United Arab Emirates adopts a federal-level data protection law

The UAE Personal Data Protection Law was adopted on 28 November. Organisations are given 12 months to prepare for compliance from the date when the law will be published in the Official Gazette. It is also expected that executive regulations will be issued within six months.

“The law prohibits the processing of personal data without the consent of its owner, with the exception of some cases in which the processing is necessary to protect the public interest, or that the processing is related to the personal data that has become available and known to all by an act of the data owner, or that the processing is necessary to carry out any of the legal procedures and rights,” states the UAE Cabinet.

The law also establishes the UAE Data Office.

Previously, only the free trade zones of the Dubai International Financial Centre and the Abu Dhabi Global Market have had formal data protection regimes. The United Arab Emirates consists of seven independent city-states: Abu Dhabi, Dubai, Sharjah, Umm al-Qaiwain, Fujairah, Ajman and Ra's al-Khaimah.

See UAE Cabinet - UAE adopts largest legislative reform in its history 

We will publish an analysis of this law in PL&B International Report.