Data Protection Controls (Article 5)

Under the PDPL, Personal Data must be processed according to the following controls:

• Processing must be made in a fair, transparent and lawful manner;
• Personal Data must be collected for a specific and clear purpose, and may not be processed at any subsequent time in a manner incompatible with that purpose. However, Personal Data may be processed if the purpose of Processing is similar or close to the purpose for which such data is collected;
• Personal Data must be sufficient for and limited to the purpose for which the Processing is made;
• Personal Data must be accurate and correct and must be updated whenever necessary;
• Appropriate measures and procedures must be in place to ensure erasure or correction of incorrect Personal Data;
• Personal Data must be kept securely and protected from any breach, infringement, or illegal or unauthorized Processing by establishing and applying appropriate technical and organizational measures and procedures in accordance with the laws and legislation in force in this regard;
• Personal Data may not be kept after fulfilling the purpose of Processing thereof. It may only be kept in the event that the identity of the Data Subject is anonymized using the “Anonymization” feature;
• Any other controls set by the Executive Regulations of this Decree Law.

Legal Bases for Processing (Article 4)

The PDPL prohibits Processing Personal Data without the consent of the Data Subject, except in the following cases:

• if the Processing is necessary for the Controller or Data Subject to fulfill his / her obligations and exercise his / her legally established rights in the field of employment, social security or laws on social protection, to the extent permitted by those laws;
• if the Processing is necessary to perform a contract to which the Data Subject is a party or to take, at the request of the Data Subject, procedures for concluding, amending or terminating a contract;
• if the Processing is necessary to protect the interests of the Data Subject;
• if the Processing is for Personal Data that has become available and known to the public by an act of the Data Subject;
• if the Processing is necessary to protect the public interest;
• if the Processing is necessary to initiate or defend against any actions to claim rights or legal proceedings, or related to judicial or security procedures;
• if the Processing is necessary for the purposes of occupational or preventive medicine, for assessment of the working capacity of an employee, medical diagnosis, provision of health or social care, treatment or health insurance services, or management of health or social care systems and services, in accordance with the legislation in force in the State;
• if the Processing is necessary to protect public health, including the protection from communicable diseases and epidemics, or for the purposes of ensuring the safety and quality of health care, medicines, drugs and medical devices, in accordance with the legislation in force in the State;
• if the Processing is necessary for archival purposes or for scientific, historical and statistical studies, in accordance with the legislation in force in the State;
• if the Processing is necessary to fulfill obligations imposed by other laws of the State on Controllers;
• any other cases set by the Executive Regulations.

Processing of Sensitive Personal Data

Unlike the GDPR, the PDPL does not impose more stringent controls around processing of Sensitive Personal Data, however if a Controller or Processor is Processing that involves a systematic and comprehensive assessment of Sensitive Personal Data, including profiling and automated processing, or if the Processing will be made on a large amount of Sensitive Personal Data, then the Controller or Processor must appoint a Data Protection Officer (Article 10).

Article 21 also requires that DPIAs be conducted before Processing that will use any of the modern technologies that would pose a high risk to the privacy and confidentiality of the Personal Data of the Data Subject, if the Processing will be made on a large amount of Sensitive Personal Data (Article 21).

Transparency (Privacy Notices)

The PDPL contains a broad obligation to process personal data in a transparent manner. This obligation is not placed specifically on either Controllers or Processors, so it can be assumed that it is intended to apply to both. Under other data protection laws, the general transparency obligation is often tied to a clear obligation to provide a privacy notice to Data Subjects which meets prescriptive content requirements. The PDPL does (yet) not have an express provision regarding this (although it is possible that the Executive Regulations may do). However, the PDPL does give Data Subjects a detailed right of access (without charge) to the types of information which would ordinarily be contained in a privacy notice. Moreover, per Article 13 of the PDPL, the Controller is required to, in all cases and prior to the commencement of processing, provide Data Subjects with information regarding:

• the purposes of the processing;
• the targeted sectors or establishments with whom the personal data will be shared, both within and outside the UAE; and
• the protection measures for cross-border processing.

Therefore, in practice, Controllers may ultimately consider publishing privacy notices that contain, at least in broad terms, the information that the Data Subject is entitled to seek under the PDPL.

Rights of the Data Subject

Data subjects enjoy a range of rights to control the processing of their personal data replicating those in the EU GDPR. Controllers must provide information on action taken in response to requests within one calendar month as a default, with a limited right for the controller to extend this period thereby a further two months where the request is onerous. 

Right to obtain information (‘data access’) (Article 13)

A Data Subject is entitled to request access to and obtain the following information without charge:

• the types of his / her Personal Data that is processed;
• purposes of Processing;
• decisions made based on Automated Processing, including Profiling;
• targeted sectors or establishments with which his / her Personal Data is to be shared, whether inside or outside the State;
• controls and standards for the periods of storing and keeping his / her Personal Data;
• procedures for correcting, erasing or limiting the Processing and objection to his / her personal data;
• protection measures for Cross-Border Processing;
• procedures to be taken in the event of a breach or infringement of his / her Personal Data, especially if the breach or infringement poses a direct and serious threat to the privacy and confidentiality of his / her Personal Data;
• the process of filing complaints with the Data Office.

Right to request Personal Data transfer (‘data portability’) (Article 14)

The Data Subject has the right to obtain his / her Personal Data provided to the Controller for Processing in a structured and machine-readable manner, so long as the Processing is based on the Consent of the Data Subject or is necessary for the fulfillment of a contractual obligation and is made by automated means.

The Data Subject has the right to request the transfer of his / her Personal Data to another Controller whenever this is technically feasible.

Right to correction or erasure ('right to be forgotten') (Article 15)

The Data Subject has the right to request the correction or completion of his / her inaccurate Personal Data held with the Controller, and has the right to request the erasure of his / her Personal Data held with the Controller in any of the following cases:

• if his / her Personal Data is no longer required for the purposes for which it is collected or processed;
• if the Data Subject withdraws his / her Consent on which the Processing is based;
• if the Data Subject objects to the Processing or if there are no legitimate reasons for the Controller to continue the Processing;
• if his / her Personal Data is processed in violation of the provisions hereof and the legislation in force, and the erasure process is necessary to comply with the applicable legislation and approved standards in this regard.

Right to restriction of Processing (Article 16)

The Data Subject has the right to oblige the Controller to restrict and stop Processing in any of the following cases:

• if the Data Subject objects to the accuracy of his / her Personal Data, in which case the Processing shall be restricted to a specific period allowing the Controller to verify accuracy of the data;
• if the Data Subject objects to the Processing of his / her Personal Data in violation of the agreed purposes;
• if the Processing is made in violation of the provisions hereof and the legislation in force.

The Data Subject has the right to request the Controller to continue to keep his / her Personal Data after fulfillment of the purposes of Processing, if such data is necessary to complete procedures related to claiming or defending rights and legal proceedings.

Right to stop Processing (Article 17)

The Data Subject has the right to object to and stop the Processing of his / her Personal Data in any of the following cases:

• if the Processing is for direct marketing purposes, including Profiling related to direct marketing;
• if the Processing is for the purposes of conducting statistical surveys, unless the Processing is necessary to achieve the public interest;
• if the Processing is in violation the controls referred to in Article 5 (referred to above)

The right not to be subject to automated decision making, including profiling (Article 18)

The Data Subject has the right to object to decisions issued with respect to Automated Processing that have legal consequences or seriously affect the Data Subject, including Profiling. However, the Data Subject may not object to the decisions issued with respect to Automated Processing in the following cases:

• if the Automated Processing is included in the terms of the contract entered into between the Data Subject and Controller;
• if the Automated Processing is necessary according to other legislation in force in the State;
• if the Data Subject has given his / her prior Consent on the Automated Processing.