The landscape of data privacy is intricate and continually changing, posing numerous challenges for organizations. This complexity introduces uncertainties at various levels regarding the appropriate ways and timing for processing personal data. With the enactment of the UAE Data Protection Law, organizations engaging in activities within or related to the United Arab Emirates will experience a significant impact. Consequently, they will need to establish data privacy programs to align with the stipulations of the law.
It is essential to note that the UAE Data Protection Law refers to “Executive Regulations,” scheduled for release approximately six months after the law’s issuance (around May 2022). These regulations will provide additional details on how organizations should adhere to the law, and we will incorporate relevant updates into this handbook accordingly.
Why prioritize data privacy?
Failing to safeguard personal data and comply with the UAE Data Protection Law exposes companies not only to penalties enforced by the regulatory Office but also to operational inefficiencies, regulatory interventions, and, crucially, a permanent loss of consumer trust. Although the UAE Data Protection Law empowers the Office to impose penalties, the exact extent of these penalties will remain unclear until the issuance of the Executive Regulations.
Regulatory implications
Data protection regulators possess the authority to enforce mandatory audits, request access to documentation and evidence, and even mandate that organizations cease processing personal data.
Financial and criminal consequences are significant aspects of Data Protection Laws worldwide, imposing substantial penalties on businesses found in violation. In the Middle East, it is customary for Data Protection Laws to also incorporate criminal sanctions, although the specific penalties will only be clarified with the issuance of the Executive Regulations.
Financial and Criminal Implications
Businesses breaching Data Protection Laws face hefty financial penalties. In the Middle East, there’s an additional layer with the potential for criminal sanctions. The exact nature of these penalties will become clearer once the Executive Regulations are revealed.
Reputational Risks
Non-compliance with the law can lead to severe reputational damage. This includes harm to the brand, erosion of consumer trust, diminished employee confidence, and potential customer attrition. Protecting the reputation of an organization is integral to long-term success, and adherence to Data Protection Laws plays a crucial role in maintaining trust.
Operational Challenges
The UAE Data Protection Law grants individuals increased rights over their data, such as the right to access or request deletion of their personal information. While this empowers individuals, it can pose a significant operational burden for organizations if not implemented effectively. Ensuring compliance with these rights requires a strategic approach to managing and securing data, avoiding disruptions to day-to-day operations.
As the landscape of data protection evolves, organizations must proactively address these financial, criminal, reputational, and operational considerations. This underscores the importance of understanding and complying with Data Protection Laws to mitigate risks and foster a trustworthy and resilient business environment. The forthcoming Executive Regulations will provide more clarity on the specific penalties and guidelines for compliance, enabling organizations to fine-tune their data privacy programs accordingly.
Key Concepts of UAE Data Protection Law
Understanding the key terms and concepts introduced by the UAE Data Protection Law is essential for navigating its requirements. Here are some crucial terms:
Data Processing:
- Definition: Any operation or set of operations performed on personal data through electronic means or other processing methods.
- This includes a range of activities such as collecting, storing, recording, organizing, adapting, modifying, circulating, transferring, retrieving, exchanging, sharing, using, describing, and disclosing personal data through various methods.
The Office:
- Definition: The “Emirates Data Office,” established as a result of Federal Decree No. 44 of 2021.
- Role: The Office serves as the de facto regulator for the UAE Data Protection Law, overseeing its implementation and enforcement.
Data Subject:
- Definition: The natural person who is the subject of the Personal Data.
- Clarification: In simpler terms, any individual to whom personal data belongs.
Personal Data:
- Definition: Information that relates to an identifiable person, either directly or indirectly.
Sensitive Personal Data:
- Definition: A subset of personal data that reveals information about a person’s family, ethnicity, political or philosophical views, religious beliefs, criminal record, biometric data, or details related to physical, psychological, mental, genetic, or sexual health.
- Special consideration: Includes information related to healthcare service provisioning that can reveal the person’s health status.
Key Principles of Data Privacy:
While the UAE Data Protection Law may not explicitly list the key principles, they are embedded in its requirements. Understanding these principles is crucial as they form the foundation for data privacy and the protection of personal data. Familiarizing yourself with these principles will aid in comprehending and complying with the law’s requirements. It is recommended to refer to the handbook for specific details on each principle and how they relate to the UAE Data Protection Law.
Data Privacy Principles:
The UAE Data Protection Law is founded on seven key data privacy principles that organizations must adhere to when processing personal data. Compliance with these principles is crucial for ensuring robust data protection:
Lawfulness, Fairness, and Transparency:
- Personal data must be processed in a fair, lawful, and transparent manner.
Purpose Limitation:
- Personal data should only be processed for a specified and lawful purpose.
Data Minimization:
- Organizations should only process the personal data necessary for their intended purpose, avoiding unnecessary data collection.
Accuracy:
Measures must be in place to ensure personal data is accurate, and necessary corrections are promptly made.
Storage Limitation:
- Personal data should not be retained for longer than necessary for the specified purpose.
Integrity and Confidentiality:
- Adequate security controls must be implemented to protect personal data against loss, destruction, or damage.
Accountability:
- Organizations must have appropriate measures and records to demonstrate compliance with data protection requirements.
What is Personal Data?
Personal data encompasses information that can identify a living person directly or indirectly. Examples include names, account numbers, digital identifiers like IP addresses, usernames, or location data such as GPS coordinates.
What is Sensitive Personal Data?
Sensitive personal data, under the UAE Data Protection Law, includes information that, if leaked or misused, could cause harm to an individual. This may involve details related to family, ethnicity, political or philosophical views, religious beliefs, criminal record, biometric data, or aspects of physical, psychological, mental, genetic, or sexual health.
Data Controller vs. Data Processor:
The UAE Data Protection Law distinguishes between the roles of Data Controller and Data Processor:
- Data Controller:
- Determines the method, approach, criteria, and purpose of processing personal data.
- Data Processor:
- Processes personal data on behalf of the Controller under the Controller’s direction and instructions.
Organizations may act as both Data Controller and Data Processor depending on the personal data and processing activities involved. For instance, a retailer managing customer data on its e-commerce website may be a Data Controller, while a cloud provider hosting the website database may be a Data Processor in this context. The distinction emphasizes different responsibilities associated with each role.
Roles and Responsibilities
Roles and Responsibilities:
Data Controller:
If you are a Data Controller, you hold the ultimate accountability for compliance, both for yourself and any processors you engage. Your responsibilities encompass adherence to the UAE Data Protection Law, compliance with data protection principles, addressing individuals’ rights, implementing security measures, managing data breaches, and engaging only with processors providing sufficient guarantees to protect data.
Data Processor:
As a Data Processor, you have less autonomy over the data you process, but you still have direct legal obligations. If you engage a sub-processor, you may be liable to the Data Controller for the sub-processor’s compliance. Your responsibilities include compliance with the Data Controller’s instructions, enforcing security measures, notifying the Data Controller of personal data breaches, and not engaging any sub-processor without the approval of the controllers.
Data Subject Rights:
The UAE Data Protection Law emphasizes empowering individuals with control over their personal data, acknowledging several rights concerning data protection. Not all of these rights are absolute, applying only in specific circumstances:
Right to Delete:
- Individuals can request the deletion of their personal data without undue delay.
Right to Object to Automated Decision Making:
- Individuals can object to decisions made about them based on automated means. They also have the right to human intervention to review decisions made through automated processing.
Right to Correct:
- Individuals can have their personal data rectified if inaccurate, or completed if incomplete.
Right of Access to Information:
- Individuals have the right to be informed about what data is being processed and how it is being processed.
Right to Restrict Processing:
- Individuals have the right to compel the Controller to restrict, suspend, or stop the processing of their data.
Right to Request Transfer:
- Individuals have the right to obtain their personal data in a machine-readable format and request the transfer of their data to another controller.
It is crucial for organizations to understand and respect these rights, ensuring compliance with the UAE Data Protection Law and fostering a transparent and accountable data processing environment.
When Can Personal Data Be Processed?
The UAE Data Protection Law prohibits the processing of personal data without obtaining the consent of the data subject. However, there are exceptions to this requirement, and the law permits the processing of personal data in certain cases:
Public Interest and Public Health:
- Processing necessary to protect public interest or public health.
Publicly Available Information:
- Processing related to personal data made public by the data subject.
Defence of Legal Claims:
- Processing necessary for the defense of legal claims.
Preventive or Occupational Medicine:
- Processing necessary for the assessment of an employee’s ability to perform work.
Archiving, Scientific, or Historical Research:
- Processing necessary for achieving purposes in scientific, historical, or statistical research.
Legal Obligations:
- Processing necessary for the controller to carry out legal obligations in recruitment, social security, social protection, or compliance with other laws in the UAE.
In the Interest of the Data Subject:
- Processing necessary to protect the interests of the data subject.
Contractual Obligations:
- Processing necessary for the performance of a contract to which the data subject is a party.
The law also allows for other cases to be specified in the Executive Regulations.
Ten Steps to an Effective Data Privacy Programme:
Appoint a Data Protection Officer:
The UAE Data Protection Law introduces the pivotal role of a ‘Data Protection Officer’ (DPO), signifying a new leadership position responsible for overseeing an organization’s data protection program and ensuring compliance with relevant data protection laws. There are circumstances outlined in the law where both Data Controllers and Data Processors are required to appoint an individual within the organization to carry out the responsibilities outlined by the law.
Role of the Appointed Individual:
The individual appointed as the DPO plays a crucial role in ensuring compliance with the UAE Data Protection Law. Their responsibilities include:
- Monitoring Internal Compliance: Regularly assessing and overseeing internal practices to ensure alignment with the provisions of the UAE Data Protection Law.
- Advising on Data Protection Obligations: Providing guidance and advice to the organization regarding its data protection obligations, ensuring that policies and practices comply with the law.
- Offering Expert Advice: Providing expertise on data protection matters when needed, especially during the development and implementation of policies or in response to specific challenges.
- Acting as a Point of Contact: Serving as a primary contact person for individuals within the organization and external entities, including data protection authorities. This involves handling inquiries, complaints, or requests related to data protection.
Who Could Act as an Appointed Individual:
The appointed individual can be an existing employee within the organization, or they may be authorized by the Data Controller or Data Processor to take on the DPO role. Regardless of the specific individual, the DPO must possess sufficient skills and expert knowledge in the field of Data Protection.
The appointment of a DPO reflects a proactive approach to data protection, demonstrating an organization’s commitment to ensuring the lawful and ethical handling of personal data.
Maintain a Personal Data Register:
Identify all processing activities involving personal data, documenting how and why the data is used in a Record of Processing Activities.
Notify Purpose and Seek Consent
The UAE Data Protection Law emphasizes that the processing of personal data must be fair, transparent, and lawful. When collecting individuals’ personal data, it is essential to provide clear information about why, what, and how the data will be processed.
What Information Should Be Provided?
To fulfill the transparency requirements, the privacy notice shared with individuals should include the following information:
- Details about the collected or processed personal data
- Purpose of processing and the legal reason for collection
- Method of collecting personal data
- Means of storing personal data
- Duration of data processing and destruction timelines
- Rights of data subjects and how to exercise them
- Contact details of the organization and Data Protection Officer
- Recipients of personal data and details of cross-border transfers
How to Provide Information? Privacy information should be shared with individuals at the time of collecting their personal data or within a reasonable timeframe if collected from other sources. It must be concise, transparent, intelligible, easily accessible, and use clear language. Various techniques such as expandable sections, dashboards, and just-in-time notices can be employed to meet these requirements.
What is Consent? Valid consent under the UAE Data Protection Law is a clear, simple, and unambiguous agreement provided by an individual. Consent should reference the right of the data subject to withdraw their consent. It is a way for individuals to have control and choice over how their personal data is processed. The Data Controller must maintain a register or inventory of consents captured and be able to demonstrate that the data subject consented to the processing.
How to Obtain Consent?
- Individuals can provide consent in written or electronic form, separate from other agreements such as terms and conditions.
- The language used should be clear, simple, and unambiguous.
- Individuals can withdraw their consent at any time, and the withdrawal procedures should be as easy as those for giving consent.
Ensuring transparent communication and obtaining valid consent are crucial steps in building trust with data subjects and complying with data protection regulations.
- Respond to Individuals’ Personal Data Inquiries
Respond When Individuals Ask About Their Personal Data:
What Are Data Subject Requests?
The UAE Data Protection Law introduces new rights for individuals, termed “Data Subject Requests.” These rights empower individuals to have more control over the usage of their data. Individuals are entitled to raise requests to exercise their data subject rights, and organizations must respond promptly. While specific response timeframes may be outlined in the Executive Regulations, organizations should be prepared to address these requests.
How Can I Be Prepared?
To be prepared, organizations should implement robust procedures to:
- Authenticate the requester
- Assess the validity of the request
- Formulate an adequate response
What Information Should I Provide?
When responding to a data subject request, organizations should provide the following information:
- Details of the personal data being processed (refer to page 10 for further details)
- Purposes for processing the data
- Details of how the personal data is processed
- Any decisions made through automated processing
- Details of any third-party recipients of the personal data
- Details of any cross-border data transfers
- Information on how long the data will be retained, or at least the criteria used to determine this period
Steps to Responding to a Data Subject Request:
- Receive the data subject request and forward it to the concerned department.
- Determine if the request is self-raised or on behalf of others, then verify the identity of the individual.
- Determine where the personal data of the individual is stored, whether in systems or physical documents.
- Perform the appropriate action according to the type of data subject request (e.g., copy data, delete data, restrict processing, etc.).
- Provide appropriate details to the Data Protection Officer (DPO) for delivery and response to the data subject.
- Send and document the appropriate response to the individual.
Responding efficiently and transparently to Data Subject Requests is crucial for maintaining compliance with data protection laws and fostering trust with individuals whose data is processed by the organization.
Enforce Security Mechanisms:
The UAE Data Protection Law mandates both Data Controllers and Data Processors to take necessary measures to prevent unauthorized disclosure of personal data. Organizations are required to take reasonable steps to protect personal data, with the definition of “reasonable” often being a business decision supported by legal counsel. This decision is influenced by the organization’s size and the type and amount of personal data being processed.
Organizational Measures:
These involve assessing, developing, and implementing controls to secure information and protect personal data. Examples include:
- Policies and procedures
- Awareness and training
- Business continuity
- Risk assessments and audits
Technical Measures:
These are controls implemented on systems from a technological aspect and include:
- System and physical security
- Encryption or de-identification of personal data
- Robust data disposal measures
- Passwords and two-factor authentication
- Bring Your Own Device (BYOD) and remote access
Which Security Measures to Implement?
The selection of security measures depends on the organization’s size and processing activities. Utilizing established frameworks such as ISO27001 / ISO27701 can assist in assessing and developing adequate measures. To determine the appropriate measures:
- Conduct an information security risk assessment.
- Perform technical vulnerability assessments on high-risk devices and systems.
- Assess and select security measures to mitigate identified risks.
- Keep employees up-to-date on information security and best practices.
Embed Data Privacy into Your Systems, Processes, and Services:
The UAE Data Protection Law mandates Data Controllers to conduct assessments related to the impact of personal data processing and to apply appropriate technical and organizational measures by default. These concepts are known as “Data Protection Impact Assessments” and “Data Privacy by Design and by Default.”
Key Principles:
- Privacy and data protection are embedded into the design of new processes or applications.
- Transparency is maintained, with privacy notices regularly updated to reflect processing activities and practices.
- Safeguards are established and enabled, such as enforcing encryption and data minimization on personal data.
Data Privacy by Default:
- Focuses on data minimization and purpose limitation.
- Requires processing only necessary personal data.
- Involves adopting default privacy settings on systems and providing transparent information and options for individuals to exercise their rights.
Data Privacy by Design:
- Requires embedding data privacy into the design and overall lifecycle of technology, processes, products, or services.
- Involves putting appropriate technical and organizational measures in place to implement data privacy principles.
- Comprises Data Privacy Impact Assessment (DPIA) and Personal Data Change Management.
Notify Data Breaches:
Data breaches can occur for various reasons, despite precautions taken. The UAE Data Protection Law includes breach notification requirements, compelling Data Controllers to immediately inform The Office (the regulator) in case of a data breach. Moreover, if the breach impacts the privacy, confidentiality, or security of the Data Subject’s data, the Controller must also notify the affected Data Subjects.
How to Respond to a Data Breach:
When a data breach is discovered, follow these steps:
- Assess the nature of the breach and confirm if personal data is involved.
- Identify the impacted personal data and how it has been affected.
- Determine if the breach affects the privacy, confidentiality, or security of the Data Subject’s personal data.
- Decide whether to notify The Office (the regulator) and the individuals concerned.
- Conduct a thorough investigation to identify the source of the breach.
Notifying The Office:
When notifying The Office about a data breach, provide the following minimum information:
- Nature of the breach
- Cause of the breach
- Approximate number of affected records or data subjects
- Details of the Data Protection Officer
- Possible and expected impacts of the breach
- Steps taken to investigate and remediate the incident
Top Tips for Dealing with Data Breaches:
- Stay calm and thoroughly investigate before resuming business operations.
- Establish a response plan and communicate it to all employees and relevant third parties.
- Assign responsibility for managing breaches to a dedicated person or team.
- Regularly test the plan to minimize disruption following a breach.
- Manage Third Parties
Manage Third Parties:
The UAE Data Protection Law mandates Data Controllers to ensure that third parties or suppliers receiving Personal Data (i.e., Data Processors) implement suitable safeguards to meet the requirements of the UAE Data Protection Law and maintain ongoing compliance. If a third party is engaged to process personal data, the responsibility may fall on the Data Controller if the service provider violates the law while rendering the service.
Contractual Agreements:
When forming a contractual agreement with a third-party service provider, ensure it contains clauses that compel them to take adequate measures for compliance with the UAE Data Protection Law and other relevant data privacy laws. Key details to include in the contract are:
- The scope, nature, and purpose of processing
- Types of personal data and categories of data subjects
- Minimum terms or clauses required of the processor
- Obligations and rights of the controller
- Obligations of the Data Processor regarding data erasure or handover at the contract’s end
Enhancing Third-Party Risk Management:
Contracts alone may not suffice for managing third-party risks. Consider the following steps to enhance your third-party risk management program:
- Conduct a due diligence assessment to ensure the third party has adequate controls in place for personal data protection.
- Update existing contracts and draft new ones clearly defining roles, responsibilities, and liabilities of both parties.
- Implement ongoing monitoring through risk assessments and audits to ensure third parties maintain adequate controls for personal data protection.
- Understand whether any third-party Data Processors engage sub-processors and ensure appropriate safeguards are in place.
- Protect Personal Data When Transferring Across Borders
- Communicate Data Protection Policies, Practices, and Processes
10. Communicate Your Data Protection Policies, Practices, and Processes:
Ensuring compliance with the UAE Data Protection Law involves more than just legal and compliance departments. It requires the collective understanding and commitment of everyone in the organization. To achieve this, effective communication of data privacy policies and practices is crucial.
For Customers:
- Make the contact information of your Data Protection Officer (DPO) easily accessible, ensuring customers know who to contact for inquiries or complaints.
- Provide information about data protection policies and practices promptly upon request.
- Develop a culture of privacy awareness by aligning data privacy importance with organizational values, implementing practical approaches, and turning them into repeated practices.
- Regularly update your privacy notice to ensure customers understand the processed personal data, how it’s done, and enable them to make informed decisions. The privacy notice should be concise, transparent, written in clear language, delivered timely, and easily accessible.
For Employees:
- Communicate data protection policies and practices to employees, ensuring they understand their roles and responsibilities in processing personal data.
- Cultivate a culture of privacy awareness within the organization by emphasizing the importance of data privacy and implementing practical approaches.
- Use various communication tools such as posters, emails, and others to raise awareness among staff about the significance of personal data protection.
- Send key employees handling personal data to attend regular data privacy training to keep them updated on internal processes and the latest developments in the privacy space.