Securiti Named a 2022 Cool Vendor in Data Security by GartnerDownload Now
The UAE Cabinet issued its highly anticipated Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data (PDPL). The PDPL is one of the first projects of UAE’s legislative reform and will come into effect on 2 January 2022. Executive regulations are due to be issued by 20 March 2022.
The UAE’s government has long been devising a comprehensive data protection law to elevate its data handling and protection standards as per international best practices. The Cabinet realizes that in an era where customers, consumers, and governments increasingly value data privacy and its handling process, personal data protection is paramount.
The PDPL provides a legal framework to ensure the confidentiality and security of personal information while emphasizing the rights and duties of all concerned parties.
The UAE government will designate a single national data privacy regulator the ‘UAE Data Office.’ The ‘Office’ will be established under a separate regulation to regulate the application of the PDPL. The regulatory body will be responsible for various tasks that include:
Article 2(1) of the PDPL provides that it applies to the processing of personal data by any data controller or data processor located in the UAE processing the personal data of data subjects residing or working within or outside the UAE. It covers the personal data of data subjects residing or working in the UAE.
Moreover, the PDPL also applies to any data controller or data processor established outside the UAE carrying out processing activities about data subjects in the UAE.
The PDPL, therefore, has an extraterritorial application similar to GDPR.
Article 2(2) of the PDPL provides that it does not apply to government data, public entities, the processing of personal data for personal use, health or credit data governed by their own respective legislation, and organizations and entities established in free zones with their own personal data protection laws (as an example the Dubai International Financial Centre has data protection laws already).
Under the PDPL, personal data is defined as any data relating to an identified natural person, or a natural person who can be identified, directly or indirectly, through the linking of data, by reference to an identifier such as his name, voice, picture, identification number, electronic, identifier, geographical location, or one or more physical, physiological, cultural or social characteristics.
Under the PDPL, sensitive information is defined as any information that directly or indirectly reveals a person’s:
Under the PDPL, personal data can only be processed with the consent of the data subject except in certain lawful circumstances. These prescribed circumstances include:
Article 6 of the PDPL provides the following necessary conditions for obtaining valid consent from the data subjects for the processing of his/her personal information:
The PDPL also provides that data subjects have the right to withdraw their consent at any time, and such withdrawal should not impact the legality of the processing carried out before the withdrawal. The PDPL includes a similar requirement for “opt-in” consent as contained in the GDPR.
A controller must, before processing a data subject’s personal data, provide the data subject with the purposes for the personal data processing, any third parties that the personal data will be shared with and the protection measures put in place to cover any cross-border data transfers.
The PDPL demands the data controller and processor to implement appropriate technical and organizational measures and actions to ensure a high information security level appropriate to the risks associated with the processing according to the best international standards and practices. These practices may include:
Under the PDPL, the data controller shall immediately, after having become aware of a data breach, notify the Office and data subjects of any Personal Data Breach relating to a data subject which might result in a risk to privacy, confidentiality, and security of his/her data within a period that will be specified in the Executive Regulations that will follow in due course. The notification period will be specified in the Executive Regulations. The data processor shall also, immediately after becoming aware of the breach,notify the data controller.
In addition, the notification must be accompanied by the following statements and documents:
As per Article 10 of the PDPL, the data controller and data processor shall appoint a Data Protection Officer in any of the following circumstances:
The appointed individual must have the adequate skills and knowledge to protect personal data.
Article 21 of the PDPL states that organizations must conduct a DPIA prior to the processing that involves new technologies which are likely to result in a high risk to data subjects. A DPIA is mandatory in the following circumstance:
The PDPL also specifies that the data controller must review the outcomes of DPIAs regularly to ensure that processing activities are conducted in accordance with the assessment in the event that the level of risk changes.
Data controllers and data processors are both separately required to keep records concerning the personal data they process. The content requirements for such records are primarily aligned with the equivalent requirements under the GDPR but with some additional points. A RoPA must include the following:
The PDPL provides that personal data can be transferred to countries approved by the Data Office as having an “adequate level of protection”. These cover countries that either have data protection legislation in place or where the specific country has acceded to bilateral or multilateral agreements relating to the protection of personal data.
The cross border transfer of personal data to inadequate countries can also be done in the following circumstances:
Article 7(5) requires that data controllers must ensure that they engage data processors providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that processing will meet the processing requirements provided under the PDPL and its Executive Regulations. Article 8 of the PDPL provides separate data processing requirements for the data processors.
The PDPL provides that the data controller is required to make available the means and procedures for data subjects to exercise their rights under the PDPL. The PDPL grants data subjects the following rights:
The data subject will have the right to request the data controller and obtain the following information:
The PDPL provides certain exceptions to the right to access information.
The data subject will have the right to receive his/her personal data in a structured and machine-readable format where the processing of personal data is subject to the data subject’s consent or is necessary for the performance of a contractual obligation, or performed by automated means.
The data subject will have the right to rectify any inaccurate of his/her personal information and the right to require the data controller to erase his/her personal information.
The data subject will have the right to require the data controller to restrict and stop his/her personal data from being used in any way. The data subject can exercise this right in the following circumstances:
The data subjects will also have the right to require the data controller to stop the processing of his/her personal data in the following circumstances:
The data subject will have the right to object to automated decision-making that has legal implications or seriously affects the data subject.
The PDPL does not explicitly state the penalties that will apply to organizations due to non-compliance with the PDPL. Administrative penalties can be imposed as part of a decision by the Council of Ministers in response to a breach of the PDPL or the Executive Regulations. The amount for penalties will be specified in subsequent Executive Regulations issued by the UAE Data Office.
To comply with PDPL, organizations must:
The global dynamics of accessing, protecting, and sharing personal data is rapidly changing, requiring organizations to become more privacy-conscious of their processes and responsible guardians of their consumers' data, all while automating privacy and security operations for swift action.
With a growing database of users and potential users, organizations need to incorporate robotic automation to operationalize compliance without missing out. While multiple services offer software that enables companies to comply with global privacy regulations, those solutions only go as far as possible with various restrictions or elementary data-driven functions.
Securiti binds reliability, intelligence, and simplicity working on the PrivacyOps framework to allow end-to-end automation for organizations. Securiti can help you stay compliant with UAE’s PDPL and other privacy and security regulations worldwide. See how it works. Request a demo today.
See how easy it is to manage privacy compliance with robotic automation.