Data Privacy & Protection Advisory

Under Federal Decree-Law No. 45 of 2021 (the PDPL), obligations extend to any entity established in the UAE that processes personal data, and to entities outside the UAE that process personal data of individuals located in the UAE in specified circumstances, subject to defined exclusions. This covers the great majority of operating businesses — anyone with employees, customers, or website visitors is processing personal data. DIFC and ADGM-registered entities fall under those centres' own, separate data protection laws instead of the federal PDPL. PNPC confirms the applicable regime and scope for each specific business rather than assuming a default answer.

The PDPL is the federal law applying to mainland UAE and most free zones without their own dedicated data protection regime. DIFC and ADGM are financial free zones with their own independent legal systems, and each has enacted its own data protection law — the DIFC Data Protection Law and ADGM's Data Protection Regulations respectively — supervised by that centre's own regulator (the DIFC Commissioner of Data Protection and the ADGM Office of Data Protection). A group with a mainland trading entity and a DIFC-registered financial services arm can genuinely be subject to two different regimes for different parts of its operation. PNPC identifies which regime governs which entity at the outset of every engagement.

Personal data broadly means any information relating to an identified or identifiable natural person — names, Emirates ID and passport numbers, contact details, employment and financial records, IP addresses and device identifiers, and biometric data used for access control are all typically in scope. Certain categories — health data, biometric data, data revealing racial or ethnic origin or religious belief, and criminal record data — are commonly treated as sensitive personal data requiring a higher standard of protection and, in most regimes, a narrower set of lawful grounds for processing.

Whether a formal Data Protection Officer appointment is required depends on the applicable regime and the entity's processing volume, sensitivity of data handled, and risk profile — the specific threshold is set out in the applicable law and its implementing guidance. Where an appointment is warranted, PNPC advises on structuring the role, defining its reporting line and authority, and can provide external DPO advisory support under a specifically scoped retainer; this is distinct from a standing, in-house appointment with day-to-day operational authority, which the entity itself typically holds.

UAE data protection regimes generally restrict or place conditions on transferring personal data outside the UAE (or, for DIFC/ADGM entities, outside the relevant free zone) unless an adequate level of protection exists in the receiving jurisdiction or another recognised safeguard — such as appropriate contractual clauses or the data subject's explicit consent — is in place. PNPC reviews each actual transfer the business makes, including transfers to a group parent, an offshore team, or a cloud hosting provider, against the specific safeguard requirements of the applicable regime.

A DPIA is a structured assessment of the privacy risks a specific processing activity creates, typically required or recommended before undertaking processing likely to result in higher risk to individuals — large-scale processing of sensitive data, systematic monitoring, or a new technology deployment with significant privacy implications, for example. PNPC assesses whether a given activity crosses the threshold warranting a DPIA under the applicable regime and, where it does, conducts the assessment before the activity goes live rather than as a retrospective exercise.

UAE data protection regimes typically grant individuals rights including access to their personal data, correction of inaccurate data, deletion in specified circumstances, and objection to certain processing, among others defined by the applicable law. PNPC designs an internal workflow so a request reaching any part of the business — customer service, HR, a general email inbox — is recognised, routed to an accountable owner, and actioned within the relevant timeframe, with the response properly documented.

A functioning breach response plan defines how a suspected incident is detected and escalated internally, who is accountable for assessing its scope and severity, how containment is actioned, how the business determines whether a notification obligation to a regulator or affected individuals has been triggered under the applicable law, and how internal and external communication is managed. PNPC builds this plan around the entity's actual systems and team structure, and walks the relevant staff through it so the first time it is used is not during a live incident.

UAE regulatory practice generally expects consumer-facing documentation, including privacy notices, to be accessible in a manner data subjects can genuinely understand, and Arabic-language availability is a common expectation for businesses serving UAE residents broadly, though the specific requirement can depend on the entity's sector, licensing authority, and audience. PNPC advises on the appropriate language approach for each specific business as part of the notice-drafting stage.

Yes — this is one of the more common engagements we see. A business adopts a privacy policy, often based on a template or a group-standard document, and never verifies it against what its own website forms, CRM, and vendor relationships actually collect and share. PNPC runs a gap assessment comparing the published policy against actual data flows and remediates the mismatch, rather than starting the policy from scratch unnecessarily.

The PDPL and the equivalent DIFC and ADGM laws provide for administrative penalties for non-compliance, with the specific fine amounts and enforcement mechanics set out in implementing regulations and applied by the relevant supervisory authority based on the facts of each case. PNPC does not quote specific penalty figures in general advisory conversations, since enforcement practice and any prescribed amounts can be updated by regulation; we advise clients to treat proportionate compliance investment as materially lower-cost than remediation after a finding or breach.

Data protection law requires 'reasonable' or 'appropriate' technical and organisational security measures proportionate to the sensitivity of the data held, but does not itself prescribe specific technical controls — that is the domain of cybersecurity and IT risk management. PNPC's data privacy advisory identifies what needs to be protected and to what standard, and coordinates with (or refers into) technical cybersecurity work — access controls, encryption, network security — that implements the actual protection, rather than duplicating that technical scope itself.

Yes. Employee personal data — contracts, payroll, visa and Emirates ID details, performance records, and any biometric access-control data — is personal data like any other and is subject to the same lawful-basis, security, and rights obligations under the applicable regime, with employment-specific nuances (such as the basis for processing being tied to the employment relationship rather than standalone consent in most cases). PNPC's data-flow mapping specifically includes HR and payroll systems, which are frequently overlooked when a business focuses primarily on customer-facing data.

PNPC charges a fixed, agreed advisory fee for the scoping, data-flow mapping, policy drafting, and roll-out phases, scoped to the entity's size, number of systems, and data complexity, and confirmed in writing before work begins. Ongoing retainer pricing for periodic review, new-processing assessments, and incident-response support is quoted separately once the initial scope is agreed.

For a single-entity business with a moderate number of systems and no prior programme, PNPC's engagement — from scoping through policy roll-out — typically runs a small number of weeks, depending on how quickly internal stakeholders can be interviewed for the data-flow mapping stage. Groups with multiple jurisdictions, sensitive-data processing, or complex vendor relationships should expect a longer, phased engagement.

Yes. Where the UAE Data Office, the DIFC Commissioner of Data Protection, the ADGM Office of Data Protection, or another relevant authority raises an inquiry, PNPC supports the entity in responding accurately and drawing on the documented data inventory, policies, and processes already built — or, where no programme exists yet, helps assemble a credible response and remediation plan as quickly as the circumstances allow.

No. Only the two financial free zones — DIFC and ADGM — have their own independent data protection law and regulator. Non-financial free zones such as JAFZA, DMCC, RAKEZ, IFZA, Meydan, RAK ICC, and Ajman Free Zone do not have a separate data protection statute; entities licensed in these free zones are governed by the federal PDPL in the same way a mainland entity is, even though their trade licence, ownership rules, and company law are administered by the free-zone authority.

A controller is the entity that determines the purpose and means of processing personal data — typically the business collecting data from its own customers or employees. A processor is an entity that processes personal data on the controller's behalf and instructions, such as a payroll bureau, a cloud hosting provider, or an outsourced call centre. UAE data protection regimes place distinct obligations on each role, and a business acting as a processor for a client (a SaaS platform storing its customers' data, for example) has its own set of processor-specific obligations separate from its controller obligations for its own employee and vendor data.

Both, in different ways. The processor typically has a contractual and, depending on the regime, statutory obligation to notify the controller promptly of any breach affecting the data it processes on the controller's behalf. The controller, however, generally retains the ultimate responsibility for assessing whether the breach triggers a notification obligation to a regulator or affected individuals and for managing that response, because the controller is the entity with the direct relationship to the data subject. A vendor contract silent on breach notification timelines leaves the controller unable to meet its own obligations promptly.

Yes. Any collection, storage, or use of a customer's name, phone number, or conversation content through a messaging app used for business purposes is processing of personal data, and the same lawful-basis, security, and retention principles apply as they would to any other customer data channel. Businesses using messaging apps for order confirmations, customer service, or sales frequently treat the channel informally, but the data protection obligations do not change simply because the channel feels conversational rather than formal.

There is no blanket size-based exemption in the PDPL for sole proprietorships or small businesses as such — if the entity processes personal data of customers or employees, the same core obligations apply regardless of headcount. What does vary with size is the proportionate scale of the programme: a sole proprietorship with a handful of customers needs a materially lighter privacy notice, retention approach, and governance structure than a large retailer, but it is not exempt from the underlying obligation to handle personal data lawfully.

Where a business's activity is also regulated by a sector-specific authority — health data under the relevant health authority's rules, financial and banking data under UAE Central Bank regulation — those sector rules typically layer on top of, and can be more specific than, the general PDPL, DIFC, or ADGM framework. PNPC's data-flow mapping identifies where sector-specific rules apply to a particular data category and coordinates the general privacy programme with any sector-specific requirement, rather than assuming the general framework alone is sufficient for regulated health or financial data.

Not every processing activity requires explicit consent — UAE data protection regimes generally recognise multiple lawful bases, including contractual necessity, legal obligation, and legitimate interest, alongside consent. Which basis applies depends on the specific processing activity: fulfilling an order relies on contractual necessity, not consent; sending marketing communications typically does require a specific, freely given consent in most regimes. PNPC maps the correct lawful basis to each processing activity individually rather than defaulting to consent-for-everything, which both over-complicates the customer experience and misstates the actual legal basis being relied on.

Whether re-consent is needed depends on the nature of the change. A clarifying update that does not change what data is collected or how it is used generally does not require fresh consent, though re-publishing the updated notice is good practice. A material change — a new category of data being collected, a new purpose, or a new third party the data is shared with — generally does require fresh notice and, where consent is the underlying lawful basis, fresh consent for the new activity specifically. PNPC reviews each policy update against this distinction before it is published.

A former employee's personal data — held for as long as the entity's retention schedule justifies, for example payroll and end-of-service records kept for a defined period after employment ends — remains subject to the same data subject rights as a current employee's data, including the right to request access. PNPC's data subject rights workflow is designed to route a request regardless of whether the individual is a current customer, current employee, or former employee, so a former staff member's request does not fall through a gap because no one is actively managing that relationship anymore.

The PDPL does not impose a blanket data-localisation requirement forcing all personal data to be stored on servers physically inside the UAE. What it does regulate is the conditions under which personal data can be transferred outside the UAE — requiring an adequate level of protection in the receiving jurisdiction or another recognised safeguard. Certain sector-specific rules (for example, some categories of banking or government-related data) can impose stricter localisation requirements separately from the general PDPL, which is why PNPC checks sector overlap alongside the general cross-border transfer analysis.

The UAE Data Office is the federal authority responsible for overseeing implementation of and compliance with the PDPL. Where a business's data processing also falls under a sector regulator's own rules — the UAE Central Bank for banking and financial data, or a health authority for patient data — that sector regulator's rules apply alongside the Data Office's general PDPL oversight, rather than one replacing the other. PNPC's scoping stage identifies which regulator(s) are actually relevant to a specific business's data processing, since more than one can be relevant simultaneously.

A franchise or joint-venture structure where two legally separate businesses both determine how shared customer data is used can create a joint-controller relationship, which typically requires the parties to have a clear, documented arrangement covering which party handles which obligation — who responds to a data subject request, who is responsible for the privacy notice, and how a breach affecting the shared data is managed. PNPC reviews the underlying franchise or joint-venture agreement specifically for this data-sharing dimension, which general commercial contract drafting frequently leaves unaddressed.

Precise location data is generally treated as personal data requiring the same lawful-basis and security standard as other personal data, though it is not automatically classified in the narrower 'sensitive personal data' category (which typically covers health, biometric, racial/ethnic origin, religious belief, and criminal record data) unless the location data reveals something inherently sensitive, such as regular visits to a place of religious worship or a medical facility. PNPC's data-flow mapping specifically flags location data collection in any mobile app in scope, since it is one of the more commonly under-assessed data categories in app-based businesses.

Personal data transferred as part of a merger, acquisition, or business sale is still subject to the applicable data protection law, and the transfer itself needs a lawful basis — due diligence disclosure to a prospective acquirer typically relies on legitimate interest with appropriate safeguards (such as a confidentiality agreement and data minimisation during the due diligence phase), while the post-completion transfer of the full customer or employee database to the acquiring entity needs to be assessed against the applicable transfer and notice requirements. PNPC advises on structuring the data-handling terms of a transaction alongside the corporate and financial due diligence workstreams.

There is no fixed universal sequence, but PNPC generally recommends confirming the entity's basic regulatory scope — which laws apply to which entity — as an early, shared step across data protection, AML/CFT, and other compliance workstreams, since the underlying group structure and licensing analysis overlaps. From there, the specific sequencing depends on which area carries the more immediate risk or deadline for a given business; a DNFBP facing an imminent AML/CFT inspection may need that workstream prioritised, while a business about to launch a new customer-facing app may need privacy addressed first.

Whether individual notification is required depends on whether the change is material to how the business described its data handling in the existing privacy notice — moving to a materially different hosting location (particularly one outside the UAE where the prior notice specified UAE-based hosting) or a provider with different security or sub-processing arrangements would generally warrant an updated notice and, in some cases, a fresh assessment of the cross-border transfer basis. A like-for-like hosting change within the same jurisdiction and security standard is less likely to require individual notification, though updating the vendor list in the privacy notice is still good practice.

Yes. PNPC can conduct a data protection due diligence review specifically for a transaction context, assessing the target entity's data-flow mapping accuracy, policy-to-practice alignment, cross-border transfer documentation, vendor contract coverage, and breach history, and format the findings for inclusion in a due diligence report or data room. This is a distinct, typically faster-turnaround engagement from a full programme build, focused on identifying and quantifying gaps for the transaction rather than remediating every one of them before the deal closes.

PNPC's engagement focuses on data protection compliance — what data a website collects, how it is used, and whether the notice and consent mechanisms match that collection — rather than website accessibility standards (readability for users with disabilities), which is a separate discipline. Where a client's accessibility work overlaps with privacy notice design (for example, ensuring a cookie consent banner is itself accessible), PNPC coordinates with the client's web team on that specific overlap rather than delivering accessibility compliance as part of the engagement scope.

A general gap assessment reviews the entity's overall data protection programme against applicable law — policies, consent mechanisms, vendor contracts, and governance — to identify where the existing programme falls short. A Data Protection Impact Assessment (DPIA) is narrower and forward-looking: it assesses the specific privacy risk of a single new or changed processing activity before it goes live, such as launching a new app feature or introducing a new monitoring tool. PNPC runs a gap assessment at the outset of most engagements and DPIAs specifically when a new higher-risk processing activity is being introduced or expanded.

For groups with entities in both jurisdictions, PNPC's UAE data protection advisory focuses specifically on the UAE entity's obligations under PDPL, DIFC, or ADGM law as applicable, while coordinating — through PNPC's India offices where relevant — on how data flows between the Indian and UAE entities are structured. This is treated as two related but distinct compliance analyses rather than a single blended framework, since Indian and UAE data protection law are separate legal regimes with their own specific requirements.

Yes. Data protection obligations attach to the processing of personal data regardless of the channel — a retail shop collecting customer details for a loyalty programme, a services office keeping client files, or any business maintaining employee records is processing personal data whether or not it has an online presence. The absence of a website removes website-specific considerations like cookie consent, but does not remove the underlying obligation to handle customer and employee data lawfully, securely, and with an appropriate retention approach.

PNPC's data privacy advisory team monitors updates to PDPL executive regulations, UAE Data Office guidance, and DIFC/ADGM data protection rule changes as part of the periodic review built into every ongoing advisory relationship. Where a regulatory development materially affects an existing client's programme — a new specific requirement for a particular sector, a clarified threshold for DPIAs, or an updated cross-border transfer mechanism — PNPC proactively flags the change and recommends the specific update needed, rather than waiting for the client's next scheduled review to raise it.