UAE Law and Practice Contributed by: Saifullah Khan and Saeed Hasan Khan, Bizilance Legal Consultants
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws The Constitution of the United Arab Emirates (UAE) provides that safety and security for all citizens shall be the pillars of society. The Constitution further pro - vides that freedom of correspondence by post, tel - egraph or other means of communication, and the secrecy thereof, is guaranteed in accordance with the law, and that dwellings are inviolable. These constitu - tional provisions serve as the foundational guidelines for respecting privacy. The statutory regime concerning data protection is chiefly found in the following laws/regulations. Federal Decree Law No 45 of 2021 on personal data protection (the “UAE Law”) The UAE Law is a federal-level law applicable across the UAE, except for the following: • governmental data; • government authorities that control and process personal data; • security and judicial authorities; • health-related personal data; • banking and credit personal data; and • companies and organisations incorporated Dubai International Financial Centre (DIFC) Law No 5 of 2020 (the “DIFC Law”) The DIFC is a free zone, and the DIFC Law applies in the jurisdiction of the DIFC to the processing of personal data, regardless of the place of incorpora - tion of the controller or processor. Similarly, it is also applicable to controllers and processors incorporated in the DIFC, irrespective of their processing of per - sonal data. The Abu Dhabi Global Market (ADGM) Data Protection Regulations 2021 (the “ADGM Regulations”) The ADGM is a free zone, and the ADGM Regulations apply in the context of the establishment of a control - ler or a processor in the ADGM.
Apart from the above, sector-specific regulations gov - ern data protection in their respective sectors, as fol - lows: • Federal Decree-Law No 6/2025 Concerning the Central Bank and the Regulation of Financial Insti - tutions, Activities, and Insurance Business (govern - ing data protection of customers of banks); • Federal Law No 3 of 2003 (concerning telecommu - nications) governing data protection of telecoms consumers; and • Federal Law No 2 of 2019 (concerning use of infor - mation and communication technology in health fields) governing confidentiality of patients’ infor - mation. The above-mentioned laws/regulations provide for matters related to offences, penalties and enforce - ment in their respective sphere. In the UAE, Federal Decree-Law No 45 of 2021 (PDPL) forms the main national data protection law. Alongside this, the DIFC and ADGM have their own data pro - tection regimes that apply within their respective free zones. While separate, these frameworks are broadly aligned with each other and with GDPR principles, reflecting a shared commitment to high standards of personal data protection. The DIFC and ADGM laws also set out more detailed, zone-specific require - ments, which are enforced by their own regulatory authorities. The sector-specific regulations mentioned above reg - ulate the processing of personal data in their respec - tive spheres while complementing the personal data protection laws in the UAE. 1.2 Rights and Obligations The data privacy laws applicable across the UAE based on the set of principles for the processing of the personal data, which are as follows: • Lawfulness: Personal data must be processed in accordance with applicable legal requirements. • Fairness and Transparency: Processing must be fair to individuals and carried out in a transparent manner.
530 CHAMBERS.COM
Powered by FlippingBook