All about Personal Data Protection Law -AHAD

1. All about Personal Data Protection Law The government of the UAE added another layer of importance to data security- The personal data protection law. It is part of the major legal reform implemented on the occasion of the UAE’s50th anniversary; the laws ensure the confidentiality of the information and protect the privacy of a person in the UAE. In this blog, we will discuss the key aspects of the data protection law and some practical steps that companies consider for data protection. What is The Personal Data Protection Law in UAE? It is a comprehensive law that deals with data privacy and the privacy of UAE citizens over the way they choose to share their data with handlers. The United Arab Emirates (UAE) published its first federal-level data protection law Federal-Decree Law No. 45 of 2021 on the protection of personal data protection (‘PDPL) on 21 September 2021. The "UAE Personal Data Protection Law" will be enforceable six months after the associated executive regulations are issued. The Law ensures key international data protection principles and best practices and marks a positive step towards a greater data protection system with international standards. Importance of Data Protection- Every company has data, such as personnel data files, product and service information, accounting details, financial transactions, etc. All the decisions are made on the basis of that data to deliver quality services, in fact, data is the most valuable asset a company has. That's why data protection is considered a top priority for any company. We at AHAD help people, and businesses to grow securely by providing cyber security, digital transformation, and risk management services and solutions according to UAE personal data protection law as ensuring the data held safe is the minimum people expect from companies they deal with or invest money in. To Whom Does The Data Protection Law apply? The UAE Personal Data Protection Law has extraterritorial application and covers- 1.Individuals who process data and are based in the UAE or have a place of business there 2.Organizations based in the UAE that handle the personal data of people living there or elsewhere. 3.Organizations based outside the UAE that handle the personal information of people living there. To Whom Does The Data Protection Law not Apply? 1.Governmental agencies that handle or process personal information. 2.Free zone businesses that are already governed by data protection laws. 3.Those in charge of personal processing data for security and judicial purposes. 4.Health information that is already covered by data privacy laws. 5.People who use their personal data for personal objectives.

2. What is The Basis for Processing Personal Data? The Data Protection lawpreserves the necessity to seek a data subject’s consent in order to process their personal data, which is consistent with the former position under the UAE Penal Code. The data subject's right to withdraw consent must be made plain, straightforward, and unambiguous in the consent, and it must be simple to do so. Businesses that previously did not give this information to data subjects will need to revise their consent forms and policy documents. The Data Protection Law also authorizes processing in the following situations- 1.When processing is required to carry out a contract to which the person is a party, or when the person requests that steps be taken to enter into, amend or terminate the agreement. 2.Beginning or defending legal action, or engaging in judicial or security procedures. 3.Processing personal data required for the organization to comply with its legal obligations under applicable UAE laws. Conclusion The Data protection law constitutes an integrated framework to ensure the data privacy and confidentiality of information in the UAE. It involves both “controller and processors” to maintain a special record for personal data that should be available to the UAE data office if requested. The law encourages data processing controls in a fair, transparent, and lawful manner, and individuals have the right to receive information and request a transfer of their personal data security.