United Arab Emirates: Controller/Processor Duties

Accountability And DpiaGreen

DIFC Law 2020 introduced DPIA obligations for high-risk processing (absent from the 2007 predecessor) and requires controllers/processors to maintain a 'Privacy Program' demonstrating accountability.

Claims (2):

• DIFC Law 2020 establishes Data Protection Impact Assessment (DPIA) requirements not present under the prior DIFC Law 2007.
• DIFC Law 2020 introduces accountability as a key requirement, stipulating that controllers and processors establish a Privacy Program to demonstrate compliance.

Dpo RequirementsGreen

The PDPL permits but does not universally mandate DPO appointment (employee or outsourced); DIFC requires DPO appointment where necessary, including annual assessments — a requirement more detailed than GDPR's baseline.

Claims (2):

• The PDPL allows an organization's DPO to be an employee or outsourced to a third party with data-privacy expertise, and not all organizations are required to appoint one.
• DIFC Law 2020 requires DPOs to conduct annual assessments, a requirement more nuanced than the GDPR's baseline DPO obligations.

Ropa RequirementsGreen

ADGM and DIFC both require maintenance of Records of Processing Activities, including separate records where both regimes apply to the same entity.

Claims (1):

• ADGM Regulations require controllers and processors to maintain a Record of Processing Activities, including maintaining separate records in both jurisdictions where both ADGM and another regime apply.

Joint Controller ArrangementsRed

No AE-specific joint-controller provisions beyond general controller/processor contract requirements were confirmed in available sources.

Absence provenance: unavailable. Searched: UAE PDPL executive regulations 2024 issued Cabinet Decision breach notification timeline fine.

Security MeasuresAmber

DIFC and ADGM both require technical/organisational security measures, with pseudonymisation referenced as an ADGM security measure.

Claims (1):

• DIFC Law 2020 introduces accountability as a key requirement, stipulating that controllers and processors establish a Privacy Program to demonstrate compliance.

Breach NotificationAmber

DIFC requires controller notification to the Commissioner 'as soon as practicable' for confidentiality/security/privacy-compromising breaches, processor-to-controller notification 'without undue delay', and data-subject notification 'as soon as practicable' (or 'promptly' for immediate-risk cases); federal PDPL breach-timeline specifics remained unconfirmed shortly after enactment.

Claims (3):

• DIFC controllers must notify the Commissioner of a personal data breach compromising confidentiality, security, or privacy 'as soon as practicable in the circumstances', and processors must notify controllers 'without undue delay'.
• DIFC controllers must communicate a personal data breach to affected data subjects 'as soon as practicable' where high risk exists, and 'promptly' where there is immediate risk of damage.
• Shortly after PDPL enactment it remained uncertain exactly how breach reporting timelines (and, by extension, other statutory response windows) would be specified pending executive regulations.

Retention And DisposalAmber

No AE-specific statutory retention period was confirmed; PDPL is described only generally as restricting retention to as long as needed for the original purpose.

Claims (1):

• The PDPL restricts data retention to only as long as needed for the purpose originally captured (data retention principle).