UAE PDPL Compliance for IT Asset Disposal
By Ali Hassan, Editor, MAH Recycling
The PDPL never mentions hard drives. It does say personal data must not be kept after its purpose is exhausted, and a retired laptop is exactly where it can sit. This guide maps the law’s wording to NIST SP 800-88 and the records a DPO can show. It is general information, not legal advice.
What the law says that reaches retired hardware
Federal Decree-Law No. 45 of 2021 defines processing broadly. The list includes storing, erasing and destroying personal data. So a wipe is itself a processing operation, and the law’s controls apply to it.
Three controls matter most. Data must be kept securely with appropriate technical and organizational measures (Article 5(6)). It must not be kept once its purpose is exhausted, unless it has been anonymized (Article 5(7)). And security should meet the highest standard suited to the risk, in line with best international practices and standards (Article 20).
From PDPL principle to disposal evidence
| PDPL provision | What it means for retired hardware | Evidence to keep |
|---|---|---|
| Art. 5(7), storage limitation | Devices holding personal data you no longer need should be sanitized, not shelved | Retirement date, sanitization record |
| Arts. 5(6), 7(1), 20, security | Method must suit the data and media type | NIST method per device: clear, purge or destroy |
| Art. 8, processor duties | A vendor handling devices follows your instructions, erases data and can prove compliance | Contract, certificate, serial-level records |
| Art. 9, breach reporting | A drive lost in transit may count as a breach | Sealed handover, chain of custody log |
Where NIST SP 800-88 fits
The PDPL does not name NIST. Article 20 points to international standards, and NIST SP 800-88 Rev. 2 (https://csrc.nist.gov/pubs/sp/800/88/r2/final) is a widely used reference for sanitization. Treating it as your benchmark is our reading, not the law’s wording.
Use it to pick the method by media type and data sensitivity. Flash storage usually needs purge or destruction, and hard disks that must be destroyed need a physical method. Then record the result per device, so the certificate shows serial numbers instead of “1x server.”
Treat your ITAD vendor as a processor
A vendor that handles devices holding personal data may count as a processor under Article 8. Ask your legal team to confirm, then check the contract for:
- Your written instructions and the scope of work.
- The sanitization method per media type.
- Erasure after processing, as Article 8(4) requires.
- Protection of the devices while in custody (Article 8(6)).
- Evidence on request, including serial-level certificates (Article 8(8)).
- Prompt notice to you of any loss or breach.
What is still unsettled
The law expected executive regulations within six months. Morgan Lewis reported in June 2026 that they had still not been issued, and that the market expects the new Federal Authority for Artificial Intelligence and Data to finalise them and drive enforcement. Penalties are left to a Cabinet decision (Article 26), so fine figures circulating online do not come from the statute’s text.
The scope also has limits. Article 2 excludes government data, health and banking data covered by their own laws, and free-zone companies with their own data legislation. Check which regime covers each entity in your group.
For sanitization with serial-level certificates, see our data destruction services.
