Skip to content
Fahmفاهم
Sign in

Personal Data Protection Law · Federal Decree-Law 45 of 2021

Article 2

clear positive statement or action

Not yet lawyer-reviewedText from the official portal, corpus snapshot of 26 October 2026.

English translation

Scope of Application of the Decree by Law

1. Provisions of this Decree by Law shall apply to the processing of all or part of the Personal Data by means of electronic systems which operate automatically, or by other means, by the following: a. Each Data Subject residing in the State or having a place of business in it. b. Each Controller or Processor residing in the State and carrying out the activities of processing Personal Data of Data Subjects inside and outside the State. c. Each Controller or Processor residing outside the State and carrying out the activities of processing Personal Data of Data Subjects inside the State.

2. Provisions of this Decree by Law shall not apply to the following: a. Government Data b. Governmental entities which control or process Personal Data. c. Personal Data held by the security and judicial authorities d. A Data Subject who processes his/her data for personal purposes. e. Personal Health Data that has legislation regulating its protection and processing. f. Personal banking and credit data and information that have legislation regulating their protection and processing. g. Companies and establishments located in free zones in the Country and have special legislations regarding Personal Data protection.

Official translation, as published by the portal.

Official Arabic text

نطاق سريان المرسوم بقانون

.1 تسري أحكام هذا المرسوم بقانون على معالجة البيانات الشخصية سواء كلها أو جزء منها عن طريق وسائل الأنظمة الإلكترونية التي تعمل بشكل تلقائي وآلي، أو غيرها من الوسائل الأخرى، وذلك من قبل: أ. كل صاحب بيانات يقيم في الدولة أو له مقر عمل فيها. ب. كل متحكم أو معالج متواجد في الدولة يقوم بمزاولة أنشطة معالجة البيانات الشخصية لأصحاب البيانات في الدولة أو خارجها. ج. كل متحكم أو معالج متواجد خارج الدولة يقوم بمزاولة أنشطة معالجة البيانات الشخصية لأصحاب البيانات في الدولة.

.2 لا تسري أحكام هذا المرسوم بقانون على ما يأتي: أ. البيانات الحكومية. ب. الجهات الحكومية المتحكمة بالبيانات الشخصية أو تلك التي تقوم بمعالجتها. ج. البيانات الشخصية لدى الجهات الأمنية والقضائية. د. صاحب البيانات الذي يقوم بمعالجة بياناته لأغراض شخصية. ه. البيانات الشخصية الصحية التي لديها تشريع ينظم حماية ومعالجة تلك البيانات. و. البيانات والمعلومات الشخصية المصرفية والائتمانية التي لديها تشريع ينظم حماية ومعالجة تلك البيانات. ز. الشركات والمؤسسات الواقعة في المناطق الحرة في الدولة ولديها تشريعات خاصة بحماية البيانات الشخصية.

What it means when you sign

This article sets out who and what the personal data protection law applies to, and what it leaves out. It applies to processing of personal data involving a data subject residing in the State or having a place of business in it, a controller or processor residing in the State processing data of people inside or outside the State, and a controller or processor outside the State processing data of people inside the State.

The law does not apply to government data, governmental entities that control or process personal data, personal data held by security and judicial authorities, an individual processing their own data for personal purposes, health and banking data that have their own legislation, and companies and establishments in free zones that have special legislation on personal data protection.

When you are about to sign a contract that involves personal data, this article means the data protection law may apply to a party based abroad if it handles data of people in the State. A clause on data handling may need to be read against these exclusions, for example if one party is in a free zone with its own data rules.

In Fahm reports this article usually sits under: One-sided mechanisms

Related articles

All articles of this law