Appearance
Personal Data Security, Breaches, Impact Assessment, and Cross-Border Transfers
The UAE PDPL gives these rules for the protection of Personal Data:
- Article 20: Personal Data Security obligations of the Controller and the Processor.
- Article 9: the notifications after a breach.
- Article 21: the "Assessment of the Impact of Personal Data Protection" (impact assessment) before the processing starts.
- Articles 22 and 23: cross-border transfers of Personal Data.
In the UAE PDPL, the "State" is the United Arab Emirates, and the Bureau is the UAE Data Bureau, the "Office" of Article 1 (Article 1). For the Modulos Requirements that apply to these Articles, see UAE PDPL in Modulos.
Article 20 — Personal data security
UAE PDPL Article 20 gives the Personal Data Security obligations of the Controller and the Processor:
- The Controller and the Processor shall develop and take appropriate technical and regulatory measures to ensure the highest standard of information security that is suitable for the risks related to data processing in accordance with the best international practices and standards. This shall include the following:
a. Encryption of Personal Data and the application of Pseudonymisation.
b. Applying measures which ensure the continuous confidentiality, safety, accuracy and flexibility of data processing systems and services.
c. Applying measures which ensure timely retrieval of and access to Personal Data in case of any actual or technical failure.
d. Applying measures which ensure a seamless testing and evaluation of the effectiveness of the technical and regulatory measures to ensure the security of processing.
- When evaluating the information security level as set out in Paragraph1 of this Article, the following shall be observed:
a. Data processing risks, including damage, loss, accidental or illegal change and disclosure of or access to the Personal Data, whether being transferred, stored or processing.
b. The costs of data processing, and its nature, scope and purposes, in addition to potential risks impacting the confidentiality and privacy of the Data Subject's Personal Data.
In Article 20(1), the Controller and the Processor must "develop and take appropriate technical and regulatory measures". The information security standard must be "suitable for the risks related to data processing". Article 20(1)(a) to (d) are part of the obligation.
Article 1 of the UAE PDPL gives the definitions of Personal Data Security and Pseudonymisation:
Personal Data Security: A set of technical and organizational measures, procedures and processes specified in accordance with provisions of this Decree by Law which maintain the protection of privacy, confidentiality, integrity and availability of Personal Data
Pseudonymisation: Processing performed on Personal Data in such a way which, after the completion of processing, makes it not possible to associate and attribute such data to the Data Subject without the use of additional information, provided that such additional information is kept independently and securely. In accordance with the technical and organizational measures and procedures specified under provisions of this Decree by Law, it shall ensure that Personal Data is not linked to a specific natural person or that he/she can be identified by using it
Other UAE PDPL Articles also give protection obligations. Article 5(6) is one of the processing controls (Article 5). Articles 7(1) to 7(3) and 8(2) give protection obligations. Articles 8(5) and 8(6) give the Processor disclosure and protection obligations.
Article 9 — Notification of a personal data breach
UAE PDPL Article 9 gives notification obligations to the Controller and the Processor:
| From | To | Provision |
|---|---|---|
| Controller | Bureau | Article 9(1) |
| Controller | Data Subject | Article 9(2) |
| Processor | Controller | Article 9(3) |
For the Controller notifications in Article 9(1) and 9(2), check the UAE Legislation website for the Executive Regulations.
In Article 1 of the UAE PDPL, a Data Breach is "Breaching information security and Personal Data through illegal or unauthorized access". A Data Breach also includes "copying, sending, distributing, exchanging, transferring, circulating or processing it in a way which leads to disclosure of such data to third parties, or destroying or modifying it during storage, transfer and processing".
Notification to the Bureau
UAE PDPL Article 9(1) gives the obligation of the Controller to notify the Bureau:
In addition to the obligations of the Controller stipulated in this Decree by Law, the Controller shall, at the time it becomes aware of the existence of any breach or violation of Personal Data of the Data Subject that would prejudice the privacy, confidentiality and security of data, notify the Bureau of such breach or violation and the investigation rights within the period and in accordance with the measures and requirements set by the Executive Regulations of this Decree by Law, provided that the reporting is accompanied by the following data and documents:
a. A description of the nature of the breach or violation, its form, causes, approximate number and records.
b. Details of the appointed Data Protection Officer.
c. Potential and expected effects of the breach or violation.
d. Corrective measures and actions taken or suggested by it to confront such violation and reduce its negative impacts.
e. Documents of the violation and corrective actions taken by it.
f. Any other requirements required by the Bureau
Article 10(3) gives a different notification: the Controller or the Processor tells the Bureau the "contact details of the Data Protection Officer" (Article 10).
Notification to the Data Subject
UAE PDPL Article 9(2) gives the obligation of the Controller to notify the Data Subject:
In all cases, the Controller shall notify the Data Subject in the event that the violation or breach would prejudice the privacy and confidentiality of the security of his/her Personal Data within the period and in accordance with the measures and requirements set by the Executive Regulations of this Decree by Law. It shall inform him/her of the measures taken by it.
Notification from the Processor to the Controller
UAE PDPL Article 9(3) gives the obligation of the Processor:
If the Processor becomes aware of any breach of Personal Data, it shall notify the Controller of such breach as soon as it becomes aware of the same. the Controller shall in turn inform the Bureau in accordance with Clause (1) of this Article.
Bureau procedure after a notification
For the Bureau procedure after a Controller notification, see UAE PDPL Article 9(4).
Article 21 — Impact assessment of Personal Data protection
UAE PDPL Article 21 gives the conditions in which the Controller must do an impact assessment before the processing starts. Article 21(1) and 21(2) give the obligation and the conditions:
Taking into account the nature, scope and purposes of data processing, the Controller shall, before carrying out the processing, evaluate the impact of the proposed processing operations on the protection of Personal Data, when using any of the modern technologies that would pose a high risk to the privacy and confidentiality of the Data Subject's Personal Data.
The assessment of the impact provided for in Paragraph (1) of this Article shall be required in the following cases:
a. If the processing includes a systematic and comprehensive assessment of the personal aspects of the Data Subject, using automated processing, including profiling, having legal consequences or serious impact on the Data Subject.
b. If processing would be carried out on a large volume of Sensitive Personal Data.
For the definition of Sensitive Personal Data, see Article 1. For Automated Processing and Profiling, see Article 18.
Article 21(3) gives the minimum contents of the impact assessment:
a. Clear and systematic explanation of the suggested processing operations for the protection of Personal Data and the purpose of processing.
b. Evaluation of how necessary the processing operations are and how they are suitable for the purpose of processing.
c. Evaluation of potential risks related to the privacy and confidentiality of the Data Subject's Personal Data.
d. The suggested procedures and measures aimed at reducing the potential risks related to the protection of Personal Data.
Article 21 also gives these rules for the Controller:
- Article 21(4) lets the Controller "carry out one evaluation of a set of processing operations which have similar nature and risks".
- Article 21(5) tells the Controller to "coordinate with the Data Protection Officer upon evaluating the impact of the protection of Personal Data".
- Article 21(7) tells the Controller to "review the evaluation results on a regular basis to make sure that the processing is being carried out in accordance with the evaluation in case the processing risks level changes".
Article 21(6) tells the Bureau to "prepare a list of processing operation types which do not require evaluation of the impact of the protection of Personal Data". The Bureau must also "publish such list on its website". Before you use the Article 21(6) "list", make sure that it includes the type of processing operation.
For the Data Protection Officer, the conditions of Article 10(1), and the obligations in Articles 11 and 12, see Articles 10–12.
Articles 22–23 — Cross-border transfers
UAE PDPL Article 22 gives cross-border transfer cases "approved by the Bureau". Article 23 gives different cases and conditions for cross-border transfers. In Article 1, Cross-Border Processing is "Dissemination, use, display, transmission, reception, retrieval, sharing or processing of Personal Data outside the State".
Article 22: conditions approved by the Bureau
UAE PDPL Article 22 has the name "Cross-Border Transfer and Sharing of Personal Data for Processing Purposes if a Proper Protection Level is Available":
Personal Data may be transferred to outside of the State in the following cases approved by the Bureau:
The State or Province to which the Personal Data is transferred shall have legislations addressing Personal Data Protection. This includes most significant provisions, measures, controls, stipulations and rules related to the protection of the privacy and confidentiality of the Date Subject's Personal Data, and his/her ability to exercise their legal rights. The State or the Province shall also have a judicial o regulatory authority imposing appropriate measures against the Controller or the Processor.
If the State joins a bilateral or multilateral agreement related to the protection of Personal Data concluded with countries to which the Personal Data is transferred.
These rules apply to Article 22:
- The condition "approved by the Bureau" applies to Article 22(1) and 22(2).
- In Article 22(1), the State or Province "to which the Personal Data is transferred" must have the "legislations" and also the authority specified there.
- In Article 22(2), "the State" has the definition of Article 1: the United Arab Emirates.
Before you use Article 22 for a cross-border transfer, make sure that it is one of the "cases approved by the Bureau".
Article 23: other conditions for cross-border transfers
UAE PDPL Article 23 has the name "Cross-Border Transfer and Sharing of Personal Data for Processing Purposes if a Proper Protection Level is not Available". Article 23(1) applies "Notwithstanding Article (22) of this Decree by Law". In Article 23(1), Personal Data "may be transferred to outside the State" if one of these cases applies:
- (a) "Companies, operating in countries where there are no laws for Data Protection, may transfer data under a contract or agreement obligating the companies in such countries to adopt measures, controls and requirements set out in this Decree by Law". The "contract or agreement" also contains "provisions forcing the Controller or the Processor to adopt appropriate measures which are imposed by a judicial or regulatory authority in such countries as set out in the contract".
- (b) "there is an explicit consent granted by the Data Subject to transfer his/her Personal Data outside the State, provided that such transfer shall not contradict the public or security interest of the State".
- (c) The cross-border transfer "is necessary to fulfil obligations and establish rights before judicial entities, exercise or defend the same".
- (d) The cross-border transfer "is necessary to sign or implement a contract made between the Controller and the Data Subject, or between the Controller and third parties to serve the interest of the Data Subject".
- (e) The cross-border transfer "is necessary to implement an action related to an international judicial cooperation".
- (f) The cross-border transfer "is necessary to protect the public interest".
In Article 23(2), the Executive Regulations "set forth the controls and stipulations referred to in Paragraphs (1) of this Article, which should be observed during the transfer of data outside the State". Before you use Article 23 for a cross-border transfer, check the UAE Legislation website for the Executive Regulations.
Records and information about cross-border transfers
Other UAE PDPL Articles give obligations about cross-border processing. Articles 7(4) and 8(7) tell the Controller and the Processor to keep a record that includes "any data related to the cross-border movement and processing of such data" (Controllers, Processors, and the DPO). Before the processing starts, the Controller must give the Data Subject the information of Article 13(1)(b), (d), and (g) (Article 13(2)). Article 13(1)(g) is about the "Protection measures for cross-border processing".
Related pages
Scope, enforcement, and the Executive Regulation
The persons and the processing that the UAE PDPL applies to, the Bureau, complaints, penalties, and the Executive Regulations
Lawful processing and data subject rights
Consent, the processing controls, and the rights of the Data Subject
Controllers, Processors, and the Data Protection Officer
The obligations and records of the Controller and the Processor, and the Data Protection Officer that the Controller must "coordinate with" for an impact assessment
UAE PDPL in Modulos
The UAE PDPL Frameworks in Modulos, the sequence of work, and the Requirements
Sources
- UAE PDPL — Federal Decree-Law No. 45 of 2021: Articles 1, 5(6), 7, 8, 9, 10 to 13, 20 to 23, and 26.
Disclaimer
This page gives general information. It is not legal advice.