The Strategic Guide to Data Regulation Compliance Advisory in the UAE

A business handling personal data in the UAE is not dealing with one regime. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL) sets the position onshore. The Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM) are separate common-law jurisdictions, each with its own data protection legislation and its own regulator. A group with a mainland trading company, a DIFC holding entity and staff sitting in an ADGM office is subject to all three, and the differences between them are practical rather than theoretical.

This guide sets out which regime applies to what, the obligations that any of them will expect to see evidenced, how cross-border transfers and group data sharing are handled, and what to put in contracts with vendors. It is written for the person who has to produce the records, not for the person who has to describe the policy.

Which regime applies

Start with a map, not a policy. For each entity in the group, identify where it is registered, where its customers and employees are, where the data physically sits, and which systems are shared across entities. Onshore entities look to the PDPL. Entities established in the DIFC apply the DIFC's data protection law; entities in the ADGM apply the ADGM's data protection regulations. Both centres draw on the concepts familiar from European data protection law — controller and processor roles, a lawful basis for processing, purpose limitation, data minimisation, individual rights and accountability — while differing in detail and in enforcement practice.

Sector rules sit on top. Financial services, healthcare and telecommunications each carry additional requirements on where records are held and how long they are kept, and a business regulated by the DFSA or the FSRA will find data obligations in its regulatory rulebook as well as in the data protection legislation. Getting data protection uae advice at group level, rather than entity by entity, avoids the common outcome of three inconsistent privacy notices for one customer journey.

What compliance actually requires

Whichever regime applies, a regulator asking questions will want to see documents, not intentions. The core set is the same across the three.

• A record of processing. What personal data is held, for which purpose, on what lawful basis, where it is stored, who it is shared with, and how long it is kept. Without this, nothing else can be answered.
• Privacy notices that match what the business actually does, in the languages its customers use, given at the point data is collected.
• A lawful basis for each processing activity, recorded. Where consent is relied on, evidence of how it was obtained and how it can be withdrawn.
• A process for individual rights requests — access, correction, deletion, objection — with an owner, a log, and a response within the period the applicable law allows.
• Assessments for higher-risk processing, such as large-scale profiling, monitoring of employees, or processing of sensitive categories of data.
• A breach response procedure naming who decides whether the incident is notifiable, who notifies the regulator and affected individuals, and within what period the applicable regime requires. Decide this before an incident, not during one.
• A data protection officer where the applicable regime requires one, with the independence and reporting line that role needs.
• Retention and deletion schedules that are applied to live systems and backups rather than recorded in a policy nobody executes.

Most data regulation compliance advisory work in the UAE begins with the gap between the record of processing a business believes it has and the systems it actually runs.

Cross-border transfers and sharing within a group

Transfers out of the jurisdiction are where multi-entity groups most often come unstuck. Each of the three regimes permits transfers to jurisdictions recognised as providing an adequate level of protection, and otherwise requires an appropriate safeguard — typically contractual terms binding the recipient, or an intra-group instrument — or reliance on a narrow exception. The practical requirements are the same in each case: identify the recipient, identify the mechanism relied on, and be able to produce the signed document.

Sharing between affiliates is a transfer. A mainland subsidiary sending employee records to a DIFC parent, or a shared customer relationship system hosted outside the UAE, needs the same treatment as a transfer to an unrelated third party. Intra-group agreements are frequently drafted, signed and then contradicted by how the systems are configured; check the configuration.

Vendors, processors and new technology

A business remains answerable for personal data processed on its behalf. Contracts with cloud providers, payroll bureaux, marketing agencies and IT support should specify the purpose and duration of processing, prohibit use for the vendor's own purposes, require security measures appropriate to the data, control the appointment of sub-processors, require prompt notification of incidents, oblige the vendor to assist with individual rights requests, and set out what happens to the data at the end of the contract. Where the vendor's standard terms do not include these, that is a negotiating point rather than a formality.

New technology raises the same questions in sharper form. Distributed ledger systems sit awkwardly with rights of correction and deletion, and businesses combining a token or payments offering with customer data need crypto regulation compliance advisory and data advice in the same conversation rather than in sequence. The same applies to automated decision-making and to any system trained on customer records.

Practical steps for UAE businesses

• Map the group first: entities, jurisdictions, systems, data locations. Everything else depends on this document.
• Identify one accountable owner for data protection in each entity, with a line to the board.
• Reconcile privacy notices with the record of processing, and fix whichever is wrong.
• Test the breach procedure with a rehearsal before you need it, including who contacts the regulator.
• Review vendor contracts on renewal against the processor terms above.
• Re-run the assessment when the business changes — a new market, a new product, a new supplier, an acquisition.

Treated this way, data regulation compliance stops being an annual document exercise and becomes a set of records the business can produce on request.

Related Services: Explore our data regulation compliance advisory and crypto regulation compliance advisory services for practical legal support in this area.

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.

Nour Attorneys Team

Additional Resources

Explore more of our insights on related topics:

• The Strategic Guide to Crypto Regulation Compliance Advisory in the UAE
• Resolving Data Regulation Compliance Advisory Disputes Effectively
• Common Data Regulation Compliance Advisory Mistakes to Avoid in Dubai
• How Proper Data Regulation Compliance Advisory Structuring Saves Millions