UAE Trends and Developments Contributed by: Nadim Bardawil, Hala Harb and Hebah Innah, BSA LAW
tions. Most significantly, data subjects can now bring claims directly before the DIFC courts without first needing to engage the DIFC Commissioner of Data Protection, a procedural requirement that had, in prac - tice, acted as a barrier to litigation. The territorial reach of the DIFC DP Law has also been clarified. It now applies not only to entities incorpo - rated in the DIFC, but to any controller or processor, including those based outside the DIFC, that process - es personal data of individuals residing or working there, whether directly or through third-party arrange - ments. Separately, the rules around sharing personal data with third-country authorities have been tightened, with controllers now required to verify that any such request is valid and proportionate before any disclo - sure is made. Taken together, these changes reflect a regulatory environment that is deliberately designed to stay ahead of, rather than simply respond to, the challenges that organisations face. ADGM: Targeted Reforms and Substantial Public Interest Processing Data protection in the ADGM is governed by the ADGM Data Protection Regulations 2021 (the “ADGM DP Regulations”). In September 2025, the ADGM Registration Authority introduced the Data Protection Regulations (Substantial Public Interest Conditions) Rules 2025 (the “ADGM Rules”), a focused refinement addressing a practical gap in the existing framework. While consent remains the default basis for process - ing special categories of personal data, including health, biometric, and genetic data, there are circum - stances in which obtaining it is neither possible nor appropriate. The ADGM Rules draw the boundaries of those circumstances with care, concentrating on two areas where the tension between data protection and broader public interest is most acute: insurance and the safeguarding of vulnerable individuals. In the insurance context, the ADGM Rules permit the processing of sensitive personal data where it is nec - essary for underwriting, policy administration, claims handling, or compliance with legal obligations. Where the processing does not directly concern the individ -
ual, the controller must demonstrate that obtaining consent was not reasonably practicable and that the individual has not actively refused it. Notably, silence does not constitute refusal. This enables insurers to act promptly where needed, while preserving consent as the default position. The safeguarding provisions operate on a similar basis but in a context where the stakes are higher. Sensi - tive data may be processed without consent for the purpose of protecting children and vulnerable adults who are unable to safeguard themselves, particularly where seeking consent would itself place the individ - ual at greater risk. This provides the necessary legal basis for timely disclosures to relevant authorities in cases of neglect, abuse, or exploitation. Cross-Border Transfers From the Mainland and Best Practice in the Absence of Formal Mechanisms Businesses operating in or from the UAE are frequent - ly subject to multiple and overlapping data protection regimes, depending on their place of establishment, the location of customers or employees, and the structure of their operations. For many organisations, particularly those with group entities spanning the mainland and financial free zones, effective compli - ance requires a jurisdiction-sensitive approach, rather than reliance on a single, uniform framework. In practice, organisations often overlook that the trans - fer of personal data between the UAE mainland and financial free zones such as the DIFC and ADGM (and vice versa) is treated as a cross-border data trans - fer, notwithstanding that all jurisdictions are located within the UAE. This is because the mainland, DIFC, and ADGM operate as separate legal jurisdictions with distinct data protection regimes. As a result, trans - fers from the mainland to the DIFC or ADGM must satisfy the cross-border transfer requirements of the receiving jurisdiction’s data protection law, and may trigger transfer assessments, contractual safeguards, or regulatory scrutiny, particularly where regulated or sensitive data is involved. While the PDPL does contemplate mechanisms for managing such transfers, the Implementing Regula - tions necessary to give full effect to these provisions
541 CHAMBERS.COM
Powered by FlippingBook