Penalties for Non-Compliance
This is undoubtedly the biggest difference between the PDPL and the GDPR. While the GDPR takes a much more standardized approach where anyone in breach of the law would not know what penalties to expect, the UAE law approaches penalties on a case-by-case basis:
The UAE
The UAE's data protection law does not have any standardized penalties in place for websites and companies found in non-compliance as of yet. There will be further executive regulation carried out to set penalties after the law is implemented in January 2022.
Until such regulation is done, the courts and the UAE Data Office will oversee each case of non-compliance separately and decide the appropriate punishment in each case.
The GDPR
The GDPR is incredibly strict when penalizing companies and websites found to be in non-compliance with any of the law's provisions.
Under GDPR, non-compliance and data breaches can result in fines as high as 20 million euros or 4% of the violating company's annual global turnover - whichever amount is higher.
Privacy Policy
The privacy policy is an important document and tool that can help any data handler communicate with their users exactly what they’re signing up for. Both the UAE’s PDPL and the GDPR have comprehensive and clear guidelines over what any data handler’s privacy policy must contain.
The UAE
A controller must, before processing a data subject’s personal data, provide the data subject with the purposes for the personal data processing, any third parties that the personal data will be shared with and the protection measures put in place to cover any cross-border data transfers.
The UAE’s PDPL legislation mandates all data handlers to be transparent about their data collection activities with the data subjects. This includes detailed information about what data is being collected, why it’s being collected, how the data collected is used, whether the collected data is shared or sold to another party, whom to contact if the data subjects wishes to request access, alteration or deletion of their data, and how the collected data is protected
The GDPR
The GDPR requires all data handlers to be extensive with their privacy policy. However, at the same time, all data handlers are required to ensure that the policy is easy-to-read, comprehensible, and does not use any jargon that may obfuscate the consent agreement in any way.
The privacy policy must contain information on identity and contact details of the controller, controller’s representative where applicable, controller’s data protection officer where applicable, the purposes of the processing, the lawful basis of the processing, the recipients or categories of recipients of personal data, and where applicable if the controller intends to transfer personal data outside the EU. The policy must also reiterate the rights of data subjects and how they can resscind their consent at any given time.
Cross Border Data Transfers
Data collected on data subjects is an incredibly vital asset for any data handler. In some instances, this data may need to be transferred to another country for protection or any other reason. In such a scenario, this what both the legislations have to say on the matter:
The UAE
Transfers of data outside the UAE’s jurisdiction is allowed, provided the country where the data is to be transferred has an “adequate level of protection”. This means the country having some form of data protection legislation of its own or a country that has some sort of bilateral data protection agreement signed with the UAE. Even so, transfer of data can only occur if the following conditions are met:
- Under a contract that applies the requirements of the PDPL;
- After obtaining the data subject’s express consent for such transfer;
- If the transfer is necessary for the execution of a contract between the controller and the data subject or as part of a contract between the controller and a third party that achieves the interests of a data subject;
- If the transfer is necessary for international judicial cooperation;
- If the transfer is necessary to protect the public interest.
The GDPR
The GDPR is unique in this particular case as it does not mention any jurisdiction outside the EU. Hence, the transfer of data to a country outside the EU jurisdiction is not overtly addressed. However, there are some strict criteria that need to be met as judged by the Information Commissioner's Office.
Some of these criteria include:
- Binding Corporate Rules with specific requirements (e.g., a legal basis for processing, a retention period, and complaint procedures)
- Standard data protection clauses adopted by a supervisory authority and approved by the EU Commission)
- An approved code of conduct; or
- An approved certification mechanism.
- Legally binding instruments for cross-border transfers between public authorities
How Securiti Can Help
The GDPR and PDPL legislation mean that companies must rethink and strategize their data collection mechanisms. These legislations put the users' right to privacy above all else, including user experience. This can be particularly challenging for companies for whom data processing is vital to their ability to offer better products and services.
However, thanks to its PrivacyOps framework that consists of several machine learning and artificial intelligence-powered tools, Security can help companies of varying sizes achieve data compliance swiftly and effectively. To see Securiti's tools in action and how they can help you comply with both the GDPR and PDPL, request a demo today.
