UAE Law and Practice Contributed by: Amir Alkhaja, Gerry Rogers, Daria Selivanova and Danila Kriuchkov, Habib Al Mulla & Partners
is complemented by sector-specific legislation and free-zone regimes such as DIFC and ADGM. Although PDPL enforcement is pending acti - vation of Executive Regulations, penalties will range from AED50,000 to AED5 million, includ - ing administrative sanctions and remediation orders by the UAE Data Office. The PDPL closely mirrors the GDPR, requiring lawful, fair and transparent data processing, purpose limitation, data minimisation, accuracy, storage limitation and security measures. Data subjects are granted rights to: • access, rectify, delete, restrict processing and receive a copy of their data; • object to automated processing; • withdraw consent; and • lodge complaints with the UAE Data Office, subject to a 30-day resolution timeline. The law empowers the UAE Data Office to issue Executive Regulations, which are essential for operationalising key obligations and enforce - ment mechanisms. Although the PDPL entered into force on 2 January 2022, enforcement was to follow after issuance of the Regulations, but full implementation has been delayed until these Regulations are formally released. This delay has resulted in a grey zone of limited formal enforce - ment. 8.2 Geographical Scope PDPL establishes broad territorial and extrater - ritorial jurisdiction. The law applies to: • processing conducted within the UAE, regardless of the origin of the controller or processor, whether domestic or foreign; and • processing outside the UAE, where it involves personal data of individuals residing or
conducting business in the UAE, even if the controller or processor is established abroad. Thus, a foreign company collecting or process - ing data from UAE-based individuals must com - ply with the PDPL, even with no physical pres - ence in the UAE. The DIFC and ADGM Regulations maintain GDPR‑level regimes. These apply to all con - trollers and processors operating within those zones, including overseas entities that process data pertaining to those jurisdictions. 8.3 Role and Authority of the Data Protection Agency The UAE Data Office, which is formally estab - lished but is not yet fully operational in enforce - ment, will serve as the UAE’s federal data pro - tection authority. It will enforce the PDPL and oversees data protection compliance across the UAE. The UAE Data Office is empowered to: • draft and review policies, Executive Regula - tions, guidelines and codes of practice imple - menting the PDPL; • issue binding decisions on administrative matters such as breach notification stand - ards, adequacy and standard contractual clauses for international transfers, and data subject rights; • receive and resolve complaints and griev - ances from data subjects; • supervise compliance, including conducting audits, investigations and site inspections; and • impose administrative sanctions, issue cor - rective/remediation orders, and refer cases for criminal prosecution when warranted.
841 CHAMBERS.COM
Powered by FlippingBook