Appearance
Controllers, Processors, and the Data Protection Officer
Article 7 of the UAE PDPL gives general obligations to the Controller, and Article 8 gives general obligations to the Processor. Articles 10 to 12 give the rules for the Data Protection Officer (DPO). In English, the UAE PDPL uses the name "Bureau" for the regulator. For the name and the functions of the Bureau, see the definitions of Article 1.
Provisions such as Articles 7(7), 8(11), 10(4), and 11(1)(e) of the UAE PDPL refer to rules in the Executive Regulations. Before you apply these provisions, examine UAE Legislation for the Executive Regulations. For Article 28 and the Executive Regulations, see Article 28 of the UAE PDPL.
Controller and Processor roles
Article 1 of the UAE PDPL gives these definitions of Controller and Processor:
Controller: An establishment or natural person that has Personal Data, and by virtue of its activity, determines whether individually or jointly with other persons or establishments, the method and criteria for processing such Personal Data and the purpose of processing it
Processor: An establishment or Natural Person that processes Personal Data on behalf of the Controller. It processes it under their supervision and in accordance with their instructions
Use these definitions for each "operation or set of operations" on Personal Data (Article 1). For the scope of the UAE PDPL, see Article 2 of the UAE PDPL.
Modulos recommends that your organization record its role for each processing operation. See Roles and scope.
Article 7 — The Controller's General Obligations
Article 7 of the UAE PDPL gives the general obligations of the Controller in seven items. Article 7(1) to (3) are about protection measures and automatic settings: see Protection measures and automatic settings.
Special record, Article 7(4). The Controller must keep a "special record for Personal Data". The Processor must also keep a special record (Article 8(7)). These are the items of the two records:
| Controller record, Article 7(4) | Processor record, Article 8(7) |
|---|---|
| "the data of both the Controller and the Data Protection Officer" | "the data of the Controller, the Processor and the Data Protection Officer" |
| "a description of the categories of Personal Data" | "a description of the categories of Personal Data they have" |
| "details of the persons authorized to access the Personal Data" | "data of the persons authorized to access Personal Data" |
| "processing times, limitations and scope" | "processing times, restrictions and scope" |
| "the mechanism for erasing, modifying or processing Personal Data" | "the mechanism of erasing, modifying or processing Personal Data" |
| "the purpose of processing" | "the purpose of processing" |
| "any data related to the cross-border movement and processing of such data" | "any data related to the cross-border movement and processing of such data" |
| "the technical and organizational measures related to information security and processing" | "the technical and organizational measures related to information security and processing operations" |
| "The Controller shall submit such record to the Bureau whenever requested to do so." | "the Processor submits such record to the Bureau whenever it is requested to do so" |
Processor selection, Article 7(5). The Controller must appoint a Processor that has "sufficient guarantees to implement technical and organizational measures". With these measures, the processing must agree with the processing requirements, rules, and controls in:
- the UAE PDPL
- the Executive Regulations of the UAE PDPL
- "the decisions issued to implement the same".
Information to the Bureau, Article 7(6). The Controller must "Provide the Bureau, pursuant to a decision made by the competent judicial authority, with any information it requests in implementation of its powers stipulated in this Decree by Law and its Executive Regulations."
Other obligations, Article 7(7). The Controller must also obey "Any other obligations set out in the Executive Regulations of this Decree by Law".
Article 8 — The Processor's General Obligations
Article 8 of the UAE PDPL gives the general obligations of the Processor. Article 8(2) is about protection measures: see Protection measures and automatic settings. Article 9(3) tells the Processor to notify the Controller of a breach of Personal Data "as soon as it becomes aware of the same": see Article 9 of the UAE PDPL.
The Processor must obey these obligations:
Instructions and contracts, Article 8(1). The Processor must process "in accordance with the instructions of the Controller and contracts and agreements concluded between them". The contracts and agreements "specify in particular the scope, subject, purpose, nature and type of Personal Data, and the category of the Data Subject".
Processing period, Article 8(3). The Processor must process "according to the purpose and the period specified for it". If "the processing exceeds the specified period", the Processor must notify the Controller. The Controller can then "authorize it to extend such period or give appropriate instructions".
Erasure, Article 8(4). The Processor must "Erase data after the expiry of the processing period or upon handing it over to the Controller."
Disclosure, Article 8(5). The Processor must "Avoid doing anything which would disclose Personal Data or results of processing, except in cases authorized by the law."
Protection, Article 8(6). The Processor must "Protect and secure data processing, the electronic media and devices used in processing and the Personal Data they contain."
Special record, Article 8(7). The Processor must keep a "special record of Personal Data which is processed on behalf of the Controller". For the items of this record, see Article 7.
Compliance, Article 8(8). The Processor must "Provide all means to prove its commitment to the implementation of provisions of this Decree by Law when so requested by the Controller or the Bureau."
Rules and instructions, Article 8(9). The Processor must "Carry out processing in accordance with rules, conditions and controls specified in this Decree by Law and its Executive Regulations, or pursuant to which instructions are issued by the Bureau."
More than one Processor, Article 8(10).
In the event that more than one Processor participates in processing data, the processing shall be carried out in accordance with a written contract or agreement in which they clearly define their obligations, responsibilities and roles with regard to processing, otherwise they shall be deemed jointly responsible for the obligations and responsibilities contained in this Decree by Law and its Executive Regulations.
Article 8(11) of the UAE PDPL adds: "The Executive Regulations of this Decree by Law shall specify the procedures, controls, conditions, and technical standards related to such obligations."
Protection measures and automatic settings
The UAE PDPL gives protection obligations to the Controller in Article 7(1) to (3) and to the Processor in Article 8(2).
Controller, Article 7(1). The Controller must:
Take appropriate technical and organizational measures to implement the necessary standards to protect and secure Personal Data in order to preserve its confidentiality and privacy, and to ensure that it is not breached, destroyed, altered or tampered with, taking into account the nature, scope and purposes of processing and the possibility of risks to the confidentiality and privacy of the Data Subject's Personal Data.
Controller, Article 7(2). The Controller must "Apply the appropriate measures, whether while determining the means of processing or while processing, in order to comply with the provisions of this Decree by Law, including the controls stipulated in Article (5)." Article 7(2) adds: "These measures include the Pseudonymisation Mechanism." For the Article 5 controls, see Article 5 of the UAE PDPL. For the definition of Pseudonymisation, see Personal data security.
Controller, Article 7(3). The Controller must "Apply appropriate technical and organizational measures with respect to automatic settings, to ensure that the processing of Personal Data is limited to the purpose for which it is intended." Article 7(3) adds: "Such obligation shall apply to the volume and type of Personal Data collected, the type of processing which will be carried out, the period of storage and accessibility of such data."
Processor, Article 8(2). The Processor must:
Apply the appropriate technical and organizational procedures and measures to protect Personal Data at the design stage, whether during the identification of the means of processing or during the processing, taking into account the cost of implementing such procedures and the nature, scope and purposes of processing.
Articles 10–12 — the Data Protection Officer
Articles 10 to 12 of the UAE PDPL give the rules for the Data Protection Officer (DPO) of a Controller or a Processor. Article 1 of the UAE PDPL gives this definition of Data Protection Officer:
Data Protection Officer: Any Natural or Legal Person appointed by the Controller or Processor, that undertakes the tasks of ascertaining the extent to which the entity to which it belongs complies with the controls, requirements, procedures and rules for processing Personal Data Protection stipulated herein. It also ensures the integrity of systems and procedures in order to achieve compliance with provisions of the Decree by Law
Appoint a DPO, Article 10
Article 10(1) of the UAE PDPL gives this rule:
The Controller and Processor shall appoint a Data Protection Officer, who has sufficient skills and knowledge of the Personal Data Protection Law, in any of the following cases:
a. If processing would cause a high-level risk to the confidentiality and privacy of the Personal Data of the Data Subject as a result of adopting new technologies or with regard to the volume of data.
b. If processing would involve a systematic and comprehensive assessment of Sensitive Personal Data, including Profiling and Automated Processing.
c. If processing would be carried out on a large volume of Sensitive Personal Data.
For the definition of Sensitive Personal Data, see the definitions of Article 1. For Profiling and Automated Processing, see Article 18 of the UAE PDPL.
Article 10(4) of the UAE PDPL adds: "The Executive Regulations of this Decree by Law shall specify the types of technologies and criteria for determining the volume of data required in accordance with this Article." Also examine UAE Legislation for "the types of technologies and criteria for determining the volume of data".
Article 10(2) of the UAE PDPL gives this rule: "The Data Protection Officer may be an employer of the Controller or the Processor or authorized by them, whether inside or outside the State." UAE Legislation gives this rule for the English Decree-Law: "In case of conflict, the Arabic text will prevail".
Article 10(3) of the UAE PDPL gives this rule: "The Controller or the Processor shall specify the contact details of the Data Protection Officer and notify the Bureau of the same." The notification of a breach from the Controller to the Bureau must include "Details of the appointed Data Protection Officer" (Article 9(1)(b)): see Article 9 of the UAE PDPL.
DPO tasks and protection, Articles 11–12
Article 11(1) of the UAE PDPL gives this rule: "The Data Protection Officer shall ensure the extent of compliance of the Controller or the Processor with the application of provisions of this Decree by Law, its Executive Regulations and instructions issued by the Bureau." Article 11(1) adds: "The Data Protection Officer shall, in particular, undertake the following tasks and powers:"
- (a) "Verifying the quality and correctness of the procedures in place at the Controller and the Processor."
- (b) "Receiving requests and complaints related to Personal Data in accordance with provisions of this Drcree-Law and its Executive Regulations."
- (c) "Providing technical advice on evaluation procedures and periodic examination of personal data protection systems and intrusion prevention systems at the Controller and Processor, documenting the results of such evaluation and providing appropriate recommendations in this regard, including risk assessment procedures."
- (d) "Acting as a link between the Controller or the Processor, as the case may be, and the Bureau regarding the application of personal data processing provisions stipulated in this Decree by Law."
- (e) "Any other tasks or powers which are determined in accordance with the Executive Regulations of this Decree by Law."
For an impact assessment, the Controller must "coordinate with the Data Protection Officer" (Article 21(5)): see Article 21 of the UAE PDPL.
Article 11(2) of the UAE PDPL gives this rule: "The Data Protection Officer shall maintain the confidentiality of information and data it receives in implementation of its duties and powers in accordance with provisions of this Decree by Law and its Executive Regulations and in accordance with the legislations in force in the State."
Article 12(1) of the UAE PDPL tells the Controller and the Processor to "provide all means to ensure that the Data Protection Officer performs the duties and tasks assigned to it as stipulated in Article (11) of this Decree by Law in the required manner". Article 12(1) adds: "In particular, this shall include the following:"
- (a) "Ensure that the Data Protection Officer is appropriately and timely involved in all matters relating to the protection of Personal Data."
- (b) "Ensure that the Data Protection Officer is provided with all the necessary resources and the necessary support to carry out the tasks assigned to it."
- (c) "Not to terminate the Data Protection Officer services or impose any disciplinary penalty for a reason related to the performance of its duties in accordance with the provisions of this Decree by Law."
- (d) "Ensure that the Data Protection Officer is not charged with duties which contradict its duties under this Law."
Article 12(2) of the UAE PDPL gives this rule to the Data Subject: "The Data Subject may communicate directly with the Data Protection Officer about all matters relating to his/ her personal data processing to enable him/ her to exercise his/ her rights in accordance with the provisions of this Decree by Law." For the rights of the Data Subject and the contact with the Controller, see Data subject rights (Articles 13–19).
Related pages
Scope, enforcement, and the Executive Regulation
The Article 1 definitions, the Article 2 scope, the Bureau, and the Executive Regulations
Lawful processing and data subject rights
Consent, Articles 4 and 5, and the rights of the Data Subject
Security, breaches, impact assessment, and cross-border transfers
Personal data security, breach notification, impact assessment, and cross-border transfers
UAE PDPL in Modulos
OFF-24 and MFF-24, the role decision, and the Requirements
Sources
- UAE PDPL — Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data: Articles 1, 2, 7, 8, 9(1)(b), 9(3), 10–12, and 21(5). UAE Legislation.
Disclaimer
This page gives general information. It is not legal advice.