Key Takeaways
- PDPL (Federal Decree-Law No. 45 of 2021) is the UAE's federal personal data protection law.
- Real estate brokerages collecting ID, financial, and contact information from clients are considered data controllers or processors under the law.
- Buyers and sellers have rights to know how their data is used and, in many cases, to request access or deletion.
- PDPL compliance sits alongside AML obligations — a brokerage must protect data even while collecting it for legally required identity checks.
What PDPL covers
The UAE's Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 (PDPL), sets federal rules for how personal data is collected, processed, stored, and shared. Real estate brokerages handle significant personal data during a transaction — passports, Emirates ID, contact details, and financial information — putting them squarely within PDPL's scope.
Your rights as a client
PDPL gives individuals rights over their own data, including the right to be informed about how it's used, and in many circumstances the right to request access, correction, or deletion of personal data held by a business.
- Right to be informed about what data is collected and why.
- Right to request access to personal data a brokerage holds about you.
- Right to request correction of inaccurate data.
- Right to request deletion, subject to legal retention requirements (such as AML record-keeping obligations).
How this interacts with AML requirements
PDPL doesn't override a brokerage's separate legal duty to retain identity and transaction records for AML compliance — the two frameworks work together: a compliant brokerage collects only what's needed, secures it properly, and retains it only as long as legally required, rather than indefinitely or for unrelated purposes.