The UAE Federal Personal Data Protection Law (PDPL) excludes companies and institutions located in free zones from its scope if they are subject to special legislation on personal data protection.

Text of Relevant Provisions

Federal PDPL Art.2(2)(g):

"2. The provisions of this Decree Law shall not apply to the following: g. companies and institutions located in the free zones of the State and are subject to special legislation on Personal Data Protection."

Analysis of Provisions

The UAE Federal PDPL explicitly carves out an exemption for entities located in free zones that are subject to their own data protection legislation. This provision effectively limits the territorial scope of the Federal PDPL within the UAE mainland by excluding certain geographical areas (free zones) from its application.

The key elements of this exemption are:

1. The entity must be "located in the free zones of the State"
2. The entity must be "subject to special legislation on Personal Data Protection"

This means that not all companies in free zones are automatically exempt from the Federal PDPL. Only those that are governed by specific data protection laws within their respective free zones fall under this exemption.

Implications

This exemption has several important implications for businesses:

1. Dual regulatory regime: The UAE effectively maintains a dual regulatory regime for data protection, with the Federal PDPL applying to mainland UAE and separate laws governing free zones.
2. Compliance considerations: Companies operating in both mainland UAE and free zones may need to comply with different data protection regimes, potentially increasing compliance complexity.
3. Free zone attractiveness: Free zones with their own data protection laws may become more attractive for certain businesses, especially if their regulations are perceived as more business-friendly or aligned with international standards.
4. Potential regulatory arbitrage: Companies might strategically choose to locate in specific free zones to benefit from potentially more favorable data protection regulations.
5. Jurisdictional clarity: This provision provides clear guidance on which law applies to entities in free zones, reducing potential conflicts between federal and free zone regulations.