Your UAE customer has sent you an ESG questionnaire. Here is what the law requires of them — and what they need from you.

The UAE Climate Change Law imposes mandatory, legally enforceable emissions measurement and reporting obligations on entities whose operations release greenhouse gases. This is not a voluntary framework — it carries direct financial penalties. Large private companies in the UAE increasingly operate within global supply chains that impose their own ESG requirements, and the Climate Change Law creates a domestic legal foundation that reinforces those supply chain demands.

The Dubai Financial Market and Abu Dhabi Securities Exchange have both introduced mandatory ESG disclosure requirements for listed companies. Reports must be published annually and cover environmental, social, and governance metrics. Listed companies are required to assess and disclose their supply chain ESG risks as part of these obligations — which flows directly to their suppliers.

The UAE's Net Zero by 2050 commitment is driving a progressive expansion of mandatory sustainability requirements across the economy. The Securities and Commodities Authority (SCA) has issued ESG disclosure guidelines for listed companies, and the framework is expected to extend to larger private companies and their supply chains as the regulatory architecture matures. Companies that build their ESG response capability now will be well positioned as requirements expand.

UAE companies that supply European buyers are already subject to ESG questionnaires driven by the EU Corporate Sustainability Reporting Directive and the incoming Corporate Sustainability Due Diligence Directive. European buyers are legally required to assess their supply chains — including suppliers based in the UAE. This is the most immediate source of ESG questionnaires for many UAE SME suppliers.

The UAE Federal PDPL requires data controllers to notify the UAE Data Office within 72 hours of becoming aware of a personal data breach that is likely to result in harm to data subjects. Affected individuals must also be notified without undue delay. The law applies to all entities processing personal data in the UAE and to entities outside the UAE processing data of UAE residents. Penalties reach AED 5 million (approx. USD 1.36 million) for first offences, doubling for repeat violations. Free Zone entities operate under separate but equivalent regimes: DIFC Data Protection Law 2020 requires breach notification within 72 hours; ADGM Data Protection Regulations 2021 also require 72-hour notification. The UAE National Cybersecurity Council (NCC) mandates incident reporting for critical infrastructure operators under the National Cybersecurity Strategy. Suppliers processing UAE customer data must maintain an incident response plan aligned to the 72-hour notification window and document their breach response procedures.