United Arab Emirates
Federal law is only the beginning. DIFC and ADGM run their own data protection regimes that displace the federal PDPL inside the zones, and Dubai activity can trigger emirate-level requirements from the DHA, DTCM, RERA and Trakheesi. The Radar never applies federal PDPL to a DIFC entity by default.
Federal UAE (PDPL, e-commerce, consumer protection) → emirate / free zone (Dubai, DIFC, ADGM, Abu Dhabi, DHCC) → sector authorities.
Sub-jurisdictions, live from the matrix
Law counts shown for the hotel (hospitality) example; every cell opens the full verbatim stack.
The instruments that do the damage
Federal data protection law: notices, purposes, cross-border transfer rules and data-subject rights for onshore entities.
A GDPR-style regime with its own commissioner and enforcement inside the DIFC; ADGM mirrors with its own regulations.
Dubai property marketing requires valid advertising permits; listings without permit numbers are checkable, and checked.
DHA-licensed providers need medical-advertising approval; content rules extend to social embeds on your site.
Enforcement climate, cited
Free-zone determination is evidence-led: registered address, licence references and regulator statements on your own site decide which regime attaches, and the result is shown with its evidence.
Serving this market? See your stack.
Pick your sector and sub-sector in the Explorer, or start with the introductory audit from this market's vantage.
Applicability depends on confirmed facts about your business (establishment, targeting, reach) and supported scope. Figures are cited to their sources and periods; items marked for approval are re-verified before publication.