Securiti Named a 2022 Cool Vendor in Data Security by Gartner

Download Now

Overview of UAE’s Federal Decree-Law No. (45) of 2021 on Personal Data Protection (PDPL)

background-image

1. Introduction

The UAE Cabinet issued its highly anticipated Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data (PDPL). The PDPL is one of the first projects of UAE’s legislative reform and will come into effect on 2 January 2022. Executive regulations are due to be issued by 20 March 2022.

The UAE’s government has long been devising a comprehensive data protection law to elevate its data handling and protection standards as per international best practices. The Cabinet realizes that in an era where customers, consumers, and governments increasingly value data privacy and its handling process, personal data protection is paramount.

The PDPL provides a legal framework to ensure the confidentiality and security of personal information while emphasizing the rights and duties of all concerned parties.

2. Regulatory Authority

The UAE government will designate a single national data privacy regulator the ‘UAE Data Office.’ The ‘Office’ will be established under a separate regulation to regulate the application of the PDPL. The regulatory body will be responsible for various tasks that include:

  • proposing and devising policies concerning data protection;
  • proposing and approving the idolized standards for monitoring the application of federal legislation regulating the personal data of data subjects;
  • preparing and approving systems for complaints and grievances; and
  • issuing guidelines and instructions for the implementation of data protection legislation.
uae data protection law

3. Who Needs to Comply with the Law

3.1 Material Scope

Article 2(1) of the PDPL provides that it applies to the processing of personal data by any data controller or data processor located in the UAE processing the personal data of data subjects residing or working within or outside the UAE. It covers the personal data of data subjects residing or working in the UAE.

3.2 Territorial Scope

Moreover, the PDPL also applies to any data controller or data processor established outside the UAE carrying out processing activities about data subjects in the UAE.

The PDPL, therefore, has an extraterritorial application similar to GDPR.

Article 2(2) of the PDPL provides that it does not apply to government data, public entities, the processing of personal data for personal use, health or credit data governed by their own respective legislation, and organizations and entities established in free zones with their own personal data protection laws (as an example the Dubai International Financial Centre has data protection laws already).

4. Definitions of Key Terms

4.1 Personal Data

Under the PDPL, personal data is defined as any data relating to an identified natural person, or a natural person who can be identified, directly or indirectly, through the linking of data, by reference to an identifier such as his name, voice, picture, identification number, electronic, identifier, geographical location, or one or more physical, physiological, cultural or social characteristics.

4.2 Sensitive Personal Data

Under the PDPL, sensitive information is defined as any information that directly or indirectly reveals a person’s:

  • Race
  • Ethnicity
  • Political
  • Philosophical views
  • Religious beliefs
  • Criminal record
  • Biometric data
  • Health data
  • Sexual state
  • Including any information related to such a person's health.

5. Obligations for Organizations Under UAE’s PDPL

5.1 Lawful Basis of Processing

Under the PDPL, personal data can only be processed with the consent of the data subject except in certain lawful circumstances. These prescribed circumstances include:

  • Where the processing is necessary to fulfill a contractual obligation with a data subject or to conclude, amend or terminate any such contract;
  • Where the data subject has made the personal data public;
  • To protect the interests of the data subject;
  • Where the processing is necessary for claiming legal rights or as part of judicial or security procedures;
  • Where the processing is necessary for certain medical purposes or matters of public health (in accordance with relevant legislation);
  • For archival purposes or for scientific, historical, and statistical studies (in accordance with relevant legislation);
  • Where the processing is necessary for the public interest;
  • Where the processing is necessary for the data controller's compliance with legal obligations; or
  • Any other circumstances specified by the Executive Regulations issued under the PDPL.

5.2 Consent Requirements

Article 6 of the PDPL provides the following necessary conditions for obtaining valid consent from the data subjects for the processing of his/her personal information:

  • The data controller must prove the data subject's consent if consent is relied upon as a lawful basis for the processing of his/her personal data.
  • The consent could be obtained electronically or in writing but must be obtained in a clear, simple, unambiguous, and accessible manner.
  • The method for obtaining consent should include information on how the data subject may withdraw their consent, and the procedure for doing so must be easy for them.
uae pdpl

The PDPL also provides that data subjects have the right to withdraw their consent at any time, and such withdrawal should not impact the legality of the processing carried out before the withdrawal. The PDPL includes a similar requirement for “opt-in” consent as contained in the GDPR.

5.3 Privacy Notice Requirement

A controller must, before processing a data subject’s personal data, provide the data subject with the purposes for the personal data processing, any third parties that the personal data will be shared with and the protection measures put in place to cover any cross-border data transfers.

5.4 Security Requirements

The PDPL demands the data controller and processor to implement appropriate technical and organizational measures and actions to ensure a high information security level appropriate to the risks associated with the processing according to the best international standards and practices. These practices may include:

  • Encrypting the personal data of the data subject;
  • Implementation of data pseudonymization;
  • Implementation of measures that guarantee long-term confidentiality, integrity, safety, and processing systems and services flexibility; and/or
  • Implementation of measures that guarantee retrieval of access to personal data in due time in case of any actual or technical failure.

5.5 Data Breach Requirements

Under the PDPL, the data controller shall immediately, after having become aware of a data breach, notify the Office and data subjects of any Personal Data Breach relating to a data subject which might result in a risk to privacy, confidentiality, and security of his/her data within a period that will be specified in the Executive Regulations that will follow in due course. The notification period will be specified in the Executive Regulations. The data processor shall also, immediately after becoming aware of the breach,notify the data controller.

In addition, the notification must be accompanied by the following statements and documents:

  • A description of the nature, form, reasons, approximate number, and data breach records.
  • The details of its Data Protection Officer.
  • The potential and expected effects of the data breach.
  • A description of the actions and measures taken to rectify the data breach and minimize its effects.
  • Documentation of the data breach.
  • Any other requirements requested by the Office.

5.6 Data Protection Officer Requirement

As per Article 10 of the PDPL, the data controller and data processor shall appoint a Data Protection Officer in any of the following circumstances:

  • Where the processing might result in a high risk to the privacy and confidentiality of personal data of the data subject.
  • Where the processing involves a systematic and overall assessment of sensitive personal data, including profiling and automated processing.
  • Where processing involves a large scale of sensitive personal data.

The appointed individual must have the adequate skills and knowledge to protect personal data.

5.7 Data Protection Impact Assessment (DPIA)

Article 21 of the PDPL states that organizations must conduct a DPIA prior to the processing that involves new technologies which are likely to result in a high risk to data subjects. A DPIA is mandatory in the following circumstance:

  • Where the processing involves systematic and extensive evaluation of personal aspects of data subjects which are based on automated processing, or has legal effects or might significantly affect the data subject;
  • Where processing involves a large scale of sensitive personal data.

The PDPL also specifies that the data controller must review the outcomes of DPIAs regularly to ensure that processing activities are conducted in accordance with the assessment in the event that the level of risk changes.

5.8 Record of Processing Activities (RoPA)

Data controllers and data processors are both separately required to keep records concerning the personal data they process. The content requirements for such records are primarily aligned with the equivalent requirements under the GDPR but with some additional points. A RoPA must include the following:

  • Details of the data controller and DPO;
  • A description of the categories of personal data it processes;
  • The purpose(s) of the processing;
  • Information in relation to the persons authorized to access the personal information;
  • Retention period and limits of the processing;
  • The method of erasing or rectifying the information;
  • Any information related to cross border data transfers; and
  • Any information related to the technical and organizational measures used to secure personal information.

5.9 Cross Border Data Transfer Requirements

The PDPL provides that personal data can be transferred to countries approved by the Data Office as having an “adequate level of protection”. These cover countries that either have data protection legislation in place or where the specific country has acceded to bilateral or multilateral agreements relating to the protection of personal data.

The cross border transfer of personal data to inadequate countries can also be done in the following circumstances:

  • Under a contract that applies the requirements of the PDPL (standard contract clauses);
  • After obtaining the data subject’s express consent for such transfer;
  • If the transfer is necessary for the execution of a contract between the controller and the data subject or as part of a contract between the controller and a third party that achieves the interests of a data subject;
  • If the transfer is necessary for international judicial cooperation;
  • If the transfer is necessary to protect the public interest.

5.10 Third Party Processing Requirements

Article 7(5) requires that data controllers must ensure that they engage data processors providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that processing will meet the processing requirements provided under the PDPL and its Executive Regulations. Article 8 of the PDPL provides separate data processing requirements for the data processors.

6. Data Subject Rights

The PDPL provides that the data controller is required to make available the means and procedures for data subjects to exercise their rights under the PDPL. The PDPL grants data subjects the following rights:

6.1 Right to access to information

The data subject will have the right to request the data controller and obtain the following information:

  • The categories of personal data processed;
  • The purpose of the processing;
  • Whether the personal data is shared inside or outside the state;
  • Automated decision making on his/her personal data;
  • Controls or standards relating to storage of his/her personal data;
  • Actions for rectification, restriction, or erasure of his/her personal data;
  • Safeguards applied to his/her personal data in case of cross border data transfer;
  • Actions to be taken in case of Personal Data Breach;
  • Procedure to lodge a complaint with the Office.

The PDPL provides certain exceptions to the right to access information.

6.2 Right to request personal data portability

The data subject will have the right to receive his/her personal data in a structured and machine-readable format where the processing of personal data is subject to the data subject’s consent or is necessary for the performance of a contractual obligation, or performed by automated means.

6.3 Right to rectification or erasure of personal data

The data subject will have the right to rectify any inaccurate of his/her personal information and the right to require the data controller to erase his/her personal information.

6.4 Right to restriction of processing

The data subject will have the right to require the data controller to restrict and stop his/her personal data from being used in any way. The data subject can exercise this right in the following circumstances:

  • Where the data subject contests the accuracy of personal data;
  • Where the data subject objects to the processing of his/her personal data contrary to agreed purposes; or
  • Where the processing is performed in contravention of provisions of the PDPL and the Executive Regulations.

6.5 Right to stop processing

The data subjects will also have the right to require the data controller to stop the processing of his/her personal data in the following circumstances:

  • Where personal data is processed for marketing purposes;
  • Where the processing is for statistical survey purposes, unless the processing is essential for the reasons of public interest;
  • Where the processing does not oblige with the Personal Data Protection Principles as stated under Article 5 of the PDPL.

6.6 Right of processing and automated processing

The data subject will have the right to object to automated decision-making that has legal implications or seriously affects the data subject.

7. Penalties for Non-compliance

The PDPL does not explicitly state the penalties that will apply to organizations due to non-compliance with the PDPL. Administrative penalties can be imposed as part of a decision by the Council of Ministers in response to a breach of the PDPL or the Executive Regulations. The amount for penalties will be specified in subsequent Executive Regulations issued by the UAE Data Office.

8. How an Organization Can Operationalize the PDPL

To comply with PDPL, organizations must:

  • Catalog their data inventories and classify sensitive personal data and personal data;
  • Assess whether they need to appoint the DPO;
  • Disclose how personal data is being processed through transparent formal policies and privacy notices;
  • Develop formal policies and procedures for data collection (consent framework etc.) and processing, and update privacy policies as needed;
  • Have robust data breach notification mechanisms in place;
  • Map their processes and discover cross-border data flows from UAE to other countries, and fulfill strict cross border requirements under the PDPL;
  • Have a comprehensive data subject requests framework in place;
  • Develop the capability to scan and track data processing activity and produce ROPA reports for compliance;
  • Have technical and organizational security measures in place to protect their processing activities; and
  • Conduct personal information protection impact assessments, vendors assessments, and other risk assessments.

9. How can Securiti Help

The global dynamics of accessing, protecting, and sharing personal data is rapidly changing, requiring organizations to become more privacy-conscious of their processes and responsible guardians of their consumers' data, all while automating privacy and security operations for swift action.

With a growing database of users and potential users, organizations need to incorporate robotic automation to operationalize compliance without missing out. While multiple services offer software that enables companies to comply with global privacy regulations, those solutions only go as far as possible with various restrictions or elementary data-driven functions.

Securiti binds reliability, intelligence, and simplicity working on the PrivacyOps framework to allow end-to-end automation for organizations. Securiti can help you stay compliant with UAE’s PDPL and other privacy and security regulations worldwide. See how it works. Request a demo today.

Share this

Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox

Take a
Product Tour

See how easy it is to manage privacy compliance with robotic automation.

Solutions

Systems

Newsletter

Users love Securiti on G2 G2 leader spring 2022 G2 leader summer 2022 G2 leader easiest business 2022 ISO certification RSAC Leader Forrester Badge IAPP Innovation award 2020 Sinet Innovator Award Gartner Cool Vendor Award

Securiti PrivacyOps Named a Leader in The Forrester WaveTM

View