Resolving Data Regulation Compliance Advisory Disputes Effectively

In the rapidly evolving landscape of data regulation compliance within the UAE, disputes arising from advisory services present complex challenges that require a precise, strategic approach. Entities operatin

By Nour Attorneys / 23 August 2026

Reviewed by Mohamed Noureldin, Founder, Managing Partner & Senior Legal Consultant

Two very different things get filed under "a data compliance dispute", and treating them as one is why so many of them are handled badly. The first is a dispute with a regulator or a data subject: someone says the business processed personal data it should not have. The second is a dispute with the consultant, law firm or compliance provider who advised on that processing: the business says it was told the wrong thing. They run in different forums, they turn on different evidence, and the second one is usually decided by a contract nobody read carefully at the outset.

First, establish which regime the data sits under

The UAE has more than one data protection law operating at once. Federal Decree-Law No. 45 of 2021 on the protection of personal data applies at federal level. DIFC and ADGM each maintain their own data protection regime, administered by their own supervisory offices rather than by the federal authority, and each has its own registration, breach-notification and data-subject-rights machinery.

For a group with an onshore operating company, a DIFC holding entity and staff records shared between them, the first question in any dispute is which regime governs the processing complained of. That is frequently unanswered because nobody mapped it. A data inventory that records, for each material processing activity, which entity is the controller, where the data is held and which regime applies, takes a few weeks to build and saves months of argument later.

Related: see our data protection uae practice and our data regulation compliance advisory service.

Disputes with a regulator or a data subject

These generally begin as a complaint rather than a claim. Under the federal law the route runs through the supervisory authority, which examines the complaint and can require the business to explain what it did. In DIFC and ADGM, the respective data protection offices perform that function within their own centres, and their courts are available where a matter proceeds beyond the regulator.

What decides these matters is documentation that already existed before the complaint. The record of processing, the lawful basis relied on for the activity in question, the consent or notice given to the individual, the contract with the processor, and the internal log of what happened and when. A business that assembles these after receiving a complaint is visibly assembling them after receiving a complaint. There is very little advocacy can do about a missing record.

Where the incident is a breach, the sequence matters as much as the substance: contain, establish what data and whose, notify in accordance with the applicable regime, and write down each decision and the time it was taken. Reconstructing a timeline months later, from recollection, is the position nobody wants to be in.

Related: for regulated-sector overlap, see our aml compliance uae and crypto regulation compliance advisory work.

Disputes with the adviser

The second category is a professional services dispute, and it turns almost entirely on scope. The recurring pattern is a business that engaged a provider for a fixed piece of work, a gap analysis or a set of policies, and then assumed it had bought an ongoing compliance function. When something goes wrong, the provider points to the engagement letter and the business points to the expectation. In most of these files, the engagement letter wins.

The provisions that decide the outcome are worth naming, because they are the ones to negotiate before the work starts rather than after it fails:

Scope and deliverables. Which regimes were assessed, which entities, which processing activities, and as at what date.
Ongoing monitoring. Whether the provider is retained to track regulatory change and tell the client about it, or whether the advice was a snapshot. This should be stated one way or the other; silence produces the argument.
Reliance on client information. Advice given on the basis of what the client described is only as good as that description. Both sides benefit from recording what was provided.
Liability and indemnities. A cap set without reference to the value of the data involved is a number chosen at random.
Escalation and forum. Where a dispute is heard, and after which steps.

Choosing a forum that actually works

Arbitration suits these disputes reasonably well: they are confidential, which matters when the subject matter is a data incident, and arbitrators with the relevant background can be appointed. Since Dubai Decree No. 34 of 2021 abolished the DIFC-LCIA and transferred its caseload to DIAC, parties reviewing older templates should check that the institution they named still exists in the form the clause assumes. DIFC remains available as a seat, and an arbitration seated there is a different thing from an arbitration administered by a body located there. Clauses that confuse the two produce a preliminary fight before anyone reaches the merits.

Where the counterparty is a DIFC or ADGM entity, that centre's own courts are the natural default and there is rarely a reason to contract away from them. Whatever the choice, a short escalation ladder, with a defined period for negotiation and a named individual on each side, resolves more of these disputes than the dispute clause itself does.

The practical point

Almost every advisory dispute in this field is a documentation dispute in disguise. The business that can produce its data map, its processing records, its incident log and an engagement letter that says what the adviser was actually retained to do is in a strong position in both categories. The business that cannot is negotiating from whatever the other side has kept.

Related Services: explore our data regulation compliance advisory services for practical support in this area.

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.

Nour Attorneys Team