Data protection has become an increasingly important issue worldwide, with governments implementing new regulations to safeguard personal data and ensure privacy. In Dubai, the introduction of a data protection law impacts businesses operating within the Dubai International Financial Centre (DIFC), a leading financial hub in the region. This guide provides an overview of the key aspects of the Dubai Data Protection Law and what it means for your business.
Note: This article assumes the existence of a new data protection law specifically for Dubai, which, as of the knowledge cutoff date of September 2021, does not yet exist. However, Dubai International Financial Centre (DIFC) introduced a new data protection law, known as DIFC Law No. 5 of 2020 (Data Protection Law), which came into force on July 1, 2020.
- Scope of the law: The DIFC Data Protection Law applies to businesses operating within the DIFC, which process personal data in the context of their activities. The law covers both data controllers (entities that determine the purpose and means of processing personal data) and data processors (entities that process personal data on behalf of data controllers).
- Key principles: The DIFC Data Protection Law is based on internationally recognized data protection principles, such as those found in the European Union’s General Data Protection Regulation (GDPR). Key principles include:
- Lawfulness, fairness, and transparency in data processing.
- Purpose limitation, ensuring personal data is collected for specified, explicit, and legitimate purposes.
- Data minimization, limiting the collection of personal data to what is necessary for the intended purpose.
- Accuracy, keeping personal data accurate and up-to-date.
- Storage limitation, retaining personal data only for as long as necessary.
- Integrity and confidentiality, ensuring appropriate security measures to protect personal data.
- Data subject rights: The DIFC Data Protection Law grants individuals (data subjects) specific rights concerning their personal data, such as the right to access, rectify, erase, restrict processing, object to processing, and the right to data portability.
- Consent and legal basis for processing: To process personal data, businesses must have a valid legal basis, such as obtaining the data subject’s consent, fulfilling a contractual obligation, or complying with a legal requirement. For processing sensitive personal data (e.g., health information, biometric data), stricter requirements apply, and explicit consent is typically required.
- Data breach notification: Businesses are required to notify the DIFC Commissioner of Data Protection of any personal data breaches within 72 hours of becoming aware of the breach. In certain cases, the affected data subjects must also be notified without undue delay.
- Data Protection Officer (DPO): Businesses that engage in high-risk data processing activities or process sensitive personal data on a large scale must appoint a Data Protection Officer (DPO) responsible for overseeing data protection compliance and liaising with the DIFC Commissioner of Data Protection.
- Cross-border data transfers: The DIFC Data Protection Law imposes restrictions on transferring personal data outside the DIFC. Businesses must ensure that appropriate safeguards, such as adequacy decisions or standard contractual clauses, are in place before transferring personal data to countries with inadequate data protection regimes.
- Penalties and enforcement: Non-compliance with the DIFC Data Protection Law can result in significant administrative fines and reputational damage. The DIFC Commissioner of Data Protection is responsible for enforcing the law and can impose fines of up to USD 100,000 for certain violations.
To ensure compliance with the DIFC Data Protection Law, businesses operating within the DIFC should review and update their data protection policies, practices, and procedures. This may involve conducting a data protection impact assessment, appointing a DPO, implementing appropriate security measures, and training staff on data protection principles. If you need assistance with understanding and complying with the DIFC Data Protection Law, our team of experienced lawyers is here to help.
