Securiti leads GigaOm's DSPM Vendor Evaluation with top ratings across technical capabilities & business value.

View

New Dubai Data Protection Law

Published July 18, 2023
Contributors

Anas Baig

Product Marketing Manager at Securiti

Maria Khan

Data Privacy Legal Manager at Securiti

FIP, CIPT, CIPM, CIPP/E

Listen to the content

This post is also available in: Brazilian Portuguese

In this era where data privacy regulations are sprouting up almost daily, another city has taken data privacy rights into consideration and devised a law that resembles the likes of GDPR. In 2004, Dubai’s International Financial Centre (DIFC), a world-class financial hub and a free zone was established and a data protection law was passed in 2007. This law has now been built upon and updated to include concepts from the EU’s GDPR as well as other significant data protection regulations around the world, for example, the California Consumer Privacy Act (CCPA).

This initiative by Dubai could mean that there is a National level law in the works (experts suggest that it is already being constructed) for the UAE. In the event that national law is published, it is believed that it will be compatible with the DIFC’s Updated Law, which certainly raises the bar significantly for similar legislations across the region.

The law was set to go into effect on July 1st, 2020, but given the Covid-19 pandemic, enforcing bodies have given organizations a three-month grace period, up until October  2020 to transition to this new law. Experts suggest that organizations that do not already have a GDPR  framework set in place will struggle to make this transition in a mere three months time.

Let’s explore the impact of this new law and what organizations will have to do in order to stay compliant with this law, ahead of 1st October 2020.

Key Changes with Regards to GDPR

The New DP Law is mirrored against the GDPR are there are certain key changes made in the law that reflect that of the GDPR.

Compliance Requirements

The New DP Law will apply to organizations that

  • Work within the DIFC, regardless of where processing takes place
  • Situated elsewhere but are processing personal data in the DIFC as part of stable arrangements (this includes those who transfer data out of the DIFC)

Accountability and Record-Keeping Requirements

Controllers need to put programs in place which demonstrate compliance with the New DP Law, similar to the GDPR’s accountability requirements. It also needs to keep records of its processing activities. Failure to maintain adequate mechanisms in compliance with the new standards imposed by the New DP Law can lead to fines going up to $50,000 along with injunctions by the DIFC court.

Data Protection Principles

The New DP Law has set requirements for processing data that are largely identical to the data protection principles under the GDPR.

Lawful Bases for Processing

The New DP Law gives organizations the same legal bases for processing personal data as the GDPR. With regard to consent, the New DP Law reflects elements of the GDPR’s standard, this includes stating “the consent be freely given and demonstrated by a clear affirmative act showing an unambiguous indication of consent.”

Data Subject Rights

Data subjects have been provided a huge host of new rights in relation to their personal data. Data controllers and processors are obligated to provide data subjects with information relating to processing and a mechanism to data subjects to exercise their rights with respect to their data or face heavy liabilities. The rights given to data subjects include:

  • Right to withdraw consent
  • Right to notice, right to access
  • Right to rectification and erasure of personal data
  • Right to object to processing
  • Right to restriction of processing
  • Right to data portability
  • Right to object to automated individual decision-making including profiling
  • Right to non-discrimination.

Controllers and Processors face heavy fines (which go up to $100,000 per incident) and are also liable for damages to individual data subjects if they are found to have violated any of these rights.

Data Protection Officer (“DPO”) and Data Protection Impact Assessments (“DPIAs”)

A Data Protection Officer must be appointed to monitor and advise on compliance with the New DP Law where a controller or processor engages in “high-risk processing activities” on a systematic or regular basis, the definition of which includes criteria that are similar, but not identical to, the criteria for appointment of a DPO under the GDPR. The DPO officer will produce annual assessments of the controller’s processing activities.  Additionally, before undertaking high-risk processing activities, a controller must carry out a Data Protection Impact Assessments in order to weigh the risks with the benefits and mitigate any potential risks.

Data Transfers

The New DP Law restricts transfers outside of the DIFC where the Commissioner of Data Protection has determined that the recipient jurisdiction, or a specific sector within the recipient jurisdiction, does not provide an adequate level of data protection to the data subjects whose data is being transferred. Standard Contractual Clauses or Binding Corporate Rules are among the available safeguards that will permit such transfers. A controller and processor should also weigh the risks to a data subject before transferring any data outside of the DFIC to a requesting authority (including a public authority).

Data Breach Notification

Controllers need to notify the Commissioner of Data Protection in case of any data breach that jeopardizes a data subject’s confidentiality, security or privacy. Data subjects must also be notified if the breach is expected to result in a high risk to their security or rights. These notifications need to be sent out as immediately as possible.

Special Category Data

There is a general prohibition on the processing of special category data unless a derogation applies.

Controller-Processor Agreements

Similar to Article 28 of the GDPR (and, to some extent, the requirements of the CCPA), the New DP Law requires controllers to create a legally binding agreement with the processor to whom they are going to disclose the information. This process must be repeated by processors when making agreements with sub-processors. Controllers may only enter into agreements with processors who can provide sufficient assurances that they have the technical and organizational measures to adhere to the requirements set forth by the DP law.

Next steps

With only three months, organizations that do not already have a GDPR framework in place are going to struggle to remain compliant. There are likely a lot of gaps in the current framework that need to be filled. These could include:

  • Creating a Record of Processing Activities
  • Ensuring necessary DPIAs are undertaken
  • Issuing privacy notices, while meeting the requirements under Part 5 of the Updated Law, both in respect of their customers and employees
  • Reviewing supplier arrangements, in order to ensure that a suitable data processing agreement is in place
  • Reviewing any international transfers of personal data and keeping them in line with the updated law
  • Creating and operationalizing a data breach or security incident policy
  • Adequate technical and organizational measures to protect the consumers' personal data withheld by the organization
  • Ensuring that processes are in place which enables data subjects to exercise their data subject rights under the Updated Law.

Filling these gaps and several others through manual tasks will make it virtually impossible to complete ahead of October, 2020. Organizations that are looking for swift and efficient compliance, while still being cost-effective, need to consider automation. With the help of automation, these gaps can be filled with ease and in a short timeframe. In an era where even our washing machines do their job on their own, it is absolutely paramount that organizations automate their operations if they want to see themselves comply with global privacy regulations.


Frequently Asked Questions (FAQs)

The United Arab Emirates (UAE) Federal Decree-Law No. 45 of 2021 on Personal Data Protection (UAE’s PDPL) was enacted on November 28th, 2021. The PDPL 2021 became effective on January 2, 2022. Before this date, the United Arab Emirates did not have an independent federal law specifically focused on data protection.

Dubai, which is one of the emirates in the UAE, has adopted the PDPL, where any company registered in the UAE that collects or processes the data of UAE residents is subject to this new legislation. Additionally, any company not registered in the UAE but processing the data is also subject to this legislation.

The GDPR (General Data Protection Regulation) is a European Union regulation and primarily applies to EU member states and entities that process the personal data of individuals in the EU. Its applicability to entities outside the EU depends on specific circumstances and factors, such as offering goods or services to EU residents.

The United Arab Emirates (UAE) is not a member state of the European Union (EU), and GDPR (General Data Protection Regulation) is an EU regulation. GDPR primarily applies within the EU and to organizations outside the EU that process the personal data of EU residents.

Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox


Share
Videos
View More
Mitigating OWASP Top 10 for LLM Applications 2025
Generative AI (GenAI) has transformed how enterprises operate, scale, and grow. There’s an AI application for every purpose, from increasing employee productivity to streamlining...
View More
Top 6 DSPM Use Cases
With the advent of Generative AI (GenAI), data has become more dynamic. New data is generated faster than ever, transmitted to various systems, applications,...
View More
Colorado Privacy Act (CPA)
What is the Colorado Privacy Act? The CPA is a comprehensive privacy law signed on July 7, 2021. It established new standards for personal...
View More
Securiti for Copilot in SaaS
Accelerate Copilot Adoption Securely & Confidently Organizations are eager to adopt Microsoft 365 Copilot for increased productivity and efficiency. However, security concerns like data...
View More
Top 10 Considerations for Safely Using Unstructured Data with GenAI
A staggering 90% of an organization's data is unstructured. This data is rapidly being used to fuel GenAI applications like chatbots and AI search....
View More
Gencore AI: Building Safe, Enterprise-grade AI Systems in Minutes
As enterprises adopt generative AI, data and AI teams face numerous hurdles: securely connecting unstructured and structured data sources, maintaining proper controls and governance,...
View More
Navigating CPRA: Key Insights for Businesses
What is CPRA? The California Privacy Rights Act (CPRA) is California's state legislation aimed at protecting residents' digital privacy. It became effective on January...
View More
Navigating the Shift: Transitioning to PCI DSS v4.0
What is PCI DSS? PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards to ensure safe processing, storage, and...
View More
Securing Data+AI : Playbook for Trust, Risk, and Security Management (TRiSM)
AI's growing security risks have 48% of global CISOs alarmed. Join this keynote to learn about a practical playbook for enabling AI Trust, Risk,...
AWS Startup Showcase Cybersecurity Governance With Generative AI View More
AWS Startup Showcase Cybersecurity Governance With Generative AI
Balancing Innovation and Governance with Generative AI Generative AI has the potential to disrupt all aspects of business, with powerful new capabilities. However, with...

Spotlight Talks

Spotlight 11:29
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Watch Now View
Spotlight 11:18
Rewiring Real Estate Finance — How Walker & Dunlop Is Giving Its $135B Portfolio a Data-First Refresh
Watch Now View
Spotlight 13:38
Accelerating Miracles — How Sanofi is Embedding AI to Significantly Reduce Drug Development Timelines
Sanofi Thumbnail
Watch Now View
Spotlight 10:35
There’s Been a Material Shift in the Data Center of Gravity
Watch Now View
Spotlight 14:21
AI Governance Is Much More than Technology Risk Mitigation
AI Governance Is Much More than Technology Risk Mitigation
Watch Now View
Spotlight 12:!3
You Can’t Build Pipelines, Warehouses, or AI Platforms Without Business Knowledge
Watch Now View
Spotlight 47:42
Cybersecurity – Where Leaders are Buying, Building, and Partnering
Rehan Jalil
Watch Now View
Spotlight 27:29
Building Safe AI with Databricks and Gencore
Rehan Jalil
Watch Now View
Spotlight 46:02
Building Safe Enterprise AI: A Practical Roadmap
Watch Now View
Spotlight 13:32
Ensuring Solid Governance Is Like Squeezing Jello
Watch Now View
Latest
Simplifying Global Direct Marketing Compliance with Securiti’s Rules Matrix View More
Simplifying Global Direct Marketing Compliance with Securiti’s Rules Matrix
The Challenge of Navigating Global Data Privacy Laws In today’s privacy-first world, navigating data protection laws and direct marketing compliance requirements is no easy...
View More
Databricks AI Summit (DAIS) 2025 Wrap Up
5 New Developments in Databricks and How Securiti Customers Benefit Concerns over the risk of leaking sensitive data are currently the number one blocker...
A Complete Guide on Uganda’s Data Protection and Privacy Act (DPPA) View More
A Complete Guide on Uganda’s Data Protection and Privacy Act (DPPA)
Delve into Uganda's Data Protection and Privacy Act (DPPA), including data subject rights, organizational obligations, and penalties for non-compliance.
Data Risk Management View More
What Is Data Risk Management?
Learn the ins and outs of data risk management, key reasons for data risk and best practices for managing data risks.
Beyond DLP: Guide to Modern Data Protection with DSPM View More
Beyond DLP: Guide to Modern Data Protection with DSPM
Learn why traditional data security tools fall short in the cloud and AI era. Learn how DSPM helps secure sensitive data and ensure compliance.
Mastering Cookie Consent: Global Compliance & Customer Trust View More
Mastering Cookie Consent: Global Compliance & Customer Trust
Discover how to master cookie consent with strategies for global compliance and building customer trust while aligning with key data privacy regulations.
Singapore’s PDPA & Consent: Clear Guidelines for Enterprise Leaders View More
Singapore’s PDPA & Consent: Clear Guidelines for Enterprise Leaders
Download the essential infographic for enterprise leaders: A clear, actionable guide to Singapore’s PDPA and consent requirements. Stay compliant and protect your business.
View More
Australia’s Privacy Act & Consent: Essential Guide for Enterprise Leaders
Download the essential infographic for enterprise leaders: A clear, actionable guide to Australia’s Privacy Act and consent requirements. Stay compliant and protect your business.
Gencore AI and Amazon Bedrock View More
Building Enterprise-Grade AI with Gencore AI and Amazon Bedrock
Learn how to build secure enterprise AI copilots with Amazon Bedrock models, protect AI interactions with LLM Firewalls, and apply OWASP Top 10 LLM...
DSPM Vendor Due Diligence View More
DSPM Vendor Due Diligence
DSPM’s Buyer Guide ebook is designed to help CISOs and their teams ask the right questions and consider the right capabilities when looking for...
What's
New