# UAE PDPL Article (23): Cross-Border Transfer and Sharing of Personal Data for Processing Purposes if a Proper Protection Level is not Available

Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data (UAE PDPL), version 2026.1, in force since 2 January 2022. Read from https://uaelegislation.gov.ae/ar/legislations/1972/download. Each clause starts with its key, which is how to cite it.

This is the official English translation. Where the two differ, the Arabic text prevails: https://dpolens.com/ar/laws/uae-pdpl/art-23.md

## uae-pdpl:art-23:para-1

1. Notwithstanding Article (22) of this Decree by Law, Personal Data may be transferred to outside the State in the following cases:

### uae-pdpl:art-23:para-1:pt-a

a. Companies, operating in countries where there are no laws for Data Protection, may transfer data under a contract or agreement obligating the companies in such countries to adopt measures, controls and requirements set out in this Decree by Law, in addition to provisions forcing the Controller or the Processor to adopt appropriate measures which are imposed by a judicial or regulatory authority in such countries as set out in the contract.

### uae-pdpl:art-23:para-1:pt-b

b. If there is an explicit consent granted by the Data Subject to transfer his/her Personal Data outside the State, provided that such transfer shall not contradict the public or security interest of the State.

### uae-pdpl:art-23:para-1:pt-c

c. If the transfer is necessary to fulfil obligations and establish rights before judicial entities, exercise or defend the same.

### uae-pdpl:art-23:para-1:pt-d

d. If the transfer is necessary to sign or implement a contract made between the Controller and the Data Subject, or between the Controller and third parties to serve the interest of the Data Subject.

### uae-pdpl:art-23:para-1:pt-e

e. If the transfer is necessary to implement an action related to an international judicial cooperation.

### uae-pdpl:art-23:para-1:pt-f

f. If the transfer is necessary to protect the public interest.

## uae-pdpl:art-23:para-2

2. The Executive Regulations of this Decree by Law set forth the controls and stipulations referred to in Paragraphs (1) of this Article, which should be observed during the transfer of data outside the State.

Page: https://dpolens.com/laws/uae-pdpl/art-23