Article 3 of the UAE Federal Decree-Law No. 45 of 2021 expressly EXCLUDES financial free zones from the federal PDPL scope. The financial free zones have their own sectoral data protection regimes: (a) DUBAI INTERNATIONAL FINANCIAL CENTRE (DIFC) - DIFC Data Protection Law No. 5 of 2020 (replaced DIFC DP Law 1 of 2007) administered by the DIFC Commissioner of Data Protection; (b) ABU DHABI GLOBAL MARKET (ADGM) - ADGM Data Protection Regulations 2021 administered by the ADGM Office of Data Protection. Sectoral laws also exist: FEDERAL LAW NO. 2 OF 2019 on the Use of Information and Communications Technology in Health Fields (Health Data Law) administered by the UAE Ministry of Health and Prevention. Multi-jurisdictional entities operating across mainland UAE + DIFC + ADGM must apply the relevant regime per jurisdiction + ensure cross-jurisdictional consistency. Free-zone-to-federal cross-border data transfers within the UAE are subject to UAE PDPL Articles 22-24 to the extent the transfer crosses jurisdiction boundaries.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.