UAE PDPL Compliance Checklist for SMEs (2026)

Federal Decree-Law No. 45 of 2021 is the UAE PDPL. Enforcement intensified through 2025 to 26, and SMEs are now in scope, not just enterprises. The 12-step checklist below covers data inventory, lawful basis, DSAR workflow, consent, breach reporting, DPO appointment, vendor risk, and board reporting. Most SMEs can reach a defensible baseline in 8 to 12 weeks.