Companies in Dubai, Abu Dhabi and the UAE free zones (DMCC, DIFC, ADGM, JAFZA and others) address European customers in many sectors: real estate marketed to buyers in Germany, tourism and hospitality, trading and e-commerce, fintech and crypto services, consulting and recruitment. English is the business language, and German-language landing pages for property investors or travellers are common. Where a UAE company has no establishment in the EU and targets people there, Art. 27 GDPR requires an EU representative. Kanzlei Matutis, a German law firm specialised in data protection, acts as EU representative for UAE companies for 350 EUR per year.
Does a company from the United Arab Emirates need an EU representative?
Yes, if it has no establishment in the EU and its processing of personal data relates to offering goods or services to people in the EU or to monitoring their behaviour there (Art. 3(2) in conjunction with Art. 27(1) GDPR). Examples: a Dubai real estate brokerage with a German-language website and lead forms aimed at investors in Germany and Austria; a DMCC trading company running an EU web shop with EUR prices; a DIFC fintech offering accounts or investment products to residents of EU Member States; a Dubai tourism operator remarketing to website visitors from the EU. A UAE company that already has a subsidiary, branch or office in an EU Member State does not need a representative; that EU entity is the point of contact. The exceptions of Art. 27(2) GDPR (occasional, low-risk processing without large-scale sensitive data; public authorities) are narrow and rarely apply to a business that actively markets to the EU. The full criteria are explained on the page What is the legal situation?.
UAE data protection law (PDPL, DIFC, ADGM) and the GDPR
The UAE has three parallel regimes: the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the DIFC Data Protection Law (DIFC Law No. 5 of 2020) for companies in the Dubai International Financial Centre, and the ADGM Data Protection Regulations 2021 for Abu Dhabi Global Market. The DIFC and ADGM laws are modelled on the GDPR, which leads some free-zone companies to assume they are “GDPR-compliant” and therefore exempt from EU rules. They are not: none of the UAE regimes replaces the GDPR for EU-related processing, and there is no EU adequacy decision for the UAE, the DIFC or the ADGM under Art. 45 GDPR. Transfers from the EU to the UAE require standard contractual clauses or another Art. 46 GDPR safeguard. A UAE company offering goods or services to people in the EU falls under Art. 3(2) GDPR and needs an EU representative under Art. 27 GDPR.
What we do as EU representative for UAE companies
Rechtsanwaltskanzlei Matutis is a German law firm in Potsdam, near Berlin, specialised in data protection law. Under a written mandate pursuant to Art. 27(1) GDPR we act as your point of contact in the EU for all supervisory authorities of the Member States and for data subjects. Letters and emails addressed to us are checked, scanned and forwarded to your contact person without undue delay; we point out deadlines, such as the one-month period for data subject requests under Art. 12(3) GDPR. With a time difference of two to three hours, our working days largely overlap, so forwarded mail can be discussed the same day. Please note that our office is closed on Saturday and Sunday, which differs from the UAE working week. We communicate in English and German. We do not replace your Data Protection Officer and do not take over your compliance decisions; the difference is explained on the page EU representative vs. Data Protection Officer.
Cost for companies from the United Arab Emirates
The annual flat fee is 350 EUR. Because the service is provided by a German law firm to a business customer outside Germany, German VAT is not charged (reverse charge), so net equals gross. We invoice in EUR; payment by international transfer or by credit card or PayPal is possible. Please instruct your bank so that the full EUR amount is credited. Forwarding of scanned mail by email is included; postal forwarding of originals is charged at 2 EUR per item plus postage. Full details: What does it cost and what is included?
Next step
Send us your company name, website and a short description of your activities in the EU via the inquiry form. We confirm whether a representative is required in your case and send you the contract and written mandate. The complete process is described on the page How to appoint an EU GDPR representative. Other countries: EU representative by country.