Federal Decree Law No. 45 of 2021 Regarding the Protection of Personal Data (“Data Protection Law”) provides a framework to ensure confidential and protection of information and privacy of personal data.

1. The provisions of this Decree-Law apply to the processing of Personal Data, either in whole or in part, through electronic automated means, or other than such means, by:
   1. a Data Subject who has domicile or place of business in the State.
   2. a Controller or Processor established in the State that conducts Personal Data Processing activities for Data Subjects who are in or outside the State.
   3. a Controller or Processor not established in the State that conducts personal data processing activities for Data Subjects who are in the State.

2. The provisions of this Decree-Law do not apply to:
   • Governmental Data.
   • Governmental authorities which control and process Personal Data.
   • C. Personal Data which is in the possession of security and judicial authorities.
   • Data Subject who processes Data relating to him for personal purposes.
   • Health Personal Data regulated under a special legislation governing their protection and Processing.
   • Banking and credit Personal Data and information regulated under a legislation governing their protection and Processing.
   • Companies and organizations incorporated in the free zones of the State and governed by special Personal Data protection legislation.

PROCESSING OF PERSONAL DATA WITHOUT CONSENT OF THE DATA SUBJECT

The Processing of Personal Data without consent of the Data Subject is prohibited. However, such prohibition is excluded and the Processing is lawful in the following situations:

1. Where the Processing is necessary for the reasons of public interest. 

2. Where the Processing is related to Personal Data which is made available by Data Subject.

3. Where the Processing is necessary to initiate or defend in any procedures relating to claim of rights and legal actions or is in relation to judicial or security procedures.

4. Where the Processing is necessary for the purposes of occupational or preventive medicine to assess the working capacity of an employee, medical diagnosis, the provision of health or social care or the treatment or the management of health or social care systems and services, in accordance with legislation in force in the State.

5. Where the Processing is necessary for the protection of public health, such as the protection from infectious diseases and pandemics, or for ensuring the safety and quality of healthcare, medicines, drugs and medical appliances, in accordance with legislation in force in the State.

6. Where the Processing is necessary for archiving purposes or for scientific, historical or statistical studies in accordance with legislation in force in the State. 

7. Where the Processing is necessary for the protection of interests of the Data Subject.

8. Where the Processing is required for the Controller or Processor to perform its obligations and establish its rights prescribed by law in the area of recruitment or social security or the laws relating to social protection, to the extent permitted by such laws.

9. Where the Processing is necessary for the performance of a contract to which the Data Subject is a party or for taking any actions upon request of the Data Subject for the purpose of concluding, amending or terminating a contract.

10. Where the Processing is necessary for the compliance with obligations prescribed under other laws of the State to which the Controller is subject.

11. Any other situations specified by the Executive Regulations of this Decree-Law.

DATA PROTECTION LAW STIPULATES:

• Personal data protection controls
• Conditions for consent to data processing
• The general obligations of the controller
• The general obligations of the processor
• Notification of personal data breach
• Roles of data protection officer
• Right to access to information
• And right to request personal data portability
• Also right to rectification or erasure of personal data
• Right to restriction of processing
• Cross border transfer and sharing of personal data.

Data Protection Law will come into effect on 2 January 2022.

As per Data Protection Law, all Companies are required to amend Terms & Conditions of their website to ensure strict compliance with the Law.

FAQ about federal decree law no. 45/2021 on the protection of personal data

1- What is UAE Federal Data Protection Law (Law No 45)?

The UAE Federal Data Protection Law (Law 45 of 2021) is the country’s first comprehensive data protection law. The United Arab Emirates adopted Federal Decree No 45 of 2021 (“UAE Federal Data Protection Law,” also known as “Law No 45 of 2021”) on September 26, 2021.

2- What does the UAE’s new data privacy law mean for You?

The UAE has published new regulations to restrict the acquisition and processing of personal data in the nation. This long-awaited breakthrough is consistent with broader international standards in preserving persons’ and personal data privacy.

3- is there a Data Protection Act in the UAE?

The Personal Data Protection Law establishes an integrated framework for ensuring information confidentiality and protecting people’s privacy in the UAE. It establishes the rights and obligations of all parties involved and offers effective governance for data management and security.

To speak to us in relation to Personal Data in UAEs law, please feel free to contact one of the best lawyers in Dubai at Khairallah Advocates & Legal Consultants, which offers comprehensive business and corporate legal services, handling and advising on all aspects of UAE and international business transactions and serving as legal advisers implementing client values by working with them. Their in-house counsels yield a greater understanding of their needs and more effective management of their work.

4- Where can I find federal laws in UAE?

The UAE Government publishes its laws and regulations in the Official Gazette on a regular basis. Federal laws are published in the UAE’s Official Gazette no later than two weeks after the President signs them.

Recent Blogs:

• what is money laundering in Dubai?December 29, 2022
  what is money laundering in Dubai? it refers to the methods used by offenders to hide the source of their money. Making such gains appear… Read more: what is money laundering in Dubai?
• UAE Law of Evidence | All you need to know about Evidence LawNovember 4, 2022
  In the legal procedure and UAE Law of Evidence, evidence is generally defined as any information that is produced by either side to support their… Read more: UAE Law of Evidence | All you need to know about Evidence Law
• The New UAE labor law | The Federal Decree-Law no. 33 of 2021December 28, 2021
  The Federal Decree Law no. 33 of 2021 concerning the regulation of labor relations (the “New Labor Law”) will become effective from 2 February 2022.
• The Crime of Money Laundering and the UAE’s Fight against that CrimeApril 20, 2024
  Anti-money laundering in UAE The United Arab Emirates (UAE) has implemented strict anti-money laundering (AML) measures to prevent money laundering and terrorist financing activities within the country.… Read more: The Crime of Money Laundering and the UAE’s Fight against that Crime
• PROTECTION FROM DOMESTIC VIOLENCE IN THE UNITED ARAB EMIRATESJanuary 10, 2022
  Federal Law Decree No (10) of 2019 aims to achieve the following: 1. Combating the family violence and encouraging social cohesion between the family members and maintaining its structure..
• Physician’s Forbidden Acts under the Federal Decree Law No. (4) of 2016April 25, 2019
  Law prevents the physician from doing (10) forbidden acts some of which were not originally set forth in the old law, e.g. Rooming patients in… Read more: Physician’s Forbidden Acts under the Federal Decree Law No. (4) of 2016

Feel free to contact us for more information or submit your enquiry in our Helpdesk.