How does the new UAE Federal Decree Law on Personal Data Protection compare against the GDPR?

The PDPL applies to the processing of personal data by any:

1. data subject who resides or has a place of business within the UAE;
2. controller or processor inside the UAE, irrespective of whether the processing of personal data is carried out inside or outside of the UAE; or
3. controller or processor located outside the UAE, who processes personal data of data subjects that are inside the UAE.

The GDPR does not automatically apply where a non-EU organisation processes personal data of individuals in the EU – certain conditions have to be met (targeting or monitoring). PDPL is broader in this regard.

However, GDPR also applies to organisations outside the EU where their processing is “in the context of the activities of an establishment in the EU” – i.e., GDPR can apply when processing is connected to an EU establishment even if that establishment does not carry out the processing. By contrast, PDPL only applies to processing by the UAE person.

The application of the law to data subjects reflects the wording of the PDPL and is somewhat odd as data subjects will often benefit from an exemption if they process data for ‘personal purposes’.

Consent needs to be specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data by a statement or by a clear affirmative action, whether in writing or electronically. This means that businesses can no longer rely on ‘catch all’ consent, which has been commonly used by UAE businesses.

Other consent requirements are similar to those set out in the GDPR. Controllers will need to be able to prove consent. The method for obtaining consent should include information on how the data subject may withdraw consent and the procedure for doing so must be easy for them., Withdrawal of consent does not impact the legality of the processing carried out prior to the withdrawal.

The PDPL provides data subjects with a number of rights including: (i) right to access (ii) request the transfer (which is broadly consistent with the right to data portability under the GDPR); (iii) the right to be forgotten; (iv) the right to restrict; (v) the right to object; and (vi) the right to object to automated processing.

The rights under the PDPL are nuanced and subject to various exceptions which do not fully align with the GDPR. The controller may only reject a data subject’s request in limited circumstances. For example, where the request is for information not covered under the PDPL; or where the request is overly repetitive, conflicts with judicial procedures or investigations; could adversely affect the controller’s information security efforts or otherwise affects the privacy and confidentiality of others’ personal data. The information needs to be provided without charge. The PDPL does not set out a timeline for a controller to respond to a data subject access request, although this is expected to be covered in the Executive Regulations.

Like GDPR, the PDPL contain a general security obligation for controllers and processors, that requires them to put in place measures appropriate to the level of risk.

The PDPL provides that the controller and processor must implement technical and organisational measures to maintain a high standard of data security appropriate to the level of risk, which may include encryption and pseudonymisation, implementation of technical and organisation measures that guarantee the availability of personal information and measures for testing and assessing the effectiveness of implemented measures.

Like the GDPR, the PDPL introduces the role of the data protection officer (DPO).

Under the GDPR, public authorities and any organisation whose core activities require “regular and systematic monitoring” of data subjects “on a large scale” or “large scale” processing of special categories of data or criminal convictions and offences are required to appoint a DPO.

Although the situations in which it is mandatory to appoint a DPO seem to be influenced by the GDPR, they are different. The PDPL requires a DPO to be appointed when the processing would cause a high risk to the privacy of the data subject as a consequence of adopting new technologies, the processing would involve a systematic and comprehensive assessment of sensitive personal data, including profiling and automated processing, and/or or where the processing will be made on large volumes of sensitive personal data.

Like the GDPR, the PDPL provides that companies must appoint a DPO who has sufficient skills and knowledge in data protection to oversee compliance.

The DPO can be an employee of the company or an external party who may be based inside or outside the UAE. As such, companies who have DPOs for GDPR purposes could use the same individual to fulfil a similar role in relation to the UAE, provided that individual has training and support on UAE requirements. Moreover, the PDPL outlines that resources should be made available to the DPO to guarantee that they are able to carry out their responsibilities.

The PDPL introduces a requirement on data controllers to perform DPIAs when using any modern technology that would pose a high risk to privacy and confidentiality. Under GDPR, “high risk” is measured by reference to the risk of infringing a natural person’s rights and freedoms – but the PDPL talks about a high risk to the privacy and confidentiality of the personal data. It remains to be seen if this difference in language results in a significant difference in practice. Also, it is notable that the PDPL limits the DPIA requirement to where “modern technology” is used. Whilst the GDPR calls out the use of new technologies in particular, the requirement to carry out a DPIA is not limited to these situations.

The PDPL sets out the minimum information that should be included in an impact assessment and these overlap with the requirements of a DPIA pursuant to GDPR. For example, a clear explanation of the nature of the processing activity concerned and the purpose, an assessment of the necessity of the processing in relation to its purpose, an assessment of the potential risks on the protection of personal information of data subjects and the suggested measures to mitigate the potential risks of such processing activities.

It is expected that the Data Office will prepare a list of the type of processing operations for which no personal data protection impact assessment is required made available through its website.

Data breaches must be notified to the UAE Data Office immediately upon awareness. The obligation is to report any personal data breach that would “prejudice the privacy, confidentiality and security of a data subject’s personal data”. The obligation applies to all data breaches, whereas the GDPR’s supervisory authority notification obligation in relation to personal data breaches does not apply to breaches that are unlikely to result in a risk to data subjects. The strict timing under the PDPL is notable – it is immediate, whereas GDPR specifies that notification should be without undue delay and, where feasible, not later than 72 hours.

The controller must also notify the data subject of the breach and, unlike the GDPR, there is no higher threshold (e.g., high risk) for any such data subject notification than that which is set for notifying the Data Office. More details in respect of notifying data subjects will be set by the Executive Regulations, including any reporting period.

Similar to the GDPR, there is an obligation on processors to inform the controller of any breach – though under this is as soon as they become aware of it (rather than the GDPR’s timing, which is “without undue delay”).

The PDPL sets out that businesses may only use personal data for direct marketing purposes with the consent of the data subject. Under the GDPR, processing for direct marketing purposes is given as an example of processing that could be necessary for the legitimate interest of a controller (though separate e-Privacy legislation could require consent).

Like the GDPR, the PDPL has a right for data subjects to object to processing for direct marketing purposes.