UAE multi emirate compliance: where the seams actually fall

UAE multi emirate compliance is not one statement about one build. Dubai's virtual assets law makes the point in a single sentence — Article 3 of Law No. 4 of 2022 applies it "in all zones across the Emirate, including Special Development Zones and free zones but excluding the Dubai International Financial Centre". A regulator whose remit stops at a boundary inside one emirate is the rule here, not the exception.

This post maps where the seams fall, because that is a system design question. Whether a specific obligation applies to your specific product is a question for your counsel, and nothing below is a substitute for that. We have not delivered a UAE product ourselves; this rests on public sources, with the gaps marked.

Three layers, and two carve-outs that cut through all of them

The mental model that survives contact with the UAE is not a hierarchy. It is a federal layer, an emirate layer and a sector layer — with the two financial free zones sitting outside large parts of all three.

Layer	Examples	Applies to
Federal	PDPL (Federal Decree-Law 45 of 2021); SCA virtual asset powers under Cabinet Resolution 111 of 2022	The UAE, with stated exceptions
Emirate	VARA in Dubai; DHA in Dubai; DOH in Abu Dhabi	One emirate, sometimes including its free zones
Financial free zone	DIFC with the DFSA; ADGM with the FSRA	A defined geographic zone, under its own law

DIFC and ADGM are common-law jurisdictions with their own legislatures, courts and regulators. They are not a licensing convenience layered on top of federal law — which is why "we are UAE registered" tells you very little about which rulebook binds a product.

Is UAE compliance a single standard?

No, and the virtual assets example shows the shape cleanly. The UAE government's own portal describes Cabinet Resolution 111 of 2022 as giving the Securities and Commodities Authority powers over virtual asset activities across the UAE including free zones, while Dubai Law No. 4 of 2022 establishes VARA for Dubai's mainland and free zones but not the DIFC. Cabinet Decision 112 of 2022 is the instrument generally described as delegating VASP licensing in Dubai, excluding the DIFC, to VARA.

So a virtual asset product can face VARA, the DFSA, the FSRA, or the SCA depending on where it is licensed and offered — four possible regulators for one category of product, in one country. We have written separately on what building to VARA's rulebooks actually requires and on what the DFSA rulebook adds inside the DIFC.

Data protection: the federal law explicitly steps back

The PDPL is the clearest case of a federal law that defines itself by exclusion. Secondary legal guides consistently describe its scope as not extending to free zones that have their own data protection legislation — DIFC and ADGM being the examples — nor to health data or banking and credit data governed by separate sectoral legislation, nor to public entities.

Two honest caveats. First, we were unable to retrieve the official Arabic or English text of the scope article from the UAE Legislation portal, which returned an access error, so the above is secondary characterisation rather than quoted law. Second, and more consequentially, sources disagree on whether the PDPL's Executive Regulations have been issued at all — some guides describe 2023 implementing regulations as providing detailed guidance, others list them as still pending. We could not resolve that from public sources.

That ambiguity is itself the design input. If the implementing detail of the federal regime is contested, a product that must be defensible should be built to the stricter of the applicable regimes rather than to the federal baseline alone. The practical consequences for where data physically sits are covered in our note on what actually has to stay in-country.

A group spanning onshore and a free zone faces both

The pattern described repeatedly in legal commentary is that an entity licensed in DIFC or ADGM follows that zone's regime, a mainland entity follows the federal one, and a commercial free zone without its own data protection law stays inside the federal regime. A group operating across both ends up subject to both, by entity.

For a single codebase serving the group, that means the tenancy model has to carry a regulatory identity. Not a country field — a licensing-jurisdiction field, set per entity, driving retention, residency, consent and breach-notification behaviour. Retrofitting that into a product that assumed one national regime is among the more expensive changes we see discussed, which is why the free zone versus mainland question is worth settling before the schema.

Health is where UAE multi emirate compliance becomes two integrations

Health is where UAE multi emirate compliance stops being an abstraction and becomes two different integrations. The regulator split described consistently across sources is MOHAP at federal level, the Dubai Health Authority for Dubai, and the Department of Health for Abu Dhabi. Sharjah is reported inconsistently — some sources place it under MOHAP, others under a Sharjah Health Authority — and we could not settle that against an official source.

The engineering consequence is sharper than the licensing one. Each of the two largest emirates runs its own health information exchange: NABIDH in Dubai and Malaffi in Abu Dhabi. The Department of Health's own health information exchange standards page states that it mandates specified coding standards and units of measurement and requires a minimum data set to be sent from source EMR and reference laboratory systems to Malaffi. Facilities are also required to meet the ADHICS cybersecurity standard in order to integrate.

Commentary reports that connecting to Malaffi became a prerequisite for applying for or renewing an Abu Dhabi facility licence from 1 April 2021, which we could not confirm in DOH's own wording. Either way, the structural point holds: one clinical product sold in both emirates needs two exchange integrations, two minimum data sets and two sets of licensing dependencies — not one UAE health connector. The licensing side of this is covered in our post on why a Dubai telemedicine build needs two licences rather than one, and the hosting side in health data residency and the DESC-certified cloud.

Where the boundary is genuinely unclear

Being useful here means marking the unknowns rather than smoothing them:

• PDPL Executive Regulations. Status contested across sources, as above. This affects nearly every product handling personal data.
• Sharjah health regulation. MOHAP or a separate emirate authority, depending on which guide you read.
• Virtual assets outside Dubai, DIFC and ADGM. Commentary expects SCA jurisdiction but notes it has not issued its own virtual assets regulations, leaving the practical path less defined than Dubai's.
• AI. The only instrument we have found that is binding rather than advisory sits inside one free zone — see DIFC Regulation 10. Federal and emirate-level AI material is largely framework and strategy, which is a different thing from a rulebook you can be examined against.

Treat each of these as a question to put to counsel with the specifics of your licence and your users, not as a gap to fill with a reasonable assumption.

What this means for the build

Four design positions follow from the map, and they are cheap at the start and expensive later:

1. Make licensing jurisdiction a first-class attribute. Per tenant, per entity, per facility — whatever your unit of licensing is. Derive residency, retention and consent behaviour from it rather than from a country code.
2. Do not build a "UAE" configuration. Build Dubai mainland, DIFC, Abu Dhabi, ADGM and Northern Emirates as separate configurations that happen to share most values today. A single UAE profile is the thing you will later have to unpick.
3. Assume integration targets are per emirate. Health exchanges are the clearest case, but the same logic applies wherever an emirate-level authority operates its own system.
4. Record which rule you implemented and why. When the federal implementing detail is contested, the defensible position is a written decision with a date and a source, not a correct guess.

The uncomfortable summary is that "UAE compliant" is a claim that needs a scope attached to be meaningful — which emirate, which zone, which sector, as of when. If you are scoping a product intended to work across several emirates and want to find the seams before they cost you a rebuild, we work with companies building in Dubai, and mapping obligations onto a data model is the custom software work we do.