The Right to Be Forgotten in the UAE: Erasure, Delisting and What the Law Allows

The phrase is usually used for a right to ask a search engine to drop results about you. In the UAE the closest rights are erasure rights. Article 15 of Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, the PDPL, is headed "Right to correction or erasure of Personal Data". Article 33 of the DIFC Data Protection Law, DIFC Law No. 5 of 2020, covers access, rectification and erasure. Both rights run against a controller: the business or person that holds your data and processes it.

Whether an erasure request under either law reaches a search engine's results, as opposed to the website that published the information, is not settled by any UAE source we found. In practice, treat delisting as something Google decides under its own policies, and treat erasure as a request to the business or person that holds or published the data.

The PDPL is Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data. It has been in force since 2 January 2022 (Article 31) and is listed as active on the official UAE Legislation portal. Article 15 gives four grounds for erasure: the data is no longer necessary; you withdraw your consent; you object, or there are no legitimate reasons for the controller to continue; or the processing violates the law.

Erasure cannot be required in four cases: where it concerns public-health data held by private facilities; where it affects investigation procedures or the claiming and defending of rights; where it contradicts other legislation binding the controller; or in other cases set by the Executive Regulations.

Information you made public yourself is treated differently. Under Article 4(2), processing without consent is permitted if it relates to personal data that has become available and known to all by an act of the data subject. The PDPL does not take public data outside its scope; it removes the need for consent only where you made the data public yourself.

The PDPL also has limits of scope. Article 2(2) excludes government data and government entities; data held by security and judicial authorities; a person processing their own data for personal purposes; health and banking or credit data that have their own legislation; and companies and establishments in free zones that have their own data-protection legislation, such as the DIFC and ADGM. It reaches abroad: under Article 2(1) it applies to a controller or processor residing outside the State that processes personal data of data subjects inside the State.

If a controller refuses, Article 24 lets you complain to the Bureau, the UAE Data Office, which may impose the administrative penalties in Article 26.

On 19 October 2026 the PDPL's list of related legislation on the official portal showed only the KYC Platform Decree-Law (No. 30 of 2024) and the Child Digital Safety Decree-Law (No. 26 of 2025), and a portal search for the Executive Regulations returned none. Some websites say the Regulations have been issued; we found no such text on the official portal.

The gap matters in two ways. Article 15 leaves further exceptions to the Executive Regulations, so the full list of cases where erasure cannot be required is not yet known. And Article 29 gives controllers and processors up to six months from the date the Executive Regulations are issued to regularise their position, a period the Cabinet may extend once. Article 15 is in force as written, but take advice from a UAE lawyer before relying on it in a dispute.

The DIFC Data Protection Law came into force on 1 July 2020 (Article 4). It is the data-protection law of the Dubai International Financial Centre, a free zone with its own data-protection legislation, and the PDPL's Article 2(2) excludes such free-zone companies and establishments from the PDPL's scope. A request to a business that holds your data in the DIFC is therefore made under Article 33.

Under Article 33(3), the controller must comply only if one of the Article 33(2) conditions applies and it is not required to keep the data by law or for the establishment or defence of legal claims.

DIFC Amendment Law No. 1 of 2025, issued on 8 July 2025 and in force from 15 July 2025, added a private right of action as a new Article 64A, through the DIFC Courts. We have this from a law-firm summary rather than the amended text, so confirm the conditions with a lawyer before relying on it.

The DIFC Courts hear matters of civil and commercial law only. They deal with cases arising out of the DIFC and its operations, and with claims the parties agree in writing to bring there. All hearings are conducted in English and all documents must be submitted in English, and criminal matters are referred to external authorities. Businesses in ADGM are also outside the PDPL; ADGM's own data-protection rules are not covered in this guide.

For many people who want to be forgotten, these policies are where a practical request starts, because they do not depend on any UAE statute. Other content that should be removed under the law goes through Google's legal-removal process. In each case Google assesses the request and decides.

Where the content concerns someone under 18, go to the police: 999 in an emergency, the Dubai Police e-crime service, Abu Dhabi Police Aman or the Ministry of Interior eCrimes platform. The guide on how to report cyber crime in the UAE covers each channel. RepuLex does not take matters involving children as reputation work.

Once a page has been deleted from its site, Google's "Refresh outdated content" tool lets you ask Google to update a result that still shows it. Other search engines run their own processes, and a Google decision does not bind them.

Removing a result from Google Search does not remove the page. Google says that even if it removes something from Google Search, it might still be on the internet, and that removing it from the site means contacting the site owner. That is where the erasure rights come in: they are requests to the controller of the data, which for a page about you may be the business or person that runs the site. For news reports, the guide to removing a news article about you sets out the publisher route.

Article 431 of the Penal Code, Federal Decree-Law No. 31 of 2021, provides for incarceration and a fine for anyone who publishes, by any means of publicity, news, photos or comments related to the private or family life secrets of individuals, "even if they are true". Article 44 of Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes punishes using an information network, information system or IT equipment to invade the privacy or sanctity of private or family life without consent, including by publishing news, electronic photos, images, scenes, comments, data or information "even if it is true and genuine", with intention of harming the person. The penalty is imprisonment of at least 6 months and/or a fine of AED 150,000 to AED 500,000.

The acts listed in Article 44 also include taking photos of people in any public or private place, or preparing, transferring, disclosing, copying or keeping electronic photos; photographing or publishing images of the injured, the dead or accident victims without consent; and tracking or disclosing geographic location data. Modifying any record, photo or scene with the intention of defaming or insulting someone carries imprisonment of at least one year and/or a fine of AED 250,000 to AED 500,000 (Article 44, final paragraph).

This does not make every true report unlawful. Article 44 turns on an invasion of private or family life without consent and, for publication, an intention of harming the person, and whether a page meets those conditions is for the prosecution and the court. Where it does, a platform report, Google's legal-removal process and a complaint all have a concrete basis. The guide to why truth is not a defence in the UAE works through the conditions.

If you are considering a criminal complaint, take advice within three months of learning of the post and who made it. Article 11 of the Criminal Procedures Law, Federal Decree-Law No. 38 of 2022, says a complaint for the offences it lists as "insult and slander of people" is not admitted after three months from when the victim becomes aware of the crime and its perpetrator. We have not been able to settle whether that limit also governs the online offences in the Cybercrime Decree-Law, including Article 43, so treat three months as the working deadline.

On conviction under the Cybercrime Decree-Law, the court may order electronic monitoring, deprivation of the use of the network, or the closing or blocking of the violating site, completely or partially (Article 59). The competent authorities, defined in Article 1 as the federal or local authorities concerned with electronic and cyber security, may issue writs of correction and removal, and disable orders, to be complied with within the period stated in the notice, and under Article 66(2) the Attorney General may order blocking. There is no route for a private party to issue such an order.

In a civil claim under the Civil Transactions Law, Federal Decree-Law No. 25 of 2025, in force since 1 June 2026, the court may, at the injured party's request, order the restoration of the status quo ante, or the performance of a specific matter related to the harmful act, by way of compensation (Article 256(2)). An infringement on another's freedom, honour, reputation, social standing or financial status is moral harm (Article 254(1)). A claim is inadmissible after three years from when you learned of the damage and the person responsible, with an absolute cap of fifteen years from the harmful act (Article 258).

A block in the UAE is a block in the UAE only. An access blocking order under the Cybercrime Decree-Law directs the UAE service provider to disable users' access in the UAE to the website or account, and the content stays online elsewhere. Under the TDRA's Internet Access Management Regulatory Policy (Version 1.1, issued 19 April 2017), an individual or entity asks its licensed internet service provider, not the TDRA, to block access; the provider escalates to the TDRA only where it cannot decide the category itself, and a block remains until the prohibited content is removed or the TDRA instructs otherwise. We have not verified the current list of prohibited content categories, or how the providers take requests today.

You can lodge a criminal complaint yourself, with the police or the Public Prosecution. If a lawyer acts for you, the courts and the Public Prosecution admit that representation only if the lawyer is recorded in the Roll of Practicing Lawyers kept with the Ministry (Article 6(2) of Federal Decree-Law No. 34 of 2022 Regulating the Legal Profession and Legal Consultation Profession).

Work through these steps in order:

RepuLex is not a law firm and holds no UAE licence or office. It does not file complaints, sue or appear in the UAE. A request under the PDPL or the DIFC law is made in your name; RepuLex prepares the evidence and the list of URLs it needs and tracks the replies, and any complaint to an authority or claim in a court is yours or your UAE lawyer's.

RepuLex works on published fixed fees per URL, paid in advance and refunded in full for any URL not removed within its agreed timeline, provided you supply the documents and authority requested for that URL. For how the work is organised across the Emirates, see online reputation management in the UAE, and for individuals and businesses in Dubai, including the DIFC, see reputation work in Dubai.