- A new UAE data protection law (Federal Decree-Law No. 45/2021) comes into force and is expected to apply to data processing, including outside the UAE, from September 20, 2022.
- The law regulates lawful data processing, data subject rights, data protection officers, breach notifications and cross-border data transfers; DIFC and ADGM excluded.
At the end of November 2021, the United Arab Emirates has new data protection regulations enacted (Media release), Federal Decree-Law No. 45 of 2021.
The new law applies to the processing of personal data also by data controllers outside the UAE, insofar as processing activities affect affected persons in the UAE. However, the law does not apply to health data and banking and credit data, which are regulated by separate decrees.
The law is expected to be published on January 2, 2022, and implementing regulations are expected by March 20, 2022. Companies must comply with the law six months after the publication of the implementing regulation, which is expected to be from September 20, 2022.
The law contains provisions on the following topics, among others:
- lawful processing of personal data;
- Appointment of data protection officers
- Machining directory;
- Order processing;
- Impact Assessments,
- Data breach notifications,
- Rights of data subjects;
- cross-border data transmission.
The law does not apply to free zones with their own data protection laws. This refers to the Dubai International Financial Centre (DIFC) and Abu Dhabi International Financial Centre (ADGM), both of which have their own privacy policies.