UAE Law and Practice Contributed by: Saifullah Khan and Saeed Hasan Khan, Bizilance Legal Consultants
• ensuring secure IoT services; • addressing reasonable demands for IoT services; • promoting continuous innovation in IoT; • efficiently managing limited resources; • safeguarding the rights and interests of IoT users; and • offering transparency to facilitate IoT market growth. Obligations Any service provider providing IoT is under an obliga - tion to follow UAE telecommunications laws, regula - tions and the IoT policy. The IoT service provider has to register with the TDRA and obtain an IoT service provider registration certificate. IoT service providers need to have a local presence or must appoint a rep - resentative to have a point of contact with the TDRA. Service providers must ensure that the service they provide is adequate and reliable. For personal data processing and storage, the IoT service provider must follow the principles of purpose limitation, data minimisation and storage limitation. Secret, sensitive and confidential data of individuals and businesses must be stored within the UAE. However, it can be stored outside the country when such data is afforded adequate or equivalent security. Secret, sensitive and confidential data of the government must remain in the UAE. The service provider has to use encryption standards. Data processors/service providers must establish technical measures to enable the inspec - tion of stored data. IoT services in the UAE are also regulated by Federal Decree Law No 3 of 2023 (the “Telecommunications Law”), under which different penalties apply for contraventions of the law. Defi - ance of or non-compliance with the IoT policy by IoT service providers or users shall be taken as a breach of the UAE Telecommunications Law, and may be penalised by the TDRA. There is no law similar or identical to that of the EU Data Act. 3.2 Interaction of Data Regulation and Data Protection The Federal Law, DIFC Law, and ADGM Regulations recognise the following legal bases for the processing of personal data:
• Data Subject Consent: Personal data may be pro - cessed when a data subject gives its consent. • Performance of Contract: Personal data may be collected when it is essential for the performance of a contract. • Compliance With Legal Obligations: Personal data may be processed when such processing is neces - sary for legal compliance purposes. • Protection of Vital Interests: Personal data may be processed when its processing is required for the protection of the vital interests of the data subjects. • For Public Tasks: Personal data processing may be carried out when such processing is essential for the performance of a task vested in a public authority. • Legitimate Interests: Personal data may be pro - cessed when the processing is necessary for the legitimate interests of the controller or a third party. UAE data privacy laws protect the confidentiality of personal data by requiring organisations that collect or use data to put in place proper technical and organi - sational safeguards. These safeguards are meant to prevent personal data from being accessed, shared, changed, or lost without authorisation. Under the fed - eral Personal Data Protection Law, as well as the DIFC and ADGM frameworks, personal data must be kept secure at all stages of its use, including when it is col - lected, stored, shared, and eventually deleted. These laws do not address the IP protection of non- personal data. 3.3 Rights and Obligations Under Applicable Data Regulation
Please see 1.2 Rights and Obligations . 3.4 Regulators and Enforcement Please see 1.7 Regulators .
4. Sectoral Topics 4.1 Use of Cookies
While there is no specific law regulating the use of cookies in the processing of personal data, existing personal data protection laws apply to their collection and use. Consent must be explicitly obtained from
535 CHAMBERS.COM
Powered by FlippingBook