The UAE's federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, has been in force since 2 January 2022. It sets out how companies collect, use, store and share personal data about customers, employees and anyone else they deal with.
The detailed executive regulations, which set out deadlines and specific requirements, have been slow to arrive, and sources disagree about their current status. Companies in the DIFC and ADGM follow their own data protection rules. Whatever the exact timing, the law's principles are clear, and most of what it asks for is good IT practice anyway.
What the law expects, in plain terms
- Collect personal data for a clear purpose, and only what you need.
- Keep it accurate, and don't keep it longer than necessary.
- Protect it with appropriate technical and organisational measures.
- Respect people's rights to access, correct and in some cases delete their data.
- Report serious data breaches.
- Take care when transferring personal data outside the UAE.
Where IT comes in
Know where the data is
You can't protect data you can't find. Start with a simple map: which systems hold personal data (CRM, HR, email, file shares, backups, cloud apps), where they are hosted, and who has access.
Control access
Give people access to what their job needs and nothing more. Use multi-factor authentication on email and remote access. Remove accounts promptly when staff leave.
Encrypt and back up
Encrypt laptops and mobile devices so a lost device isn't a data breach. Keep backups, protect them from ransomware, and test that you can restore them.
Keep logs
If something goes wrong, you need to know what happened, when and to which data. Make sure firewalls, servers and key applications keep logs long enough to investigate.
Plan for a breach
Write down who does what if personal data is exposed: who investigates, who decides whether to notify, and who speaks to customers. A one-page plan agreed in advance is far better than improvising.
Check where your cloud data lives
Many cloud services let you choose a hosting region. For personal data, find out where it is stored and whether that location meets your obligations.
A sensible first step
Run a short review of your systems against the points above, fix the gaps that carry the most risk, and keep a record of what you did. That record is useful whatever form the regulations finally take.
Sources
DLA Piper: Data protection laws in the UAE
AWS: United Arab Emirates data privacy
This article is general information about IT practices, not legal advice. Speak to a qualified UAE lawyer about your specific obligations.