Overview of UAE’s Federal Decree-Law No. (45) of 2021 on PDPL

The PDPL also provides that data subjects have the right to withdraw their consent at any time, and such withdrawal should not impact the legality of the processing carried out before the withdrawal. The PDPL includes a similar requirement for “opt-in” consent as contained in the GDPR.

5.3 Privacy Notice Requirement

A controller must, before processing a data subject’s personal data, provide the data subject with the purposes for the personal data processing, any third parties that the personal data will be shared with and the protection measures put in place to cover any cross-border data transfers.

5.4 Security Requirements

The PDPL demands the data controller and processor to implement appropriate technical and organizational measures and actions to ensure a high information security level appropriate to the risks associated with the processing according to the best international standards and practices. These practices may include:

• Encrypting the personal data of the data subject;
• Implementation of data pseudonymization;
• Implementation of measures that guarantee long-term confidentiality, integrity, safety, and processing systems and services flexibility; and/or
• Implementation of measures that guarantee retrieval of access to personal data in due time in case of any actual or technical failure.

5.5 Data Breach Requirements

Under the PDPL, the data controller shall immediately, after having become aware of a data breach, notify the Office and data subjects of any Personal Data Breach relating to a data subject which might result in a risk to privacy, confidentiality, and security of his/her data within a period that will be specified in the Executive Regulations that will follow in due course. The notification period will be specified in the Executive Regulations. The data processor shall also, immediately after becoming aware of the breach,notify the data controller.

In addition, the notification must be accompanied by the following statements and documents:

• A description of the nature, form, reasons, approximate number, and data breach records.
• The details of its Data Protection Officer.
• The potential and expected effects of the data breach.
• A description of the actions and measures taken to rectify the data breach and minimize its effects.
• Documentation of the data breach.
• Any other requirements requested by the Office.

5.6 Data Protection Officer Requirement

As per Article 10 of the PDPL, the data controller and data processor shall appoint a Data Protection Officer in any of the following circumstances:

• Where the processing might result in a high risk to the privacy and confidentiality of personal data of the data subject.
• Where the processing involves a systematic and overall assessment of sensitive personal data, including profiling and automated processing.
• Where processing involves a large scale of sensitive personal data.

The appointed individual must have the adequate skills and knowledge to protect personal data.

5.7 Data Protection Impact Assessment (DPIA)

Article 21 of the PDPL states that organizations must conduct a DPIA prior to the processing that involves new technologies which are likely to result in a high risk to data subjects. A DPIA is mandatory in the following circumstance:

• Where the processing involves systematic and extensive evaluation of personal aspects of data subjects which are based on automated processing, or has legal effects or might significantly affect the data subject;
• Where processing involves a large scale of sensitive personal data.

The PDPL also specifies that the data controller must review the outcomes of DPIAs regularly to ensure that processing activities are conducted in accordance with the assessment in the event that the level of risk changes.

5.8 Record of Processing Activities (RoPA)

Data controllers and data processors are both separately required to keep records concerning the personal data they process. The content requirements for such records are primarily aligned with the equivalent requirements under the GDPR but with some additional points. A RoPA must include the following:

• Details of the data controller and DPO;
• A description of the categories of personal data it processes;
• The purpose(s) of the processing;
• Information in relation to the persons authorized to access the personal information;
• Retention period and limits of the processing;
• The method of erasing or rectifying the information;
• Any information related to cross border data transfers; and
• Any information related to the technical and organizational measures used to secure personal information.

5.9 Cross Border Data Transfer Requirements

The PDPL provides that personal data can be transferred to countries approved by the Data Office as having an “adequate level of protection”. These cover countries that either have data protection legislation in place or where the specific country has acceded to bilateral or multilateral agreements relating to the protection of personal data.

The cross border transfer of personal data to inadequate countries can also be done in the following circumstances:

• Under a contract that applies the requirements of the PDPL (standard contract clauses);
• After obtaining the data subject’s express consent for such transfer;
• If the transfer is necessary for the execution of a contract between the controller and the data subject or as part of a contract between the controller and a third party that achieves the interests of a data subject;
• If the transfer is necessary for international judicial cooperation;
• If the transfer is necessary to protect the public interest.

5.10 Third Party Processing Requirements

Article 7(5) requires that data controllers must ensure that they engage data processors providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that processing will meet the processing requirements provided under the PDPL and its Executive Regulations. Article 8 of the PDPL provides separate data processing requirements for the data processors.

6. Data Subject Rights

The PDPL provides that the data controller is required to make available the means and procedures for data subjects to exercise their rights under the PDPL. The PDPL grants data subjects the following rights:

6.1 Right to access to information

The data subject will have the right to request the data controller and obtain the following information:

• The categories of personal data processed;
• The purpose of the processing;
• Whether the personal data is shared inside or outside the state;
• Automated decision making on his/her personal data;
• Controls or standards relating to storage of his/her personal data;
• Actions for rectification, restriction, or erasure of his/her personal data;
• Safeguards applied to his/her personal data in case of cross border data transfer;
• Actions to be taken in case of Personal Data Breach;
• Procedure to lodge a complaint with the Office.

The PDPL provides certain exceptions to the right to access information.

6.2 Right to request personal data portability

The data subject will have the right to receive his/her personal data in a structured and machine-readable format where the processing of personal data is subject to the data subject’s consent or is necessary for the performance of a contractual obligation, or performed by automated means.

6.3 Right to rectification or erasure of personal data

The data subject will have the right to rectify any inaccurate of his/her personal information and the right to require the data controller to erase his/her personal information.

6.4 Right to restriction of processing

The data subject will have the right to require the data controller to restrict and stop his/her personal data from being used in any way. The data subject can exercise this right in the following circumstances:

• Where the data subject contests the accuracy of personal data;
• Where the data subject objects to the processing of his/her personal data contrary to agreed purposes; or
• Where the processing is performed in contravention of provisions of the PDPL and the Executive Regulations.

6.5 Right to stop processing

The data subjects will also have the right to require the data controller to stop the processing of his/her personal data in the following circumstances:

• Where personal data is processed for marketing purposes;
• Where the processing is for statistical survey purposes, unless the processing is essential for the reasons of public interest;
• Where the processing does not oblige with the Personal Data Protection Principles as stated under Article 5 of the PDPL.

6.6 Right of processing and automated processing

The data subject will have the right to object to automated decision-making that has legal implications or seriously affects the data subject.

7. Penalties for Non-compliance

The PDPL does not explicitly state the penalties that will apply to organizations due to non-compliance with the PDPL. Administrative penalties can be imposed as part of a decision by the Council of Ministers in response to a breach of the PDPL or the Executive Regulations. The amount for penalties will be specified in subsequent Executive Regulations issued by the UAE Data Office.

8. How an Organization Can Operationalize the PDPL

To comply with PDPL, organizations must:

• Catalog their data inventories and classify sensitive personal data and personal data;
• Assess whether they need to appoint the DPO;
• Disclose how personal data is being processed through transparent formal policies and privacy notices;
• Develop formal policies and procedures for data collection (consent framework etc.) and processing, and update privacy policies as needed;
• Have robust data breach notification mechanisms in place;
• Map their processes and discover cross-border data flows from UAE to other countries, and fulfill strict cross border requirements under the PDPL;
• Have a comprehensive data subject requests framework in place;
• Develop the capability to scan and track data processing activity and produce ROPA reports for compliance;
• Have technical and organizational security measures in place to protect their processing activities; and
• Conduct personal information protection impact assessments, vendors assessments, and other risk assessments.

9. How can Securiti Help

The global dynamics of accessing, protecting, and sharing personal data is rapidly changing, requiring organizations to become more privacy-conscious of their processes and responsible guardians of their consumers' data, all while automating privacy and security operations for swift action.

With a growing database of users and potential users, organizations need to incorporate robotic automation to operationalize compliance without missing out. While multiple services offer software that enables companies to comply with global privacy regulations, those solutions only go as far as possible with various restrictions or elementary data-driven functions.

Securiti binds reliability, intelligence, and simplicity working on the PrivacyOps framework to allow end-to-end automation for organizations. Securiti can help you stay compliant with UAE’s PDPL and other privacy and security regulations worldwide. See how it works. Request a demo today.