Use UAE PDPL in Modulos

Modulos has two Frameworks for the UAE PDPL. Each Framework has the name UAE PDPL.

This section tells you where to add the Frameworks, how to identify your role, and which steps Modulos recommends. It also gives the Articles of each Requirement, and the work that the Frameworks do not do. Here, "you" is the organization that uses Modulos, as Controller, as Processor, or in the two roles. First, examine if the UAE PDPL applies to your processing. See Article 2.

See the definition of the Bureau.

Recommended AI System structure

Modulos uses Organization and AI System levels for its UAE PDPL Frameworks. The UAE PDPL gives obligations to Controllers and Processors.

Organization AI Systems

You cannot make a new organization AI System in Modulos. If your organization does not have one, contact Modulos before you add Frameworks at the Organization level.

To add the Frameworks:

1. Before you select the AI Systems, examine Article 2 and Article 3.
2. Add OFF-24 at the Organization level to your organization AI System.
3. If a system in scope has no AI System in Modulos, first add an AI System for that system.
4. Add MFF-24 at the AI System level to each AI System with processing in scope.

Roles and scope

Your organization makes the UAE PDPL scope decision and the role decision before the work in the Requirements:

• Scope. Examine Article 2 scope and exclusions and the Bureau exemption in Article 3 and its conditions.
• A record of the scope decision. Modulos recommends that you record the Article 2 decision. Record the processing in the scope, each Article 2(2) item that applies, and the facts for each decision. Article 2 does not make this record an obligation. Do this work in ORF-456.
• Role. Article 1 identifies the Controller and the Processor. For each processing operation, identify your role. See Controller and Processor roles.

UAE PDPL Role tags

In Modulos, each Requirement of OFF-24 and MFF-24 has one or two tags of the type "UAE PDPL Role". The tag values are "Controller" and "Processor":

• "Controller" is for a Requirement that applies where the organization is a Controller in Article 1.
• "Processor" is for a Requirement that applies where the organization is a Processor in Article 1.

For each processing operation, your organization identifies its UAE PDPL Role. One organization can be a Controller for one processing operation and a Processor for a different processing operation.

The UAE PDPL Role tags show the role for each Requirement. Modulos wants to use these tags to remove Requirements from scope by role. Modulos recommends that you record the facts for each role decision.

Requirements of the UAE PDPL Frameworks

OFF-24 and MFF-24 give Requirements for the Articles of the UAE PDPL below. Each row gives the Requirement name and level in Modulos, the Articles, and information on the law.

Requirement	Level	UAE PDPL Articles	Information on the law
MRF-431 Lawful Basis and Consent	AI System	1, 4, 6, and 28 to 31	Article 4, Article 6, Articles 27 to 29, Dates
MRF-432 Personal Data Processing Controls	AI System	5	Article 5
MRF-433 Data Protection by Design and by Default	AI System	7, 8	Articles 7 and 8
MRF-434 Transparency and Data Subject Communication	AI System	13, 19	Articles 13 to 19
MRF-435 Data Subject Rights Handling	AI System	13 to 17	Articles 13 to 19
MRF-436 Automated Decision-Making and Human Review	AI System	1, 18	Article 18
MRF-437 Personal Data Security	AI System	1, 20	Article 20
MRF-438 Data Protection Impact Assessment	AI System	1, 21	Article 21
MRF-439 Cross-Border Transfers of Application Data	AI System	1, 7(4), 8(7), 22, and 23	Articles 22 and 23, Article 7, Article 8
ORF-456 Applicability and Scope Determination	Organization	2, 3	Article 2, Article 3
ORF-457 Controller Accountability and Records of Processing	Organization	7	Article 7
ORF-458 Processor Obligations and Processing Agreements	Organization	1, 8	Article 8
ORF-459 Personal Data Breach Reporting	Organization	1, 9	Article 9, Article 26
ORF-460 Data Protection Officer Appointment	Organization	1, 10	Article 10
ORF-461 Data Protection Officer Roles and Enablement	Organization	11, 12	Articles 11 and 12
ORF-462 Cross-Border Transfer Governance	Organization	22, 23	Articles 22 and 23
ORF-463 Complaints, Grievances, and Enforcement Readiness	Organization	24 to 26	Articles 24 and 25, Article 26
ORF-464 Executive Regulation Readiness and Regulatory Watch	Organization	28, 29, 31	Articles 27 to 29, Dates

For the Controls that are in the UAE PDPL Frameworks and also in other Frameworks, see Control overlap.

Steps that Modulos recommends

To use the UAE PDPL Frameworks, Modulos recommends the steps below, in this sequence. The UAE PDPL does not make this sequence of steps in Modulos an obligation. Use the Requirement table to find the Requirement for each step.

1. Examine if the UAE PDPL applies to your processing.
   • Examine the scope of Article 2, the 7 items of Article 2(2), and the Article 3 exemption.
   • See Article 2 and Article 3.
2. Identify your role for each processing operation.
   • See Controller and Processor roles and UAE PDPL Role tags.
3. Add the Frameworks.
   • See Recommended AI System structure.
4. Apply the Article 7 or Article 8 obligations for your role.
   • Include the special record of Article 7(4) or Article 8(7) for your role.
   • See Article 7, Article 8, and Articles 7 and 8 on the protection of Personal Data.
5. Examine if you must appoint a Data Protection Officer.
   • Article 10(1) gives 3 cases for the Controller and the Processor.
   • See Articles 10 to 12.
6. Check each processing operation against Articles 4, 5, and 6.
   • Use an Article 4 case with its conditions, or get Consent that agrees with Articles 1 and 6.
   • See Article 4, Article 5, and Article 6.
7. Check the rights of Data Subjects and the "ways for the Data Subject to contact the Controller" of Article 19.
   • Check the conditions and exceptions of each right of the Data Subject.
   • See Articles 13 to 19.
8. Apply the Personal Data Security measures of Article 20. Check if Article 21 applies.
   • Where Article 21 applies, the Controller must do the impact assessment before the processing starts.
   • See Article 20 and Article 21.
9. For each breach notification of Article 9, identify who sends it and who receives it.
   • Article 9 gives different notifications for the Controller and for the Processor.
   • See Article 9.
10. Identify each cross-border transfer of Personal Data.
    • Check each cross-border transfer against an Article 22 or Article 23 case and its conditions.
    • See Articles 22 and 23.
11. Identify the complaint and grievance procedures.
    • A stakeholder can make a grievance against a decision, a penalty, or "other action" of the Bureau, on the conditions of Article 25.
    • See Articles 24 and 25 and Article 26.
12. Examine the Executive Regulations and the other instruments.
    • See Check the Executive Regulation.
13. Do the Review of each Requirement.
    • See Reviews in Modulos.
14. Examine the work again when the processing changes.
    • The Controller must "review the evaluation results on a regular basis" to make sure that the processing agrees with the impact assessment, "in case the processing risks level changes" (Article 21(7)).
    • Your organization sets the schedule for the other work.

Check the Executive Regulation

For the UAE PDPL, Modulos recommends that your organization examine the instruments below. Articles 28 and 29 do not make this check an obligation. They do not make it an obligation to give this work to a person, set a schedule, or prepare for the instruments. Do this work in ORF-464.

Before you use a date or rule from an instrument below, examine that instrument:

• Executive Regulations. Examine the UAE Legislation website. See Articles 28 and 29 for the Executive Regulations and regularization. See Dates for the Article 31 date when the Decree-Law "shall come into force". In Article 29, the Controller and the Processor must regularize their status in no more than six months. The period starts on the date of issue of the Executive Regulations, not on the Article 31 date. The Council of Ministers "may extend such period for another similar period".
• Administrative penalties. Examine the Article 26 decision on the UAE Legislation website. See Article 26.
• Impact assessment. Before you use the Bureau's Article 21(6) list, make sure that it includes your processing operation type. See Article 21.
• Cross-border transfers. Examine the Bureau's approval for an Article 22 case. See Articles 22 and 23.

Reviews in Modulos

The Requirement Owner examines the completed work for each UAE PDPL Requirement that applies. If the Requirement Owner finds that the work agrees with the Requirement, the Requirement Owner marks the Requirement as Fulfilled. This Review is necessary after the work is complete. See the governance procedure in Modulos.

External work

The status of a UAE PDPL Requirement in Modulos does not do the work below. Modulos recommends that you do this work independently of the Review of each Requirement:

• Notifications. Send the breach notifications of Article 9 that apply to your role. Notify the Bureau of the "contact details of the Data Protection Officer" (Article 10(3)). See Article 9 and Article 10.
• Contracts and agreements. Keep the instructions of the Controller and the "contracts and agreements concluded between them" that the Processor follows (Article 8(1)). If more than one Processor processes the data, Article 8(10) gives this rule: the processing is "in accordance with a written contract or agreement". Without it, the Processors are "deemed jointly responsible". A transfer in Article 23(1)(a) is "under a contract or agreement". See Article 8 and Articles 22 and 23.
• Records for the Bureau. The Controller and the Processor send their special records of Articles 7(4) and 8(7) to the Bureau when the Bureau requests them. See Article 7 and Article 8.
• The Bureau. An Article 3 exemption and an Article 22 approval come from the Bureau. A complaint of a Data Subject goes to the Bureau (Article 24). A grievance against a decision of the Bureau goes to the General Director of the Bureau (Article 25). See Article 3 and Articles 24 and 25.
• Scope and role decisions. Your organization makes these decisions. A status in Modulos does not make these decisions.

Where to go next

UAE PDPL overview

The dates of the UAE PDPL and where to find each rule

Scope, enforcement, and the Executive Regulation

Articles 1 to 3 and 24 to 29: scope, exemption, complaints, grievances, penalties, and the Executive Regulations

Lawful processing and data subject rights

Articles 4 to 6 and 13 to 19: processing without Consent, processing controls, Consent, and the rights of the Data Subject

Controllers, Processors, and the Data Protection Officer

Articles 7, 8, and 10 to 12: the obligations of the Controller and the Processor, and the Data Protection Officer

Security, breaches, impact assessment, and cross-border transfers

Articles 9 and 20 to 23: personal data security, breaches, the impact assessment, and cross-border transfers

Frequently asked questions

Short information about the UAE PDPL, and where to find each rule

Reviews & Statuses

How the Requirement Owner examines a Requirement

Governance operating model

How AI Systems, Requirements, Controls, and Evidence work together

Sources

• UAE PDPL, the Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data (UAE Legislation).
  • Articles 1 to 26 and 28 to 31.
• UAE Government website, Data protection laws (UAE Government): the UAE Data Office.

Disclaimer

This page gives general information. It is not legal advice.