Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data — cross-border transfer and sharing of personal data

Art. 22 permits transfer outside the UAE to states the UAE Data Office has approved as providing an adequate level of protection, or where a bilateral or multilateral agreement covering personal data protection applies. Art. 23 supplies the routes where no adequacy applies: a contract or agreement binding the recipient to the Decree-Law's requirements, the data subject's explicit consent, necessity for performing a contract between the controller and the data subject or a related contract in their interest, necessity for international judicial cooperation, or necessity to protect the public interest. The operative reality is that the adequacy route is unavailable: no list of adequate countries had been published, so in practice Art. 23 contract clauses or explicit consent carry every transfer. Marked 'check' and read alongside the caveat in the UAE comprehensive-law entry — the Executive Regulations that most operative detail depends on could not be confirmed as issued against a primary UAE government source. Entities licensed in DIFC or ADGM follow those free zones' own transfer rules instead.