UAE Trends and Developments Contributed by: Nadim Bardawil, Hala Harb and Hebah Innah, BSA LAW
legal necessity, not a matter to be deferred pending full operationalisation of the PDPL. The Cybercrime Law (Federal Decree Law No 34/2021) represents perhaps the broadest existing framework. It criminalises the unauthorised access, collection, processing, disclosure, or misuse of per - sonal data through information technology systems, with enhanced penalties where the data in question relates to sensitive categories, including medical records, banking information, or electronic payment data. The unauthorised disclosure of confidential information obtained through employment or a pro - fessional capacity also constitutes an offence under this law. In the public sector, the Information Security Reso - lution (Cabinet Resolution No 21 of 2013) imposes mandatory information security obligations on federal government entities, requiring the protection of per - sonal and confidential data through measures includ - ing access controls, encryption, data classification, and restrictions on external storage. Within the telecommunications sector, the TRA Con - sumer Policy requires service providers to limit the processing of subscriber data to purposes directly related to the provision of telecom services. Prior con - sent must be obtained before personal information is shared with affiliates or third parties, and consumers are afforded the right to access their data and to pre - vent its unauthorised disclosure. Under the Healthcare ICT Law (Federal Law No 2 of 2019), health information must be maintained in con - fidence, stored within the UAE absent specific regula - tory approval, and used exclusively for health-related purposes. These requirements are further reinforced within Dubai Healthcare City by the DHCA Health Data Protection Regulation No 7 of 2013, which establish - es a comprehensive regime governing the collection, use, storage, disclosure, transfer, and retention of patient health information. Licensed financial institutions operating under the CBUAE Consumer Protection Regulation and Stand - ards are similarly required to protect consumers’ per - sonal and financial data through confidentiality meas -
ures and appropriate security safeguards, to disclose the basis on which personal data is collected and used, and to prevent unauthorised access or exces - sive processing. The Penal Code (Federal Law 21 of 2021) further rein - forces the criminal dimension of data protection in the UAE. Under Article 431, it is an offence to intercept or eavesdrop on a private conversation, or to capture or transmit images of a person obtained in a private setting, in each case in the absence of the data sub - ject’s consent. Taken together, these provisions make clear that organisations operating in the UAE are already sub - ject to a substantive body of binding data protection obligations. DIFC: Enhanced Enforcement and Private Rights of Action Data protection in the DIFC is governed by the Data Protection Law, DIFC Law No 5 of 2020 (the “DIFC DP Law”), which sets out a comprehensive frame - work regulating the collection, handling, and use of personal data, together with enforceable rights and remedies for individuals. What sets the DIFC apart, however, is not just the framework itself. It is the pace and ambition with which it is evolving. The DIFC has demonstrated a clear appetite for keep - ing its regulatory infrastructure ahead of technological change. Perhaps the most notable example is Regula - tion 10, enacted in September 2023, which places the DIFC among the first subnational jurisdictions globally to specifically regulate AI and autonomous systems in the context of personal data processing. Regula - tion 10 places the burden of compliance squarely on “deployers” and “operators”, the entities that authorise or benefit from AI systems, requiring them to ensure that personal data is processed transpar - ently, fairly, and ethically, with clear accountability built into the design of these systems. This proves DIFC’s efforts to ensure that the data protection regulations are evolving alongside the ever-changing technology. In July 2025, amendments to the DIFC DP Law materi - ally strengthened the enforcement landscape in ways that have direct practical implications for organisa -
540 CHAMBERS.COM
Powered by FlippingBook