UAE Trends and Developments Contributed by: Nadim Bardawil, Hala Harb and Hebah Innah, BSA LAW
BSA LAW Level 6 Building 3 Dubai International Financial Centre (DIFC) The Gate District PO Box 262 Dubai
United Arab Emirates Tel: +971 452 855 55 Email: info@bsalaw.com Web: bsalaw.com
An Evolving Privacy Landscape The UAE has been steadily building out its data pro - tection framework, and the most significant develop - ments have come from the financial free zones, DIFC and ADGM. For businesses operating in or from the UAE, com - pliance is rarely a matter of following a single set of rules. Organisations typically need to navigate over - lapping obligations that shift depending on where they are based, what sector they operate in, and how per - sonal data flows between the mainland and the free zones. In this article, we will walk through the current state of the UAE’s data protection landscape, draw out the key differences between the mainland and free zone regimes, and outline the practical compliance risks that surface in the absence of a fully harmonised enforcement framework. UAE Mainland Data Protection Law and Enforcement The UAE’s onshore data protection framework is anchored by Federal Decree-Law No 45 of 2021 on the Protection of Personal Data (PDPL). It applies broadly to the processing of personal data of individu - als residing in the UAE, with limited exemptions, and can extend beyond UAE borders in certain circum - stances. One important carve-out: entities in the DIFC and ADGM are expressly excluded, as they operate under their own standalone data protection regimes.
Despite its broad scope, the PDPL is still very much a work in progress. The Implementing Regulations, intended to clarify key aspects of the law, have yet to be issued. The practical effect has been limited enforcement activity and a cautious regulatory stance, with most organisations driving their own compli - ance through internal risk assessments rather than in response to regulatory action. On the supervisory side, Federal Decree-Law No 44 of 2021 established the Emirates Data Office as the primary authority responsible for overseeing data pro - tection on the mainland. However, the Data Office has not yet become fully operational. The law provides that, during its initial two-year transitional period, the Telecommunications Regulatory Authority (TDRA) and the Digital Government are to provide administrative and logistical support. In practice, the TDRA has been observed to act as a point of contact for data protec - tion-related inquiries. Parallel Data Protection Obligations Under Other Laws in the UAE The fact that the PDPL has yet to be fully operation - alised does not, in itself, reduce the scope of data protection obligations that organisations in the UAE must already satisfy. Notwithstanding the PDPL’s limited enforceability to date, a number of sector- specific laws and regulations already impose binding data protection and confidentiality obligations across the UAE. Taken together, these instruments establish that robust data protection compliance is already a
539 CHAMBERS.COM
Powered by FlippingBook