Guide to the United Arab Emirates (UAE) Personal Data Protection Law (PDPL)

In this guide:

1. Overview of the UAE PDPL
2. Recommendations for business compliance
3. Keys to External Data Privacy (EDP)

Overview of the United Arab Emirates (UAE) Personal Data Protection Law (PDPL)

The United Arab Emirates (UAE) created its most comprehensive federal data protection regulation to date when it published the Personal Data Protection Law (PDPL). Formally named Federal Decree-Law No. 45/2021 on the Protection of Personal Data, the legislation was implemented in January 2022 and has been amended since. Of note, this only governs the onshore UAE, and does not include the offshore financial and healthcare center “free zones.” Thus, the Dubai International Financial Centre (DIFC), Abu Dhabi Global Market (ADGM), and Dubai Healthcare City (DHCC) each have their own legal frameworks to govern data protection and are not covered by the UAE PDPL.

To enforce the PDPL, the UAE assigned supervising authority to its Data Office, which was established under a separate federal decree issued previously. For two years after the PDPL implementation, the Telecommunications and Digital Government Regulatory Authority (TDRA) will be providing assistance to ensure more seamless enforcement and communications. More specifically, the Data Office will have the following responsibilities:

1. Drafting and formulating policies, strategies, and laws concerning data protection matters and overseeing their execution.
2. Conducting inquiries essential for ensuring adherence to data protection regulations.
3. Addressing complaints and grievances regarding data protection.
4. Validating them in collaboration with relevant authorities.

Because of the growing importance of online data privacy, the UAE PDPL was created to regulate the processing of personal data in the UAE and thereby ensure the protection of individuals right to privacy. The PDPL aligns with global standards to provide a framework for organizations handling personal data to follow when processing the personal data of anyone in the UAE, whether they are citizens, residents or visitors in the UAE and regardless of the data processor’s location. By having this extraterritorial scope, the UAE ensures the PDPL applies to every individual or group processing data from individuals located in the country.

There is also a fairly unique provision in the PDPL to include all data processors located in the UAE, even if they only process the data of individuals outside of the country. The inclusion of this broad scope is critical for shielding the public from unethical data processing activities and ensures they must give consent and have visibility for the use of their personal information.

To empower the public with greater control over their data privacy, the UAE PDPL enumerates the following rights:

• Right to be informed prior to the start of data processing about the purposes for data collection, the third parties with whom data would be shared, and the security processes in place to protect data during cross-border processing.
• Right to access any personal data held by an individual or organization in a machine-readable format.
• Right to rectify or correct any inaccurate personal data being held by the data processor.
• Right to delete or erase personal data held by the data processor.
• Right to object and opt-out the use of personal data by an individual or organization if the processing is for marketing or survey purposes.
• Right to data portability which means data must be provided to the data subject (the individual whose data is being processed) in a format that is easy to transmit to another organization.
• Right to reject automated decision-making in regards to the processing of their personal data.

When these rights are violated, individuals can contact the UAE Data Office to potentially launch an investigation into the improper practices employed by the accused organization. Penalties can be levied by the Data Office from there.

This is a significant step forward for the public in the UAE, offering them increased control and protection of their personal information online with actions they can take if and when their rights are violated. In doing so, organizations must become more transparent and accountable in their data collection and usage processes. This creates a ton of benefits overall, as the public can more easily trust their data is being handled responsibly, individuals are empowered to manage their own privacy, and there’s generally a reduced risk of data misuse since any gross negligence can be punished. In addition, businesses who get ahead of the data privacy curve can differentiate themselves and further increase brand equity with consumers.

(Source: Official UAE Government portal)

Recommendations for business compliance

The UAE PDPL imposes numerous obligations on organizations operating in the UAE or processing the data of individuals located in the country. These obligations cause significant impacts to a business and require proactive action be taken to ensure compliance via proper data handling and cybersecurity practices. But making these practices a priority will help any organization get and stay ahead of global data privacy laws, which are only becoming more stringent over time.

Specifically, the PDPL includes the following requirements:

1. Obtaining informed consent: Individuals must give clear and specific consent for their data to be collected and used.
2. Data minimization: Businesses can only collect data that is necessary for the specific purpose it is intended for.
3. Data security measures: Implementing appropriate technical and organizational measures to protect data from unauthorized access, loss, or damage.
4. Data subject rights: Individuals have various rights over their data, like access,rectification, erasure, and objection to processing.
5. Data breach notification: Businesses must report data breaches to the authorities and affected individuals within a specific timeframe.
6. Record-keeping: Maintaining records of data processing activities and consent obtained.

Any effective organization should consider how this changes their potential costs and resource allocation, necessitates the need to revamp existing processes, and adds potential risk for non-compliance. Overall, the UAE PDPL presents both challenges and opportunities for businesses. While complying with the law requires effort and investment, it can also be seen as an opportunity to build trust, enhance data security, and gain a competitive edge in the marketplace.

With so much included as part of the UAE PDPL, the following best practices are an easier way to keep your company’s data privacy processes and procedures in order:

• Understand and align with PDPL requirements: Thoroughly understand the provisions and regularly review updates to ensure full compliance. Align business practices and data processing activities with the specific requirements outlined in the legislation.
• Establish a robust privacy policy: Develop and maintain a comprehensive privacy policy that clearly communicates how personal data is collected, processed, and protected. Ensure that the privacy policy is easily accessible to data subjects.
• Implement explicit consent mechanisms: Obtain explicit and informed consent from individuals before collecting, processing, or using their personal data. Clearly communicate the purposes for data processing and allow individuals to make informed decisions about their information.
• Data minimization and purpose limitation: Practice data minimization by collecting only the minimum amount of personal data necessary for the intended purposes. Ensure that data processing activities align with the specific purposes for which consent was obtained.
• Secure data management: Implement robust security measures to protect personal data from unauthorized access, disclosure, or alteration. Regularly assess and update security protocols to address evolving threats.
• Ensure data accuracy and currency: Establish procedures to maintain the accuracy, completeness, and currency of personal data. Regularly review and update records to reflect any changes in individuals’ information.
• Enable Data Subject Rights: Facilitate the exercising of data subject rights, including the right to access, correct, and delete personal data. Establish mechanisms for individuals to easily submit requests related to their data.
• Anonymization: Where applicable, utilize anonymization or pseudonymization techniques to process personal data, especially if it is still possible to fulfill the intended purposes through these methods.
• Train employees on data protection: Provide comprehensive training to employees on data protection principles, PDPL requirements, and the organization’s privacy policies. Foster a culture of privacy awareness and responsibility.
• Regularly audit and monitor compliance: Conduct regular internal audits to assess compliance with PDL requirements. Monitor data processing activities to identify and address any deviations from established privacy practices.

Data breaches can bring hefty fines, especially for blatant disregard of individuals’ privacy rights. To avoid this, meticulously document every action you take to protect customer data and comply with regulations. Remember, most authorities assess your overall efforts, particularly during an unexpected breach. It’s vital to stay updated on the latest provisions and any changes to international laws over time, as non-compliance simply isn’t worth the risk.

The data privacy landscape isn’t changing, so the choice is simple: prioritize data protection and gain a competitive edge, or risk losing customers and facing financial penalties.

Keys to External Data Privacy (EDP)

Personal data protection is vital for organizations engaged in online service delivery today, especially for sensitive data. New regulations are popping up every day around the world. Currently, more stringent opt-in policies are the trend to grant consumers even more rights. In most countries, the public now has the ability to review and remove their personal data. This increases the accountability and obligations of every organization processing personal identifiable information (PII).

Yet the onus still falls on the individual to oversee, assess, update and delete their personal data wherever it may be collected and dispersed across the internet. That’s a lot to handle.

Monitoring and removing data exposures becomes a massive lift for any business looking to protect their organization from data breaches. When working to cover an entire company, it is practically impossible for a single person or small team to manage External Data Privacy without help from a specialized team of privacy experts. The identification and subsequent elimination of this data plays a pivotal role in deterring cybercriminals from launching dangerous social engineering attacks against an organization.

That’s why Privacy Bee emerges as the ideal solution. The process of monitoring and eradicating employee data as a complement to cybersecurity is a must, but it’s incredibly time-consuming. Privacy Bee already covers every site across the internet exposing your organization’s data and puts it to work for you. This data monitoring and deletion service is especially effective for executives who are highly visible to the general public.

Using sophisticated automation processes backed by an active human service team, Privacy Bee substantially reduces a company’s attack surface and mitigates the looming threat of an expensive data breach. Industry estimates put the cost of a single data breach anywhere between $7-10 million USD. That can be crippling for a small or mid-size business–not to mention the fines from noncompliance–which is why a proactive approach for maximum security is a must.

Social engineering attacks are already the most successful attack vector and are considered the fastest-growing data breach threat, no matter how mature an organization’s cybersecurity program is today. If your response to these attacks isn’t already thorough, then threat actors still have a lucrative way to target and obtain your organization’s most sensitive information, either holding it for ransom of selling it to competitors or bad actors abroad.

Ideally, you are already conducting risk assessments and vendor surveys as well. If so, well done! However, it is absolutely essential to recognize vendors are most susceptible to a breach via social engineering attacks relying on exposed personal data. Privacy Bee not only minimizes the proliferation of your organization’s data across the vast digital landscape but also extends its protection to vendors, helping to ensure third party partners do not serve as the weak link in an organization’s security defenses. Don’t miss this step, as there are far too many massive organizations falling victim to cyberattacks due to a vendor’s lack of proactive security. It happens every day.

Why would someone do such a thing?

In the growing billion-dollar surveillance industry, Data Brokers and People Search Sites are the key players. They reap record-breaking profits by trading and transferring your organization’s information with obscure and uncontrollable entities. These entities then either publish this information directly for clicks or compile it all to sell on again to yet another organization. Because of these groups, you and your employees’ personal data can be easily found by doing a quick Google (or Bing, or any other engine!) search.

If it’s that simple to find you and your coworker’s information, then threat actors can launch cyberattacks at scale by targeting the most vulnerable team members with emotionally engaging messaging that turns even the most highly-trained professionals into victims on a regular basis. No amount of training of internal cybersecurity defenses can 100% prevent this. The only way to stop these attacks is by stopping the data flow at the source. The consequences are simply too costly to risk:

• A single data breach leads to massive productivity losses, expensive remediation efforts, and a high likelihood of repeat breach incidents.
• This isn’t new, and is a predicament that plagues the vast majority of businesses following an initial breach. Industry estimates state as many as 83% of organizations who experienced a data breach go on to experience multiple. That is staggering, and is exactly what Privacy Bee is fighting back against.
• The initial data breach sets off a chain reaction that inflicts short-term damage on your bottom line while eroding brand value and customer trust over time.
• Furthermore, there are ripple effects to consider, such as an increase in spam emails and telemarketing along with heightened employee turnover due to poaching.

Privacy Bee combats threat actors lurking beyond your organization’s internal defenses. By meticulously analyzing every external location across the internet where your personal and sensitive data resides, then swiftly purging it, Privacy Bee closes the data security gap. The service even encompasses dark web monitoring and provides timely data breach notifications if another company falls victim to an exploitation incident and exposes your information in the process.

Our unwavering commitment is deeply rooted in the belief that privacy is an inalienable human right that transcends political discourse and negotiations. This is why Privacy Bee vigilantly monitors user data for security vulnerabilities while holding the surveillance industry accountable. We compel Data Brokers, People Search Sites, and more than 160,000 additional Custom Sites to expunge your data and opt out of further data collection to protect you, your family, and your entire organization. This unchanging goal is the reason we offer no-charge monitoring services and deletion guides. You need only reach out when help is needed.

Privacy Bee protection covers a wide range of potential threats, including:

1. Data breaches
2. Social engineering attacks
3. Doxxing
4. Spam emails
5. Telemarketing calls
6. Cyberstalking
7. Identity theft
8. Swatting
9. Blackmail
10. And more!

Privacy Bee is quickly emerging as the next necessary tool in your security tool belt. There’s no better addition for business leaders with a mature cybersecurity program wanting to protect employee and customer data in the midst of innovative threat actors using AI and other new systems to scale their efforts.

Privacy is more important and harder to come by than ever. Today, you need a trusted partner fighting to preserve your personal and organizational integrity.