600,000
Cyber breach attempts per day · UAE infrastructure
Not per year. Not per month. Per day. A tripling of the pre-conflict baseline of 200,000, driven by regional escalation and AI-powered offensive tooling.
Source: Mohammed Al Kuwaiti, UAE Cyber Security Council · SAMENA Council Leaders' Summit · 1 April 2026

When your Board last reviewed your organisation's cybersecurity posture, was that number on the table? Was the financial consequence of a breach quantified? Was anyone in the room talking about what a single incident could cost the business — in penalties, operational disruption, and lost banking relationships?

If the answer is no, this article is for you.

What the UAE PDPL Actually Requires — And Why It Is a CFO Issue

The UAE Personal Data Protection Law — Federal Decree-Law No. 45 of 2021, known as the PDPL — is the country's first comprehensive federal legislation governing how organisations collect, store, process, and transfer personal data of individuals within the UAE.

It is not a technology regulation. It is a governance and financial liability regulation.

The PDPL applies to every mainland UAE business handling personal data of UAE residents — which in practice means every business, since employee and supplier records alone bring most organisations within scope. Even a pure B2B operation processes personal data constantly: employee payroll and HR records, Emirates ID copies, names and contact details of individuals at client and vendor organisations, and individual-level data sitting in ERP and finance systems.

⚠ Free Zone Exception — Read Carefully

DIFC and ADGM operate under their own separate data protection frameworks and are excluded from the PDPL. However, companies operating across both mainland and a financial free zone may face overlapping obligations simultaneously. Foreign companies processing data of UAE residents are also within PDPL scope.

What it requires: Documented security controls and data governance frameworks. Data Protection Officer appointment for high-risk processing activities. Mandatory breach notification obligations. Restrictions and impact assessments on cross-border data transfers. Lawful basis for all personal data processing.

⚖️
Minimum penalty
AED 50,000
Per violation. Scaled to severity, duration, and intent of breach.
🚨
Maximum penalty
AED 5,000,000
Per violation. Escalates for repeated offences. Processing can be suspended entirely.
📅
In force since
January 2022
Not a future obligation. A present condition with an accelerating enforcement trajectory.
Full enforcement
January 2027
The grace period is closing. Full enforcement capacity lands in 7 months.
22
January 2022
PDPL entered into force
Federal Decree-Law No. 45 of 2021 became law. Compliance obligations active from this date.
Now
2026 — Grace period closing
Enforcement trajectory accelerating
UAE Data Office building enforcement capacity. Investigations underway. 600,000 daily attacks creating the conditions for headline-generating breaches.
27
January 2027 — Full enforcement
Full enforcement capacity active
Maximum penalties in play. The organisations exposed will not be those with the weakest technology. They will be those where the Board assumed the control existed because the certificate was on the wall.

ISO 27001: What It Actually Is — and What It Is Not

When I raise cybersecurity governance with CFOs and Boards across the GCC, the response is almost always the same:

"We are ISO 27001 certified."

Let me be precise about what that means — and what it does not.

ISO 27001 is a genuinely rigorous international standard for information security management. The 2022 version contains 93 controls across 4 themes — organisational, people, physical, and technological — covering the real attack surface of a business. A company that has genuinely implemented all relevant controls has materially reduced its exposure. The framework is sound.

✅ What ISO 27001 confirms
A management system for information security existed at point of audit
Governance structure was in place on the day the auditor visited
93 controls were scoped, assessed and documented
Risk assessment methodology was applied at a point in time
❌ What it does not confirm
That every control remains technically effective today
That the control environment has not degraded since certification
That new risks introduced after the audit are being managed
That the people running the controls understand why they exist

ISO 27001 is to cybersecurity what an annual statutory audit is to financial health. The audit confirms the accounts were prepared correctly at a point in time. It does not tell you the business won't run out of cash next month.

— Tariq Salam, CFO

Certification and ongoing compliance are two different things. Most Boards cannot tell them apart.

Where the Gap Actually Lives

Between audits, businesses change — often significantly. Consider what happens quietly, without triggering any formal review:

Staff turnover changes who has access to what — and access reviews are not always kept current. New systems are integrated without going through the security assessment process. Policies approved at Board level are never operationalised at the process level. Third-party vendors are onboarded under commercial pressure, with security due diligence deferred.

None of these events automatically invalidate your certification. But collectively, they create the conditions under which a breach becomes possible — and under which your certified posture has materially diverged from your operational reality.

This is the governance failure pattern I encounter most consistently across distressed and high-growth businesses alike. It does not announce itself. It accumulates. And by the time it surfaces, the cost of remediation is multiples of what prevention would have required.

The policy was approved. The process was never followed.

— The sentence that describes most governance failures in UAE businesses

The Financial Consequence Framework CFOs Are Missing

Most organisations approach cybersecurity as a cost centre managed by IT. The budget conversation is about firewalls, endpoint protection, and annual penetration testing. That framing is dangerously incomplete.

⚖️
Regulatory penalties
Up to AED 5 million per violation under PDPL, compounding where multiple data categories or large numbers of data subjects are involved. Processing can be suspended entirely.
🔧
Operational disruption
Regulatory investigations require system audits, documentation reviews, and remediation programmes. The internal resource cost and management distraction — in a business already under operational pressure — can be existential.
🏦
Banking and credit relationships
UAE banks conduct periodic reviews of corporate governance posture. A publicised breach involving governance failure creates covenant and credit appetite risk that most CFOs do not model in advance.
🤝
Reputational damage
In the GCC market, where relationships and trust underpin commercial activity, reputational damage from a data breach travels faster and lasts longer than the regulatory process itself.

Taken together, this is not an IT budget conversation. It is a risk-adjusted financial exposure that belongs on the Board agenda — quantified, stress-tested, and owned at CFO level.

The Questions Your Board Should Be Asking

Question 01
What is our quantified financial exposure under PDPL if a material breach occurs today?
Not a qualitative risk rating. A number — penalties, estimated operational disruption cost, credit impact. If this number does not exist, it needs to be built.
Question 02
When was our ISO 27001 certification last audited — and what has changed in the business since then?
Staff changes, system integrations, new vendors, process changes. Map the delta between what was certified and what is running today.
Question 03
Of the 93 controls in our certification scope, how many are being actively monitored versus passively assumed?
This is the question that separates governance from the appearance of governance. Most Boards have never been asked it.
Question 04
Who has access to what — and when was that last reviewed?
Access control drift is the most common and least visible governance failure in growing businesses. It is also one of the 93 controls most frequently found degraded between audit cycles.
Question 05
If a breach occurred today, could we demonstrate to the UAE Data Office that we had taken reasonable and documented steps toward compliance?
The difference between a maximum penalty and a reduced one often comes down to documented good-faith effort. Effort that was never documented does not exist in a regulatory proceeding.
Question 06
Is your Board receiving cybersecurity governance reporting — or just cybersecurity activity reporting?
Activity reports tell you what happened. Governance reports tell you whether the control environment is adequate. These are different documents serving different purposes.

The Closing Observation

The UAE has one of the most advanced cybersecurity frameworks in the region. The regulatory infrastructure is being built in real time. Full enforcement lands in January 2027.

What lags behind — in business after business — is the internal governance infrastructure that translates regulatory intent into operational reality.

ISO 27001's 93 controls exist precisely to address that gap. The framework is comprehensive. The problem is not the standard. The problem is the assumption that passing the audit means the work is done.

Certification without live control discipline is a document. Not a defence. The regulator is building the capacity to test the difference.

The organisations that will be exposed are not necessarily those with the weakest technology. They will be those where the Board assumed the control existed because the policy was approved and the certificate was on the wall.

The cost of getting ahead of this is a fraction of the cost of responding to it.

— Tariq Salam, CFO · UAE & GCC
TS
Tariq Salam
Turnaround CFO · Restructuring Advisor · ACCA · ICAEW · UAE Golden Visa
Nearly two decades of experience across Big Four firms and senior CFO roles in manufacturing and healthcare across the UAE and GCC. Working at the intersection of finance, operations, and governance — helping businesses stabilise, recover, and perform. Available for direct conversation on unquantified regulatory exposure, governance gaps, and financial distress.
Connect on LinkedIn → Email directly →
Sources UAE Cyber Security Council via Khaleej Times, 1 April 2026 · Federal Decree-Law No. 45 of 2021 (UAE PDPL) · UAE Legislation Portal: uaelegislation.gov.ae · ISO/IEC 27001:2022 Information Security Management Systems
Continue reading