Investigation and enforcement

The Commissioner has broad investigative powers under the DPR. Those include the power to:

• order, by notice in writing, Controllers and Processors to provide any information it reasonably requires for the performance of its duties and functions;
• initiate investigations into a Controller’s or Processor’s compliance with the DPR;
• it also has the power to access any equipment used to Process Personal Data (such as computers) and to take possession of any relevant documentation or information. The Commissioner must give written notice of the decision to investigate unless it believes that would likely result in the investigation being frustrated;
• carry out investigations in the form of data protection audits;
• carry out a review on certifications issued pursuant to Section 39 DPR;
• notify Controllers and Processors of any alleged contravention; and
• obtain, by notice in writing, from Controllers and Processors, access to all Personal Data and to all information reasonably necessary for the performance of its duties and functions.

From an enforcement standpoint, the Commissioner has the power to:

• issue and publish directions and warnings and make recommendations to Controllers and Processors that intended Processing operations are likely to contravene the provisions of the DPR;
• issue and publish directions and reprimands to Controllers and Processors where Processing operations have already contravened provisions of the DPR;
• order Controllers and Processors to comply with an individual's requests to exercise his or her rights pursuant to the DPR;
• order Controllers and Processors to bring Processing operations into compliance with the provisions of the DPR, where appropriate, in a specified manner and within a specified period;
• order a Controller to communicate a Personal Data Breach to the individual, where it has not done so already;
• impose a temporary or permanent limitation (including a ban) on Processing;
• order the rectification or erasure of Personal Data or restriction of Processing pursuant to Sections 14, 15 and 16 DPR and the notification of such actions to Recipients to whom the Personal Data has been disclosed, pursuant to Sections 15(2) and 17 of the DPR;
• withdraw a certification if the requirements for the certification are not or are no longer met;
• impose an administrative fine pursuant to Section 55 of the DPR, in addition to, or instead of, any of the other measures set out under the DPR.

When considering whether to issue a fine the Commissioner will consider the circumstances on a case by case basis. For particularly serious breaches the Commissioner may well issue a fine and issue an order for the infringing party to resolve its infringement moving forwards;

• order the suspension of data flows to a recipient inside or outside of ADGM or to an international organisation; and
• where appropriate, refer contraventions DPR to the attention of the court and where appropriate, commence legal proceedings, in order to enforce the provisions DPR.

The DPR also provides a mechanism for Data Subjects to lodge complaints with the Commissioner (Section 57 DPR), and bring claims for compensation where they have suffered “material or non-material damage” as a result of a contravention DPR by a Controller or Processor (Section 59 DPR).

Notably the Commissioner has started to publish enforcement decisions, which are available upon the ADGM website.