the relevant jurisdiction.
Three regimes in one country
The federal law is Federal Decree-Law No. 45 of 2021, in force since 2 January 2022. Its Article 2 covers controllers based in the UAE, whoever's data they process, and controllers abroad that process data of people in the UAE. The same article lists what it does not cover. Two exclusions matter for email and tickets: companies in free zones that have their own data protection legislation, and health or banking data that already has a law of its own (Article 2(2)(e) to (g)).
The two financial free zones have exactly that: the DIFC Data Protection Law, DIFC Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021. Article 6(3) of the DIFC law applies it to a DIFC-incorporated controller "regardless of whether the Processing takes place in the DIFC or not". A DIFC firm whose mail sits in a European data centre is still under the DIFC law for that mail.
The short version: a mainland company, or one in a free zone without its own data protection law, reads the PDPL. A DIFC entity reads the DIFC law. An ADGM entity reads the ADGM regulations. A group with entities in all three needs three answers, not one "UAE policy".
What actually changed in 2026
For the mainland, less than the headlines suggest. Article 28 of the PDPL told the Cabinet to issue executive regulations within six months of the decree, which was signed on 20 September 2021. Those regulations are meant to set the breach reporting period, the transfer conditions and several exemptions. The official legislation portal still shows the decree's last update as 20 September 2021, and Article 29 only starts a six-month compliance window once the regulations are issued, with one possible extension of the same length. The new Authority's announced mandate covers data and AI standards, government data and "ensuring compliance across federal entities". It does not mention the PDPL by name.
In DIFC the change is sharper, and it came in two steps. Amendments in force since 15 July 2025 added Article 64A, a private right of action: a person who suffers damage from a breach of the law can go straight to the DIFC Courts, and under Article 64A(5) damage includes "distress", not only financial loss. Then Consultation Paper No. 3 of 2026 proposed new duties for anyone running AI systems on personal data, including an Autonomous Systems Officer for high-risk processing. Comments closed on 18 July 2026, and the paper itself says firms should not act on the draft until it is formally enacted.
Sending data abroad: what each text allows
Most cloud email and helpdesk products store data in Europe or the US unless you pick otherwise. Under all three regimes that is a cross-border transfer.
Mainland (PDPL). Article 22 allows transfers, in cases "approved by the Bureau", to a country that has personal data legislation and a judicial or regulatory authority able to act against the controller, or under a data protection agreement the UAE has joined. Article 23 adds fallbacks: a contract that binds the recipient to the PDPL's measures, the person's explicit consent, or a transfer needed to perform a contract with them. Article 23(2) leaves the detailed conditions to the executive regulations. Until they appear, there is no official list of approved countries to rely on, so the contract route is the one you can document.
DIFC. Article 26 allows transfers to places the Commissioner has found adequate. Otherwise Article 27 requires appropriate safeguards, such as standard clauses adopted by the Commissioner or binding corporate rules, "on condition that enforceable Data Subject rights and effective legal remedies for Data Subjects are available", or one of a short list of derogations such as explicit, informed consent.
ADGM. Section 41 works the same way through the Commissioner's adequacy decisions. Section 42 allows standard contractual clauses, and the Commissioner may approve the European Commission's clauses for this purpose.
Health data, in every zone. If tickets or emails carry patient information from health services delivered in the UAE, another law applies, free zones included. Article 13 of Federal Law No. 2 of 2019 says such data may not be stored, processed or transferred outside the State unless the health authority issues a decision allowing it, and Article 24 sets a fine of AED 500,000 to 700,000 for breaking that rule. A clinic that handles patient queries in a helpdesk hosted abroad has a problem that no contract clause fixes.
Breach clocks
| Regime | Notify the regulator | Notify affected people | Processor to controller |
|---|---|---|---|
| PDPL (mainland) | Within the period set by the executive regulations (Art. 9(1)) | Same, when their privacy is affected (Art. 9(2)) | "as soon as it becomes aware" (Art. 9(3)) |
| DIFC | "as soon as practicable in the circumstances" (Art. 41(1)) | As soon as practicable if high risk (Art. 42(1)) | "without undue delay" (Art. 41(2)) |
| ADGM | Without undue delay and, where feasible, within 72 hours (s. 32(1)) | Without undue delay if high risk (s. 33(1)) | Without undue delay (s. 32(2)) |
Our advice is to run your incident plan on the 72-hour ADGM clock wherever you are licensed. It is the only fixed number in the three texts (for the Saudi side, see our piece on SDAIA's draft amendments), and the facts you need at hour 72 are the facts the PDPL and DIFC ask for anyway: what was exposed, roughly how many people, and what you did about it. If your email or helpdesk provider cannot tell you within a day which mailboxes or tickets an attacker opened, you lose that clock before it starts.
What a failure can cost
The PDPL names no amounts. Article 26 leaves the list of violations and penalties to a Cabinet decision. DIFC has a schedule: Schedule 2 caps the fine for failing to report a breach under Article 41 at USD 50,000, with the same cap for breaking the Article 27 transfer rules, and Article 62(3) lets the Commissioner add a general fine "not limited to the amounts specified in Schedule 2". Article 64A damages claims come on top. In ADGM, section 55(1) caps a fine at USD 28 million.
Where email and helpdesk data leaves the country
The primary mailbox region is the part everyone checks. The leaks are usually somewhere else:
- Backups and disaster-recovery copies kept in a second region.
- Spam and malware filtering run by a third party that scans every message in its own data centre.
- Ticket attachments: passport scans, Emirates ID copies, medical certificates, salary slips.
- AI features that send ticket text or email threads to a model hosted elsewhere for summaries or suggested replies.
- Vendor support staff who can open your tenant from another country. The PDPL's definition of Cross-Border Processing includes display and retrieval of personal data outside the State, so remote access counts.
- Logs and search indexes, which keep names, addresses and subject lines long after a message is deleted.
Checklist for choosing email and helpdesk hosting
- Write down which regime applies to each legal entity in your group: mainland, DIFC or ADGM.
- Get the vendor to state in writing the region of the primary copy, backups, filtering, search index and any AI processing.
- Ask who can access your data and from which countries, vendor support included.
- For DIFC or ADGM, name the transfer basis: an adequacy decision or standard clauses. For the mainland, sign a contract that binds the vendor to PDPL measures under Article 23(1)(a).
- Read the processor's breach clause. You want notice within hours, not "promptly", and logs that show which records were touched.
- Keep health data and ID document copies out of systems hosted abroad unless you have a clear legal basis.
- Confirm you can export everything in a standard format (EML or mbox for mail, JSON or CSV for tickets), and that deletion reaches backups. PDPL Article 14 gives people the right to receive their data in a machine-readable form.
- Keep the record Article 7(4) describes: categories of data, who can access it, and "any data related to the cross-border movement" of that data.
Where FanMail and FanDesk fit
We built both products so the location question has a short answer. FanMail can be hosted in the UAE or on servers you own, and FanDesk can run on-premise, so the primary copy, the backups and the search index stay where you decide. That does not make anyone compliant on its own: the contracts, records and incident plan above still need to exist. It does mean the answer to "where is our data?" fits in one line.
Related reading: help desk data residency under the UAE and Saudi PDPL, the Saudi PDPL draft on local storage and 72-hour breach notice, and why companies still choose self-hosted email in 2026.
Frequently asked questions
Are the UAE PDPL executive regulations in force?
They have not been published. Article 28 required them within six months of 20 September 2021, and Article 29 gives controllers six months to comply after they are issued, extendable once by the Cabinet. The law itself has applied since 2 January 2022.
Does the PDPL apply to a DIFC or ADGM company?
No. Article 2(2)(g) excludes free zone companies that have their own data protection legislation. A DIFC company follows the DIFC law, which under Article 6(3) applies even when the processing happens outside the DIFC.
Can we keep company email in a European data centre?
Often yes, with paperwork. In DIFC and ADGM you need an adequacy decision or safeguards such as standard clauses. On the mainland, Article 23 allows a binding contract or explicit consent. Health data linked to UAE health services is different: Article 13 of Federal Law No. 2 of 2019 keeps it in the country unless the health authority decides otherwise.
Is there a 72-hour breach deadline in the UAE?
Only in ADGM, where section 32 asks for notice within 72 hours where feasible. DIFC says "as soon as practicable" and the PDPL leaves the period to its executive regulations.
Can a customer sue us directly over a data breach in DIFC?
Yes, since 15 July 2025. Article 64A lets a person who suffers damage, including distress, claim compensation in the DIFC Courts without first going through the Commissioner. A controller escapes liability only if it proves it is "not in any way responsible" for the event.
Sources: Federal Decree-Law No. 45 of 2021; Federal Law No. 2 of 2019; WAM, 14 June 2026; DIFC Data Protection Law, consolidated July 2025; DIFC announcements of 16 July 2025 and 18 June 2026; DIFC Consultation Paper No. 3 of 2026; ADGM Data Protection Regulations 2021; ADGM Office of Data Protection.
