UAE Law and Practice Contributed by: Saifullah Khan and Saeed Hasan Khan, Bizilance Legal Consultants
• when processing relates to personal data that has been deliberately made public by the data subject; • when processing is necessary for the establish - ment, exercise, or defence of legal claims; and • when processing is required to comply with a spe - cific legal obligation applicable to the controller. Under the DIFC Law and the ADGM Regulations, criminal convictions are also included in the definition of the special categories of personal data. The Federal Decree Law, DIFC Law and the ADGM Regulations are silent on the matter of the processing of personal data relating to minors. Federal Decree Law No 26 of 2025 on Child Digital Safety has been enacted to establish a legal frame - work for safeguarding children in the digital environ - ment. The law aims to protect children from online risks and harmful digital content that may adversely affect their wellbeing, while at the same time ensur - ing their right to access digital content that is safe, appropriate, and age-appropriate. This law will be implemented after a one-year grace period. 1.4 Processing of Personal Data for Research and Development Purposes ADGM Regulations Processing for research purposes is allowed subject to the following conditions, irrespective of the particu - lar circumstances: • The controller must ensure, through appropriate technical and organisational measures, that per - sonal data, including special categories of personal data, are anonymised and pseudonymised in a way that prevents re-identification. The processing for research purposes must not cause substantial damage to a data subject. • The processing for research purposes is only allowed if the purpose for processing includes medical research, and it has received the approval of a public authority and research institution. 1.5 Processing of Personal Data in the Context of Artificial Intelligence Through its Regulation 10, the DIFC has enacted amendments to its data protection regulations, aimed at overseeing the use of autonomous and semi-auton -
omous systems, particularly those driven by artificial intelligence (AI) and machines. The regulations apply to AI-driven systems and processes used within the DIFC’s jurisdiction – either autonomous systems or semi-autonomous systems. These regulations emphasise: • the ethical use of systems; • that the processing must be transparent; and • that users and data subjects must be informed about the role of AI in decisions that affect them. Although neither the ADGM nor the DIFC has enacted laws specifically dedicated to AI, both have incorpo - rated AI-related considerations into their existing data protection and governance frameworks. These provi - sions ensure that AI applications in financial services are used responsibly, ethically and in accordance with data protection standards. 1.6 Data Breach Requirement The data controller, in the event of a personal data breach, is required to notify the relevant competent authority – ie, the Data Office (Federal Decree Law)/ Commissioner (DIFC Data Protection Law)/Commis - sioner of Data Protection (ADGM Regulations), where the breach is likely to pose a risk to the privacy, confi - dentiality, security, or rights of data subjects. The data processor must notify the controller without undue delay upon becoming aware of such a breach. Notification timelines differ across UAE jurisdictions: • Under UAE Federal Law, the breach must be reported immediately. • Under the DIFC Data Protection Law, notification must be made without undue delay. • risk assessment and mitigation; • accountability and oversight; • Under the ADGM Data Protection Regulations, notification must be made within 72 hours of becoming aware of the breach. Where notification is not made within this timeframe, the controller must provide reasons for the delay. The breach notification must include, at a minimum: • a description of the nature of the breach;
532 CHAMBERS.COM
Powered by FlippingBook