New UAE Data Protection Law
The UAE recently passed a new data protection law. What’s the impact? Here are a few key points you should be aware of. While the law doesn’t set a specific date for enforcement, it does outline the legal obligations of organizations. The deadlines for this law’s enforcement action are not yet known, but the UAE executive regulations are expected to clarify these rules in early 2022.
One notable feature of the law is that it does not diverge from other global privacy laws. International companies with global privacy compliance programs should consider expanding their privacy policies to the UAE. Additionally, the law does not mention a fundamental right to privacy, but it does introduce several new rights for individuals. In addition, it adopts terminology similar to those found in the EU’s General Data Protection Regulation 2016/679.
In order to comply with GDPR, companies must obtain explicit consent before processing personal data. Consent can be oral, written, or electronic. In addition, consent must be specific, informed, and unambiguous. The law also prohibits ‘catch-all’ consent, and it is vital that controllers prove that consent has been obtained. Lastly, the method of obtaining consent must also contain information on the right to withdraw it. While withdrawal of consent does not affect the legality of processing prior to withdrawal, it does affect the validity of processing that has occurred before the withdrawal.
The UAE data protection law does not override existing laws in financial free zones. It will be used alongside existing laws in Dubai’s International Financial Centre and Abu Dhabi Global Market. It will also work alongside the law in Abu Dhabi’s Healthcare City. Ultimately, the UAE’s new data protection law will protect the privacy of individuals who do business in the country. There is no national regulator for the UAE, but there are numerous free zones with specific data privacy laws.
Key Points on the New UAE Data Protection Law
The UAE data protection law will allow companies to process personal data outside the UAE if it meets certain criteria. However, the law is extra-territorial and may not apply to businesses that do not have a nexus with the UAE. However, businesses within free zones may still be required to comply with the law if they are monitoring or targeting EU residents. It is worth noting that companies within free zones will be exempted unless they process large volumes of personal data.
Changes to Data Protection law
What does the new law require of organisations? The law specifies what constitutes personal data, and defines the entities that process it. It also highlights the principles of lawfulness, transparency, accuracy, and security. In addition, the law applies to organisations outside the UAE that do business with the UAE. The UAE already has preexisting personal data protection laws. Therefore, the new law does not affect free zones outside the UAE.
Key points on the new uae data protection law
The UAE’s year-long celebration of its 50th anniversary prompted major legal reforms. One of the first projects is the UAE Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data. The Law will take effect on 2 January 2022, which gives companies a year to prepare for compliance. However, companies should take note that the law will repeal any existing data protection laws that conflict with the new law.