Lawful Processing and Data Subject Rights

This page gives the rules of the UAE PDPL (Federal Decree-Law No. 45 of 2021) for lawful processing of Personal Data and for the rights of the Data Subject. Article 4 gives the cases in which processing without Consent is permitted. Article 5 gives the controls for all processing. Article 6 gives the conditions for Consent. Articles 13 to 19 give the rights of the Data Subject. For the scope of the UAE PDPL, see Article 2.

Article 4 — Cases of Processing Personal Data without the Consent of its Owner

In Article 4 of the UAE PDPL, processing of Personal Data without Consent is not permitted unless a case below applies:

It is prohibited to process Personal Data without the consent of its owner. The following cases shall be excluded from such prohibition:

1. If the processing is necessary to protect public interest.
2. If the processing is related to Personal Data which has become available and known to all by an act of the Data Subject.
3. If the processing is necessary to initiate any procedures of legal claim or defense of rights or is related to judicial or security procedures.
4. If the processing is necessary for purposes of occupational or preventive medicine in order to assess the employees' ability of to work, performing medical diagnosis, providing health or social care, treatment or health insurance services, managing health or social care systems and services in accordance with the legislation in force in the State.
5. If the processing is necessary to protect public health, including protection from existing diseases and epidemics, or for the purposes of ensuring the safety and quality of healthcare, medicines, drugs and medical devices, in accordance with the legislation in force in the State.
6. If the processing is necessary for archival purposes or for scientific, historical and statistical studies in accordance with the legislation in force in the State.
7. If the processing is necessary to protect the interests of the Data Subject.
8. If the processing is necessary for the purposes of the Controller or Data Subject carrying out their obligations and exercising their legally established rights in the field of employment, social security or laws concerned with social protection, to the extent permitted by such Laws.
9. If the processing is necessary to perform a contract to which the Data Subject is a party, or to take measures at the request of the Data Subject with the aim of concluding, amending or terminating a contract.
10. If the processing is necessary to fulfil specific obligations stipulated in other laws in force in the State for the Controller.
11. Any other cases set out in the Executive Regulations of this Decree by Law.

Each case in Article 4 has conditions. The name of a purpose is not sufficient. The processing must agree with all the conditions of the case:

• Cases 1 and 4 to 10 apply only when the processing is "necessary" for the purpose of the case.
• Case 2 applies to Personal Data that became "available and known to all by an act of the Data Subject".
• Case 3 has two alternatives. The processing is necessary "to initiate any procedures of legal claim or defense of rights", or it "is related to judicial or security procedures".
• Cases 4, 5, and 6 also must agree with "the legislation in force in the State".
• Case 8 applies only "to the extent permitted by such Laws".

Article 4(11) adds the cases "set out in the Executive Regulations of this Decree by Law". Thus Article 4(1) to (10) does not give all the cases. Before you use a case from the Executive Regulations, examine the UAE Legislation website for the Executive Regulations. See Articles 27–29.

If no case applies, the processing must have the Consent of the Data Subject. For the conditions of Consent, see Article 6 on this page.

Article 5 — Personal Data Processing Controls

Article 5 of the UAE PDPL gives the controls for all processing of Personal Data. These controls apply together with Article 4 and Article 6:

Personal Data shall be processed according to the following controls:

1. Processing shall be carried out in a fair, transparent and lawful manner.
2. Personal Data shall be collected for a specific and clear purpose. It shall not be processed at any later time in a manner incompatible with such purpose. However, it may be processed if the purpose is similar or close to the purpose for which this data is collected.
3. Personal Data shall be sufficient and limited to what is necessary in accordance with the purpose for which the processing is carried out.
4. Personal Data shall be accurate and correct and shall be updated whenever necessary.
5. The necessary measures shall be taken to ensure that incorrect Personal Data is deleted or corrected.
6. Personal Data shall be kept securely, including protecting it from any violation, penetration, or illegal or unauthorized processing through the development and use of appropriate technical and organizational measures and procedures in accordance with the laws and legislation in force in this regard.
7. Personal Data shall not be kept after the purpose of its processing has been exhausted. It may be kept if the identity of the Data Subject has been concealed using the "Anonymization Mechanism"
8. Any other controls set out in the Executive Regulations of this Decree by Law.

In Article 5(2), subsequent processing is permitted for a purpose that is "similar or close to" the purpose "for which this data is collected". Subsequent processing "in a manner incompatible with such purpose" is not permitted.

Article 5(7) refers to the "Anonymization Mechanism". Article 1 gives the definition of Anonymization: "Processing which is performed on Personal Data in a way which leads to the anonymity of the Data Subject, not linking and attributing such data to him/her and the inability to identify him/her in any way whatsoever".

Article 5(8) refers to the Executive Regulations. Before you use a control from them, examine the UAE Legislation website.

Article 20 gives more obligations for Personal Data Security to the Controller and the Processor. See Article 20.

Article 6 — "Terms of Consent to Data Processing"

Article 1 of the UAE PDPL gives the definition of Consent. With Consent, the Data Subject "authorizes a third party to process his/her Personal Data". The Consent must show "in a specific, clear and unambiguous manner" that the Data Subject accepts the processing. It must do this "through a clear positive statement or action".

Article 6(1) gives more conditions. All of these conditions apply to Consent:

• (a) "The Controller shall be able to prove the consent of the Data Subject in the event that the processing of Personal Data is based on the consent of the Data Subject."
• (b) The Consent is "prepared in a clear, simple, unambiguous and easily accessible manner, whether in writing or electronically".
• (c) The Consent includes "the Data Subject's right to withdraw it easily".

Article 6(2) gives the rule for the withdrawal of Consent:

The Data Subject may, at any time, withdraw their consent to the processing of Personal Data. Such withdrawal of consent shall not affect the legality of the processing based on the given consent before withdrawing it.

After a withdrawal of Consent, processing without Consent is not permitted unless an Article 4 case applies. The withdrawal of Consent is also a case for erasure in Article 15(2)(b). The conditions and exceptions of Article 15 apply to that erasure. See Article 15.

Data subject rights (Articles 13–19)

Articles 13 to 19 of the UAE PDPL give rights to the Data Subject and obligations to the Controller:

Article	Right
13	Right to Receive Information
14	Right to Request Transfer of Personal Data
15	Right to correction or erasure of Personal Data
16	Right to Restrict Processing
17	Right to Stop Processing
18	Right to Processing and Automated Processing
19	"Contacting the Controller"

Articles 13 to 19 of the Decree-Law give no general time limit for the Controller to complete a request. Article 15(1) has a time condition: "without undue delay".

Article 12(2) also lets the Data Subject "communicate directly with the Data Protection Officer" about the processing of the Personal Data. See Articles 10–12. For complaints to the Bureau, see Articles 24–25.

Article 13 — Right to Receive Information

Article 13(1) of the UAE PDPL gives the Data Subject a right to information from the Controller, on request:

The Data Subject has the right, by submitting a request to the Controller without any consideration, to obtain the following information:

a. The types of its Personal Data that are being processed.

b. Purposes of processing.

c. Decisions made based on automated processing, including profiling.

d. The targeted sectors or establishments with whom its personal data will be shared from inside and outside the State.

e. Controls and standards for the period of storage and preservation of his/ her personal data.

f. Procedures for correcting, erasing or limiting processing and objection to his/ her personal data.

g. Protection measures for cross-border processing carried out in accordance with Articles (22) and (23) of this By-Law.

h. Actions to be taken in the event of a breach or misuse of his/ her Personal Data, especially if the breach or misuse has a direct and serious threat to the privacy and confidentiality of his/her Personal Data.

i. How to submit complaints to the Bureau.

Article 13(2) gives an obligation that applies without a request:

In all cases, the Controller shall, before starting the processing, provide the Data Subject with the information stipulated in paragraphs (b), (d) and (g) of Paragraph (1) of this Article.

For the conditions of cross-border transfers, see Articles 22–23.

Article 13(3) gives the cases in which the Controller is permitted to reject a request for the Article 13(1) information:

The Controller may reject the Data Subject's request to obtain the information mentioned in Paragraph (1) of this Article, if the following is established:

a. The request is not related to the information referred to in Paragraph (1) of this Article, or it is excessively repetitive.

b. The request conflicts with judicial procedures or investigations conducted by competent authorities.

c. The request may negatively affect the efforts of the Controller to protect information security.

d. The request affects the privacy and confidentiality of Personal Data of third parties.

The Controller is permitted to reject the request in each of the cases (a) to (d).

Article 14 — Right to Request Transfer of Personal Data

Article 14 of the UAE PDPL gives the Data Subject two rights.

Article 14(1) gives the right to receive the Personal Data "in an orderly and machine-readable manner". All of these conditions apply:

• The Personal Data "has been provided to the Controller for processing".
• One of two alternatives applies: "the processing is based on the consent of the Data Subject, or it is necessary for the implementation of a contractual obligation".
• The processing "is carried out by automated means".

Article 14(2) gives the right to request the transfer of the Personal Data to a different Controller:

The Data Subject shall have the right to request the transfer of its Personal data to another Controller whenever it is technically feasible.

Article 14(2) gives one condition: the transfer must be "technically feasible". Article 14(2) does not include the conditions of Article 14(1).

Article 15 — Right to correction or erasure of Personal Data

Article 15 of the UAE PDPL gives the Data Subject rights to request correction and erasure of Personal Data. Article 15(1) gives two rights. The Data Subject can request "the correction of his/her inaccurate Personal data". The Data Subject can also request that the Controller completes the data that it holds:

The Data Subject shall have the right to request the correction of his/her inaccurate Personal data, or request to complete the data held by the Controller without undue delay

Article 15(2) gives the right to request erasure, with its conditions:

Without prejudice to the legislations in force in the State and what is required for the public interest, the Data Subject shall have the right to request erasure of his/ her Personal Data held by the Controller in any of the following cases:

a. His/her Personal Data is no longer necessary for the purposes for which it is collected or processed.

b. Withdrawal of the consent of Data Subject on which the processing is based.

c. The Data Subject's objection to the processing, or the absence of legitimate reasons for the Controller to continue the processing.

d. The Personal Data is processed in violation of the provisions of this Decree by Law and the applicable legislations, and the erasure process is necessary to comply with the legislations and approved standards in force in this regard.

Article 15(3) gives the exceptions to the right to request erasure:

As an exception to what is stated in Paragraph (2) of this Article, the Data Subject is not entitled to request erasure of his/ her Personal Data held by the Controller in the following cases:

a. If the request is related to the erasure of his/her Personal Data related to public health in private facilities.

b. If the request affects the investigation procedures and claiming and defending rights.

c. If the request contradicts other legislations to which the Controller is subject.

d. Any other cases determined by the Executive Regulation of this Decree by Law.

Point (d) refers to the Executive Regulation. Examine the UAE Legislation website for the cases that it gives.

Article 16 — Right to Restrict Processing

Article 16(1) of the UAE PDPL gives the Data Subject this right against the Controller:

The Data Subject shall have the right to oblige the Controller to restrict and stop processing in any of the following cases:

a. The Data Subject's objection to the accuracy of the Personal Data, in which case the processing shall be restricted for a specific period to allow the Controller to verify the data accuracy.

b. The Data Subject's objection to the processing of his/ her Personal Data in violation of the agreed-upon purposes.

c. The processing is carried out in violation of the provisions of this Decree by Law and the applicable legislations.

Thus the Controller must restrict and stop the processing when the Data Subject uses this right in one of the cases (a) to (c). In case (a), the Controller must restrict the processing "for a specific period to allow the Controller to verify the data accuracy".

Article 16(2) gives the Data Subject one more right:

The Data Subject shall have the right to request the Controller to continue to keep his/ her Personal Data after the completion of the processing purposes when such data is necessary to complete procedures related to claiming or defending rights and lawsuits.

Article 16(3) lets the Controller continue the processing in some cases:

Notwithstanding what is stated in Paragraph (1) of this Article, the Controller may proceed with the processing of the Personal Data of the Data Subject without his/ her consent in any of the following cases:

a. If the processing is limited to storing Personal Data.

b. If the processing is necessary to pursue any of the procedures related to claiming or defending rights and lawsuits or related to judicial proceedings.

c. If the processing is necessary to protect the rights of third parties.

d. If the processing is necessary to protect the public interest.

Thus the Controller can continue the processing without Consent in the cases (a) to (d), also when Article 16(1) applies. Cases (b) to (d) apply only when the processing is "necessary".

Article 16(4) gives the Controller an obligation to notify:

In all cases, the Controller, if it lifts the restriction stipulated in this Article, shall notify the Data Subject of the same.

Article 17 — Right to Stop Processing

Article 17 of the UAE PDPL gives the Data Subject the right to object to processing and to stop it:

The Data Subject shall have the right to object to the processing of his/her Personal Data and stop it in any of the following cases:

1. If the processing is intended for the purposes of direct marketing, including profiling related to direct marketing.
2. If the processing is intended for the purposes of conducting statistical surveys, unless the processing is necessary to serve the public interest.
3. If the processing is carried out in violation of Article (5) of this Decree by Law.

Case 3 refers to the controls in Article 5 on this page.

Article 18 — Right to Processing and Automated Processing

Article 1 of the UAE PDPL gives the definitions of Automated Processing and Profiling. Article 18 uses these definitions:

• Automated Processing — "Processing which is carried out using an electronic program or system which operates in an automated and automatic manner either completely independently without any human intervention or partially with limited human supervision and intervention".
• Profiling — "A form of automated processing which involves the use of Personal Data to assess certain personality aspects associated with the Data Subject, including analyzing or predicting aspects related to his/her financial performance or condition, health, personal preferences, interests, behavior, location, movements or reliability".

Thus Automated Processing also includes processing with "limited human supervision and intervention".

Article 18(1) gives the Data Subject the right to object:

The Data Subject shall have the right to object to any decisions resulting from automated processing, including profiling, particularly those decisions which have legal impact on or adversely affect the Data Subject.

Article 18(1) uses "particularly". The right applies to "any decisions resulting from automated processing".

Article 18(2) gives the exceptions to the right to object:

Notwithstanding Paragraph 1 of this Article, the Data Subject may not object to the decisions resulting from automated processing in the following cases:

a. If the automated processing is agreed upon under the contract made between the Data Subject and the Controller.

b. If the automated processing is required under other legislations which are applicable in the State.

c. If the Data Subject gives prior consent to the automated processing as set out in Article (6) of this Decree by Law.

Article 18(3) gives the Controller an obligation in these exceptions:

The Controller shall adopt appropriate measures to protect the privacy and confidentiality of the Data Subject's Personal Data in the cases referred to in Paragraph 2 of this article and shall not cause any prejudice to the Data Subject's rights.

Article 18(4) gives one more obligation to the Controller:

The Controller shall include the human element in reviewing automated processing decisions at the request of the Data Subject.

The cases in Article 18(2) apply only to the right to object. They do not apply to the obligation of the Controller in Article 18(4).

Article 19 — "Contacting the Controller"

Article 19 of the UAE PDPL gives this obligation to the Controller:

The Controller shall provide clear and appropriate ways for the Data Subject to contact the Controller to request any of the rights set forth in this Decree by Law.

Next steps

For the UAE PDPL, see also:

• Scope, enforcement, and the Executive Regulation — the scope of the UAE PDPL, complaints, grievances, penalties, and the Executive Regulations.
• Controllers, processors, and the DPO — the obligations of the Controller and the Processor, and the Data Protection Officer.
• Personal Data Security, breaches, impact assessment, and cross-border transfers — Article 20, breach notification, the impact assessment, and cross-border transfers.
• UAE PDPL in Modulos — the Requirements with their articles.

Sources

• The Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, in English on the UAE Legislation website: Articles 1, 4 to 6, 12(2), and 13 to 20.

Disclaimer

This page gives general information. It is not legal advice.