When your Board last reviewed your organisation's cybersecurity posture, was that number on the table? Was the financial consequence of a breach quantified? Was anyone in the room talking about what a single incident could cost the business — in penalties, operational disruption, and lost banking relationships?
If the answer is no, this article is for you.
What the UAE PDPL Actually Requires — And Why It Is a CFO Issue
The UAE Personal Data Protection Law — Federal Decree-Law No. 45 of 2021, known as the PDPL — is the country's first comprehensive federal legislation governing how organisations collect, store, process, and transfer personal data of individuals within the UAE.
It is not a technology regulation. It is a governance and financial liability regulation.
The PDPL applies to every mainland UAE business handling personal data of UAE residents — which in practice means every business, since employee and supplier records alone bring most organisations within scope. Even a pure B2B operation processes personal data constantly: employee payroll and HR records, Emirates ID copies, names and contact details of individuals at client and vendor organisations, and individual-level data sitting in ERP and finance systems.
⚠ Free Zone Exception — Read Carefully
DIFC and ADGM operate under their own separate data protection frameworks and are excluded from the PDPL. However, companies operating across both mainland and a financial free zone may face overlapping obligations simultaneously. Foreign companies processing data of UAE residents are also within PDPL scope.
What it requires: Documented security controls and data governance frameworks. Data Protection Officer appointment for high-risk processing activities. Mandatory breach notification obligations. Restrictions and impact assessments on cross-border data transfers. Lawful basis for all personal data processing.
ISO 27001: What It Actually Is — and What It Is Not
When I raise cybersecurity governance with CFOs and Boards across the GCC, the response is almost always the same:
"We are ISO 27001 certified."
Let me be precise about what that means — and what it does not.
ISO 27001 is a genuinely rigorous international standard for information security management. The 2022 version contains 93 controls across 4 themes — organisational, people, physical, and technological — covering the real attack surface of a business. A company that has genuinely implemented all relevant controls has materially reduced its exposure. The framework is sound.
ISO 27001 is to cybersecurity what an annual statutory audit is to financial health. The audit confirms the accounts were prepared correctly at a point in time. It does not tell you the business won't run out of cash next month.
— Tariq Salam, CFOCertification and ongoing compliance are two different things. Most Boards cannot tell them apart.
Where the Gap Actually Lives
Between audits, businesses change — often significantly. Consider what happens quietly, without triggering any formal review:
Staff turnover changes who has access to what — and access reviews are not always kept current. New systems are integrated without going through the security assessment process. Policies approved at Board level are never operationalised at the process level. Third-party vendors are onboarded under commercial pressure, with security due diligence deferred.
None of these events automatically invalidate your certification. But collectively, they create the conditions under which a breach becomes possible — and under which your certified posture has materially diverged from your operational reality.
This is the governance failure pattern I encounter most consistently across distressed and high-growth businesses alike. It does not announce itself. It accumulates. And by the time it surfaces, the cost of remediation is multiples of what prevention would have required.
The policy was approved. The process was never followed.
— The sentence that describes most governance failures in UAE businessesThe Financial Consequence Framework CFOs Are Missing
Most organisations approach cybersecurity as a cost centre managed by IT. The budget conversation is about firewalls, endpoint protection, and annual penetration testing. That framing is dangerously incomplete.
Taken together, this is not an IT budget conversation. It is a risk-adjusted financial exposure that belongs on the Board agenda — quantified, stress-tested, and owned at CFO level.
The Questions Your Board Should Be Asking
The Closing Observation
The UAE has one of the most advanced cybersecurity frameworks in the region. The regulatory infrastructure is being built in real time. Full enforcement lands in January 2027.
What lags behind — in business after business — is the internal governance infrastructure that translates regulatory intent into operational reality.
ISO 27001's 93 controls exist precisely to address that gap. The framework is comprehensive. The problem is not the standard. The problem is the assumption that passing the audit means the work is done.
Certification without live control discipline is a document. Not a defence. The regulator is building the capacity to test the difference.
The organisations that will be exposed are not necessarily those with the weakest technology. They will be those where the Board assumed the control existed because the policy was approved and the certificate was on the wall.
The cost of getting ahead of this is a fraction of the cost of responding to it.
— Tariq Salam, CFO · UAE & GCC