UAE personal data protection law: what applies to apps while the Executive Regulation is awaited

Is the UAE data protection law in force?

Yes. The decree-law was issued on 20 September 2021, published in the Official Gazette on 26 September 2021 and took effect on 2 January 2022 (Article 31). The UAE government portal describes it as an integrated framework for the privacy and confidentiality of personal data and names the UAE Data Office as the federal data regulator.

Much of the operational detail was left to an Executive Regulation, which the Cabinet was to issue within six months of the law (Article 28). Controllers and processors then have six months from the Regulation's issue to bring themselves into line, which the Cabinet may extend once (Article 29). Breach-notification timing, some exemptions and the administrative penalties all wait on it or on a Cabinet decision.

Does it apply to an app built outside the UAE?

Yes, when the app processes the data of people in the UAE. Article 2(1) covers processing, by automated or other means, in relation to data subjects who live or have a place of business in the UAE; controllers and processors located in the UAE, whether their data subjects are inside or outside it; and controllers and processors outside the UAE that process the personal data of data subjects in the UAE.

What falls outside the federal law?

Article 2(2) excludes government data and government bodies that control or process personal data; personal data held by security and judicial authorities; a person processing their own data for personal purposes; health data that has its own protection law; banking and credit data that has its own protection law; and companies and establishments in free zones that have their own data protection legislation.

The UAE government portal lists the DIFC's Data Protection Law (DIFC Law No. 5 of 2020) and Federal Law No. 2 of 2019 on the use of information and communication technology in health fields among the related laws. A health app, or an app operated from a free zone with its own regime, needs that regime checked as well.

When can an app process data without consent, and what makes consent valid?

Article 4 prohibits processing without consent, then lists exceptions, including processing needed to perform a contract the data subject is party to (or to take steps they request before one), to meet obligations under other UAE laws, to protect the data subject's interests, to pursue or defend legal claims, for public health, and for archiving or research under UAE law, plus any cases the Executive Regulation adds.

Under Article 6, consent counts only if the controller can prove it, if it is clear, simple, unambiguous and easy to reach, in writing or electronically, and if it states the right to withdraw and makes withdrawal easy. The data subject may withdraw at any time, and withdrawal does not make earlier processing unlawful.

When does a UAE app need a Data Protection Officer?

Article 10 requires a controller or processor to appoint a Data Protection Officer with enough skill and knowledge when processing would create a high level of risk to privacy through new technologies or the volume of data, when it involves a systematic and comprehensive assessment of sensitive personal data including profiling and automated processing, or when it covers a large volume of sensitive personal data. The officer may be an employee or someone authorised by the company, inside or outside the UAE, and the contact address must be notified to the Data Office.

What happens after a breach, and can the data leave the UAE?

Article 9 requires the controller, once aware of a breach that would prejudice the privacy, confidentiality or security of a data subject's data, to report it to the Data Office with the investigation results, the nature and causes of the breach, the Data Protection Officer's details, the likely effects and the measures taken, within the period the Executive Regulation sets. Affected data subjects must also be told in that case.

Article 22 allows transfers abroad to countries with personal data protection legislation covering the main safeguards, or under agreements the UAE has joined, as approved by the Data Office. Article 23 sets exceptions where there is no adequate protection, including a contract that binds the receiving company to the law's standards and the data subject's express consent.