# UAE PDPL Article (10): Appointing Data Protection Officer

Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data (UAE PDPL), version 2026.1, in force since 2 January 2022. Read from https://uaelegislation.gov.ae/ar/legislations/1972/download. Each clause starts with its key, which is how to cite it.

This is the official English translation. Where the two differ, the Arabic text prevails: https://dpolens.com/ar/laws/uae-pdpl/art-10.md

## uae-pdpl:art-10:para-1

1. The Controller and Processor shall appoint a Data Protection Officer, who has sufficient skills and knowledge of the Personal Data Protection Law, in any of the following cases:

### uae-pdpl:art-10:para-1:pt-a

a. If processing would cause a high-level risk to the confidentiality and privacy of the Personal Data of the Data Subject as a result of adopting new technologies or with regard to the volume of data.

### uae-pdpl:art-10:para-1:pt-b

b. If processing would involve a systematic and comprehensive assessment of Sensitive Personal Data, including Profiling and Automated Processing.

### uae-pdpl:art-10:para-1:pt-c

c. If processing would be carried out on a large volume of Sensitive Personal Data.

## uae-pdpl:art-10:para-2

2. The Data Protection Officer may be an employer of the Controller or the Processor or authorized by them, whether inside or outside the State.

## uae-pdpl:art-10:para-3

3. The Controller or the Processor shall specify the contact details of the Data Protection Officer and notify the Bureau of the same.

## uae-pdpl:art-10:para-4

4. The Executive Regulations of this Decree by Law shall specify the types of technologies and criteria for determining the volume of data required in accordance with this Article.

Page: https://dpolens.com/laws/uae-pdpl/art-10