Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
UAE PDPL: Lawful Basis, Consent and Principles (Articles 4-6)

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) UAE-PDPL-Art.4_5: Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5)

Article 4 establishes the PRINCIPLES for processing: (a) processed in a fair + transparent + lawful manner; (b) collected for specified + clear + legitimate purposes (purpose limitation); (c) limited to what is necessary (data minimization); (d) accurate + kept up to date (accuracy); (e) retained only as long as necessary (storage limitation); (f) processed with appropriate security measures (integrity + confidentiality). Article 5 establishes the LAWFUL BASES for processing: (a) data subject CONSENT; (b) performance of a CONTRACT or pre-contractual steps; (c) compliance with a LEGAL OBLIGATION; (d) protection of VITAL INTERESTS; (e) performance of a TASK IN THE PUBLIC INTEREST; (f) LEGITIMATE INTERESTS of the controller / processor or a third party (balanced against data subject rights); (g) processing of personal data necessary for the realisation of historical / statistical / scientific RESEARCH purposes. Consent (Article 5(a)) must be freely given + specific + informed + explicit + revocable.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 440 controls across 185 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

GDPR · 8 controls

  • GDPR-Art.10 Processing of personal data relating to criminal convictions
  • GDPR-Art.11 Processing which does not require identification
  • GDPR-Art.15 Right of access by the data subject
  • GDPR-Art.19 Notification obligation regarding rectification, erasure or restriction
  • GDPR-Art.5 Principles relating to processing of personal data
  • GDPR-Art.6 Lawfulness of processing
  • GDPR-Art.7 Conditions for consent
  • GDPR-Art.9 Processing of special categories of personal data

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 7 controls

NIST Privacy Framework · 5 controls

  • NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment
  • NISTPF-3 Control-P - Privacy Controls, Data Management, and Disassociated Processing
  • NISTPF-4 Communicate-P - Privacy Notice, Transparency, and Individual Awareness
  • NISTPF-7 Protect-P Maintenance and Protective Technology (PR.MA-P, PR.PT-P)
  • NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

Nebraska Data Privacy Act · 5 controls

  • NDPA-1 Applicability, Scope, and Carve-Outs
  • NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal
  • NDPA-4 Sensitive Data Processing Consent and Childrens Protections
  • NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation
  • NDPA-7 Data Protection Assessments and Processor Contracts

Nigeria Data Protection Act 2023 (NDPA) · 5 controls

  • NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission
  • NG-NDPA-2 Lawful Basis, Consent, and Data Protection Principles
  • NG-NDPA-4 Data Subject Rights and Automated Decision-Making
  • NG-NDPA-5 Security of Processing, Breach Notification, and DPIA
  • NG-NDPA-7 Cross-Border Data Transfers and International Cooperation

APPI · 4 controls

  • APPI-A23 Security Control Measures
  • APPI-A24 Supervision of Employees
  • APPI-A33 Request for Disclosure of Retained Personal Data
  • APPI-A34 Request for Correction, Addition or Deletion

Bahrain PDPL · 4 controls

ISO 27043 · 4 controls

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution · 4 controls

ISO/SAE 21434 · 4 controls

Jamaica Data Protection Act 2020 · 4 controls

MARS-E · 4 controls

Malaysia PDPA 2010 · 4 controls

NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205) · 4 controls

  • PQC-2 FIPS 203 ML-KEM Implementation - Module-Lattice Key-Encapsulation Mechanism
  • PQC-5 Cryptographic Inventory and PQC Migration Roadmap
  • PQC-7 FIPS Validated Modules, HSM Readiness, and Algorithm Validation
  • PQC-8 Implementation Requirements - RNG, Side-Channel, Key Management, Operations, Incident Response

Nigeria Open Banking Regulatory Framework (CBN, 2023) · 4 controls

  • NGOB-1 Open Banking Registry Participation, Tiered Categorisation, and KYP
  • NGOB-2 Customer Consent Management and Lifecycle
  • NGOB-3 API Security Standards, mTLS, and Encryption
  • NGOB-5 Fraud Monitoring, Incident Notification, and Reporting to CBN

UK Age Appropriate Design Code (Children's Code) · 4 controls

AICPA Privacy Management Framework (PMF) · 3 controls

Armenia Law on Protection of Personal Data (2015) · 3 controls

Australian Privacy Principles (APPs) · 3 controls

  • APP-1 APP 1 - Open and transparent management of personal information
  • APP-3 APP 3 - Collection of solicited personal information
  • APP-5 APP 5 - Notification of the collection of personal information

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 3 controls

  • AT-DSG-11 Sections 42-45 - Data subject rights (law enforcement)
  • AT-DSG-13 Section 36 - Scope of law enforcement processing
  • AT-DSG-14 Section 38 - Lawfulness of law enforcement processing

Azerbaijan Law on Personal Data (2010) · 3 controls

Barbados Data Protection Act 2019 · 3 controls

  • BB-DPA-14 Section 15 - Right to Data Portability
  • BB-DPA-16 Section 22 - General Principle for Transfers
  • BB-DPA-21 Sections 61-69 - Data Privacy Officer

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 3 controls

Family Educational Rights and Privacy Act (FERPA) · 3 controls

Florida Digital Bill of Rights (FDBR) · 3 controls

ISO/IEC 27400:2022 · 3 controls

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 3 controls

ISO/IEC 29100:2024 · 3 controls

ISO/IEC 29134:2023 · 3 controls

Israel Protection of Privacy Law (5741-1981) · 3 controls

Kentucky Consumer Data Protection Act · 3 controls

Liechtenstein DPA · 3 controls

Maryland Online Data Privacy Act of 2024 · 3 controls

Mauritius DPA · 3 controls

Minnesota Consumer Data Privacy Act · 3 controls

Montana Consumer Data Privacy Act · 3 controls

NAIC Insurance Data Security Model Law (MDL-668) · 3 controls

  • NAIC-1 NAIC Model Law Adoption, Scope, and Licensee Definitions
  • NAIC-2 Information Security Program (ISP) - Section 4
  • NAIC-6 Cybersecurity Event Investigation and Notification - Sections 6 and 7

NIST SP 800-122 · 3 controls

  • NISTSP122-4 PII Minimisation, Purpose Limitation, and Pseudonymisation
  • NISTSP122-5 PII Security Controls - Encryption, Access Control, Storage, Audit
  • NISTSP122-6 PII Breach Response and Incident Handling

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 3 controls

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 3 controls

NIST SP 800-53 Rev 5 · 3 controls

NSA Guidance for Transition to Quantum-Resistant Cryptography · 3 controls

New Hampshire Data Privacy Act · 3 controls

  • NHPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation
  • NHPA-6 Reasonable Data Security and Breach Response
  • NHPA-7 Data Protection Assessments and Processor Contracts

New Jersey Data Privacy Act · 3 controls

  • NJDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal
  • NJDPA-7 Data Protection Assessments and Processor Contracts
  • NJDPA-8 AG Platkin Enforcement, 18-Month Cure Sunset, and Division of Consumer Affairs

Oregon Consumer Privacy Act · 3 controls

  • OREGONCPA-3 Consent, Sensitive Data, Children and Teen Protections
  • OREGONCPA-5 Data Protection Assessments, Privacy by Design, Security Practices
  • OREGONCPA-7 Processor Contracts, Cross-Border Transfers, DPAs

POPIA · 3 controls

  • POPIASA-3 Data Subject Rights (Access, Correction, Objection), Automated Decisions
  • POPIASA-4 Special Personal Information, Children, Information Quality, Documentation
  • POPIASA-5 Security Safeguards, Encryption, Access Control, Operator Obligations

Peru DPL · 3 controls

  • PERU-2 Consent, Privacy Notice, Sensitive Data
  • PERU-5 Security of Personal Data and Processor Agreements
  • PERU-7 DPO, Records, Retention, Marketing, Training

Qatar DPL · 3 controls

  • QATAR-3 Data Subject Rights
  • QATAR-5 Security of Processing
  • QATAR-7 DPO, Records, Retention, Marketing, Training

SASB Standards · 3 controls

SOC 2 · 3 controls

  • SOC2-P3.1 Personal information is collected consistent with privacy commitments
  • SOC2-P4.3 Personal information is securely disposed of
  • SOC2-P6.1 Personal information is disclosed to third parties only as committed

Saudi Arabia PDPL · 3 controls

South Korea ISMS-P · 3 controls

Sweden Data Protection Act (Dataskyddslag, 2018:218) · 3 controls

  • SWE-1 Scope and Purpose
  • SWE-11 Integritetsskyddsmyndigheten (IMY)
  • SWE-2 Relationship to GDPR

TISAX - Trusted Information Security Assessment Exchange · 3 controls

UK Open Banking Standard · 3 controls

3GPP 5G Security Architecture (TS 33.501) · 2 controls

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

FBI CJIS Security Policy · 2 controls

  • CJIS-8 Media Protection
  • CJIS-9 System and Communications Protection

FTC GLBA Safeguards Rule (16 CFR Part 314) · 2 controls

  • FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))
  • FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2)

FedRAMP Rev 5 · 2 controls

  • FedRAMP-Baselines FedRAMP Baseline Selection (Low, Moderate, High, LI-SaaS) and Control Overlay Parameters
  • FedRAMP-PII-Privacy FedRAMP PII processing + privacy controls (NIST 800-53 Rev 5 PT family + Privacy Act)

Hong Kong Personal Data (Privacy) Ordinance (PDPO, Cap 486) · 2 controls

ISO 13485 · 2 controls

ISO 27799 · 2 controls

ISO/IEC 27014:2020 · 2 controls

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) · 2 controls

India DPDP Act · 2 controls

Indiana Consumer Data Protection Act · 2 controls

Indonesia PDP Law · 2 controls

Iowa Consumer Data Protection Act · 2 controls

Italy Personal Data Protection Code (Legislative Decree No. 196/2003, amended 2018) · 2 controls

Kids Online Safety Act (KOSA) · 2 controls

Law No. 172-13 on the Protection of Personal Data · 2 controls

MARS-E - Minimum Acceptable Risk Standards for Exchanges · 2 controls

Mexico LFPDPPP · 2 controls

NIST SP 800-92 · 2 controls

  • NISTSP92-3 Log Infrastructure: Architecture, Centralisation, Transport Security, SIEM Governance
  • NISTSP92-4 Log Management: Time Synchronisation, Parsing, Storage, Integrity, Access Control

Nigeria Data Protection Regulation (NDPR) · 2 controls

  • NGNDPR-2 Governing Principles, Lawful Basis, and Consent under NDPR Section 2.1-2.3
  • NGNDPR-5 Security of Personal Data, Breach Notification, and DPIA under NDPR Section 2.6-Security

OWASP ASVS · 2 controls

OWASP MASVS · 2 controls

OWASP Top 10:2025 · 2 controls

  • OWASPTOP10-2 A02:2025 Cryptographic Failures and Secret Management
  • OWASPTOP10-4 A04:2025 Insecure Design and Business Logic (incl. A11 API Abuse)

PDPA Singapore · 2 controls

  • PDPASG-2 Notification, Consent, Purpose Limitation, and Lawful Basis
  • PDPASG-5 Protection, Accuracy, and Security of Personal Data

PDPA Thailand · 2 controls

  • PDPATH-5 Security Measures and Data Protection
  • PDPATH-8 Data Breach Notification, Complaints, Compliance, Enforcement

PTES · 2 controls

Personal Data Act (personopplysningsloven) · 2 controls

  • NORWAY-5 Security of Processing, Encryption, Pseudonymization, Access Control
  • NORWAY-8 Breach Notification, Complaints, Compliance, Enforcement

Privacy Act 1988 (Australia) · 2 controls

  • AUPRV-4 APP 10-11 Quality, Security of Personal Information
  • AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response

Privacy Act 2020 · 2 controls

  • NZPRV-2 IPP 5 Storage and Security of Personal Information
  • NZPRV-6 IPP 13 Unique Identifiers, Privacy Impact Assessment, Privacy by Design

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) · 2 controls

  • RIDTPPA-11 Data Minimisation and Purpose Limitation
  • RIDTPPA-2 Consumer Rights (Access, Correction, Deletion, Portability, Opt-Out)

Russia Federal Law on Personal Data (152-FZ) · 2 controls

  • RUSPD-1 Scope, Definitions, Principles under 152-FZ
  • RUSPD-4 Special Categories, Biometric Data

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 2 controls

SSAE 18 - Attestation Standards (SOC Reporting) · 2 controls

Secure by Design: A Guide for Manufacturers (CISA) · 2 controls

  • CISABD-1 Take Ownership of Customer Security Outcomes
  • SBD-DEV-04 Phishing-Resistant Authentication

Sigstore - Software Artifact Signing and Verification · 2 controls

South Korea PIPA · 2 controls

Taiwan PDPA · 2 controls

Texas Data Privacy Act · 2 controls

USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement) · 2 controls

Vietnam Law on Cybersecurity (No. 24/2018/QH14) · 2 controls

Vietnam PDPD · 2 controls

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-17 TLS encryption between email servers (Limited)

Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014) · 1 control

Azure Security Benchmark · 1 control

  • DS-2 Ensure software supply chain security

BSI IT-Grundschutz · 1 control

  • BSI-08 Cryptographic protection of data

COSO Internal Control - Integrated Framework (2013) · 1 control

  • CA-10 Selects and Develops Control Activities

Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) · 1 control

FFIEC IT Examination Handbook · 1 control

FIDO2 / WebAuthn · 1 control

FISMA · 1 control

GLBA · 1 control

Ghana Cybersecurity Act · 1 control

Global Cross-Border Privacy Rules (Global CBPR) Forum · 1 control

  • CBPR-9-APEC-Privacy-Principles Global CBPR Forum: 9 APEC Privacy Principles (Notice + Collection + Uses + Choice + Integrity + Security + Access + Accountability + Preventing Harm)

HITECH Act · 1 control

HKMA Cyber Resilience Assessment Framework (C-RAF) · 1 control

HKMA SPM · 1 control

HL7 FHIR Security Framework · 1 control

IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems · 1 control

IEC 62351 - Power Systems Communication Security · 1 control

  • 62351-9 Cyber security key management

IEEE 7000 · 1 control

ISMAP (Japan) · 1 control

ISO 19011 · 1 control

  • 6.7 Conducting Audit Follow-up

ISO 22739:2024 - Blockchain and Distributed Ledger Technologies Vocabulary · 1 control

ISO 27005 · 1 control

  • 9.1 Risk communication and consultation

ISO 27017 · 1 control

ISO 27018 · 1 control

ISO/IEC 23894:2023 · 1 control

ISO/IEC 27010:2015 · 1 control

ISO/IEC 27011:2024 · 1 control

ISO/IEC 29115:2023 - Entity Authentication Assurance Framework · 1 control

ISO/IEC 38500:2024 - Governance of IT · 1 control

Illinois Biometric Information Privacy Act (BIPA) · 1 control

India Account Aggregator Framework (RBI) · 1 control

Japan AI Guidelines · 1 control

Kenya Data Protection Act · 1 control

LGPD · 1 control

Ley Orgánica de Protección de Datos Personales (LOPDP) · 1 control

MDS2 (Medical Device) · 1 control

MITRE ATT&CK · 1 control

MITRE D3FEND · 1 control

MTCS (Singapore) · 1 control

Monetary Authority of Singapore Technology Risk Management Guidelines · 1 control

NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding) · 1 control

  • STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding

NIS2 Directive Implementing Acts · 1 control

  • NIS2I-5 Cyber Hygiene, Training, Cryptography, and Human Resources Security

NIST AI 600-1: Generative AI Profile · 1 control

  • NISTAI600-7 Confabulation, Bias, Information Integrity, Privacy, IP (Risks 2, 4, 5, 6, 7, 8, 10, 11)

NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) · 1 control

  • NISTSP115-8 Operational Considerations - Tools, Reporting Templates, ISMS Integration, Annex Material

NIST SP 800-123 · 1 control

  • NISTSP123-4 Server Cryptography - Encryption, Key Management, Certificates

NIST SP 800-137 · 1 control

  • NISTSP137-5 Vulnerability + Patch + Configuration Status Monitoring

NIST SP 800-144 · 1 control

  • NISTSP144-5 Identity and Access in Cloud, Federation, and Privileged Access

NIST SP 800-145 · 1 control

  • NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition

NIST SP 800-146 · 1 control

NIST SP 800-190 · 1 control

NIST SP 800-61 · 1 control

  • NISTSP61-3 Preparation: Communications, Toolkits, Training, Exercises, Threat Intelligence

NIST SP 800-63-4 · 1 control

  • NISTSP63R4-5 Federation: Assertions, Trust Agreements, RP Validation, Pseudonymous Identifiers

NIST SP 800-66 · 1 control

  • NISTSP66-6 Technical Safeguards: Access Control, Audit Controls, Integrity, Person Authentication

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 1 control

  • NISTSP82-2 OT Risk Assessment and Threat/Vulnerability Identification

NIST SP 800-88 · 1 control

  • NISTSP88-4 Cryptographic Erase, Key Management, and Verification of Erase

NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems · 1 control

  • NISTSP34-3 Preventive Controls and Recovery Strategies: Backup, Alternate Sites, Equipment

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) · 1 control

  • NRFCS-7 Detection, Logging, Incident Response, Breach Notification, and Fraud Detection

Nevada Gaming Control Board Cybersecurity Requirements · 1 control

  • NGCB-7 Patron and Employee Data Protection + Data Inventory + Vendor Management

New Zealand Information Security Manual (NZISM) · 1 control

  • NZISM-3 Personnel Security, Physical Security, and Cryptography

Notifiable Data Breaches Scheme (Australia) · 1 control

  • AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold

O-RAN WG11 Security Specification · 1 control

  • ORANWG11-3 Cryptography, TLS, SSH, IPsec, and PKI Lifecycle Management

OECD AI Principles · 1 control

  • OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation

OSFI B-13 · 1 control

  • OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery

OWASP API Security Top 10 - 2023 · 1 control

  • OWASPAPI-6 Security Misconfiguration and Secure API Design

OWASP SAMM · 1 control

  • OWASPSAMM-2 Design: Threat Assessment, Security Requirements, Security Architecture

OWASP Top 10 for LLM Applications 2025 · 1 control

  • OWASPLLM-3 Sensitive Information Disclosure and Privacy (LLM02)

Oman National Cybersecurity Framework · 1 control

  • OMANCS-4 Data Protection, Cryptography, and Privacy Alignment

Open Banking Security · 1 control

  • OPENBANK-3 Mutual TLS, Token Binding, Request Signing (JWS), Key Management

OpenSSF Scorecard · 1 control

  • OSSFSC-6 Signed Releases, Provenance, Trusted Publishing, Binary Artifacts

PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments · 1 control

  • PASONE-4 Technical Security: CDE Configuration, BIM Tools, Encryption, Aggregation, Mobile Working

PCI P2PE · 1 control

PCI PIN Security · 1 control

PCI SSF · 1 control

PSD2 SCA · 1 control

  • PSDTWO-2 SCA Exemptions and Risk-Based Authentication

Pakistan Personal Data Protection Bill 2023 · 1 control

  • PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training

Regional Comprehensive Economic Partnership (RCEP) - E-Commerce Chapter · 1 control

  • RCEPEC-1 Online Personal Information Protection (12.13)

SIG (Shared Assessments) · 1 control

SLSA · 1 control

  • SUPCHAIN-2 Source Integrity - Branch Protection, Code Review, Two-Person Rule

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

South Africa Promotion of Access to Information Act (PAIA) · 1 control

  • SAPAIA-4 Information Regulator Cooperation and Appeals

Student Privacy Pledge 2020 · 1 control

  • STUDPRV-2 Data Subject Rights for Students and Parents

TEFCA - Trusted Exchange Framework and Common Agreement · 1 control

  • TEFCAREC-1 Common Agreement Conformance and Onboarding

Turkey KVKK · 1 control

UNICEF Policy Guidance on AI for Children (2021) · 1 control

  • UNICEFAI-4 Transparency, Explanation, Adult Capacity

US Children's Online Privacy Protection Act (COPPA) and COPPA 2.0 Proposed Updates · 1 control

  • USCOPPA-3 Data Minimisation, Retention, Erasure (Eraser Button)

Vermont Artificial Intelligence and Consumer Data Act (AICDA) · 1 control

WHO Global Strategy on Digital Health 2020-2025 · 1 control

  • SO3.2 Regulatory frameworks for digital health

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 440 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) controls