Data Privacy & Protection Advisory

Under Federal Decree-Law No. 45 of 2021 (the PDPL), obligations extend to any entity established in the UAE that processes personal data, and to entities outside the UAE that process personal data of individuals located in the UAE in specified circumstances, subject to defined exclusions. This covers the great majority of operating businesses — anyone with employees, customers, or website visitors is processing personal data. DIFC and ADGM-registered entities fall under those centres' own, separate data protection laws instead of the federal PDPL. PNPC confirms the applicable regime and scope for each specific business rather than assuming a default answer.

The PDPL is the federal law applying to mainland UAE and most free zones without their own dedicated data protection regime. DIFC and ADGM are financial free zones with their own independent legal systems, and each has enacted its own data protection law — the DIFC Data Protection Law and ADGM's Data Protection Regulations respectively — supervised by that centre's own regulator (the DIFC Commissioner of Data Protection and the ADGM Office of Data Protection). A group with a mainland trading entity and a DIFC-registered financial services arm can genuinely be subject to two different regimes for different parts of its operation. PNPC identifies which regime governs which entity at the outset of every engagement.

Personal data broadly means any information relating to an identified or identifiable natural person — names, Emirates ID and passport numbers, contact details, employment and financial records, IP addresses and device identifiers, and biometric data used for access control are all typically in scope. Certain categories — health data, biometric data, data revealing racial or ethnic origin or religious belief, and criminal record data — are commonly treated as sensitive personal data requiring a higher standard of protection and, in most regimes, a narrower set of lawful grounds for processing.

Whether a formal Data Protection Officer appointment is required depends on the applicable regime and the entity's processing volume, sensitivity of data handled, and risk profile — the specific threshold is set out in the applicable law and its implementing guidance. Where an appointment is warranted, PNPC advises on structuring the role, defining its reporting line and authority, and can provide external DPO advisory support under a specifically scoped retainer; this is distinct from a standing, in-house appointment with day-to-day operational authority, which the entity itself typically holds.

UAE data protection regimes generally restrict or place conditions on transferring personal data outside the UAE (or, for DIFC/ADGM entities, outside the relevant free zone) unless an adequate level of protection exists in the receiving jurisdiction or another recognised safeguard — such as appropriate contractual clauses or the data subject's explicit consent — is in place. PNPC reviews each actual transfer the business makes, including transfers to a group parent, an offshore team, or a cloud hosting provider, against the specific safeguard requirements of the applicable regime.

A DPIA is a structured assessment of the privacy risks a specific processing activity creates, typically required or recommended before undertaking processing likely to result in higher risk to individuals — large-scale processing of sensitive data, systematic monitoring, or a new technology deployment with significant privacy implications, for example. PNPC assesses whether a given activity crosses the threshold warranting a DPIA under the applicable regime and, where it does, conducts the assessment before the activity goes live rather than as a retrospective exercise.

UAE data protection regimes typically grant individuals rights including access to their personal data, correction of inaccurate data, deletion in specified circumstances, and objection to certain processing, among others defined by the applicable law. PNPC designs an internal workflow so a request reaching any part of the business — customer service, HR, a general email inbox — is recognised, routed to an accountable owner, and actioned within the relevant timeframe, with the response properly documented.

A functioning breach response plan defines how a suspected incident is detected and escalated internally, who is accountable for assessing its scope and severity, how containment is actioned, how the business determines whether a notification obligation to a regulator or affected individuals has been triggered under the applicable law, and how internal and external communication is managed. PNPC builds this plan around the entity's actual systems and team structure, and walks the relevant staff through it so the first time it is used is not during a live incident.

UAE regulatory practice generally expects consumer-facing documentation, including privacy notices, to be accessible in a manner data subjects can genuinely understand, and Arabic-language availability is a common expectation for businesses serving UAE residents broadly, though the specific requirement can depend on the entity's sector, licensing authority, and audience. PNPC advises on the appropriate language approach for each specific business as part of the notice-drafting stage.

Yes — this is one of the more common engagements we see. A business adopts a privacy policy, often based on a template or a group-standard document, and never verifies it against what its own website forms, CRM, and vendor relationships actually collect and share. PNPC runs a gap assessment comparing the published policy against actual data flows and remediates the mismatch, rather than starting the policy from scratch unnecessarily.

The PDPL and the equivalent DIFC and ADGM laws provide for administrative penalties for non-compliance, with the specific fine amounts and enforcement mechanics set out in implementing regulations and applied by the relevant supervisory authority based on the facts of each case. PNPC does not quote specific penalty figures in general advisory conversations, since enforcement practice and any prescribed amounts can be updated by regulation; we advise clients to treat proportionate compliance investment as materially lower-cost than remediation after a finding or breach.

Data protection law requires 'reasonable' or 'appropriate' technical and organisational security measures proportionate to the sensitivity of the data held, but does not itself prescribe specific technical controls — that is the domain of cybersecurity and IT risk management. PNPC's data privacy advisory identifies what needs to be protected and to what standard, and coordinates with (or refers into) technical cybersecurity work — access controls, encryption, network security — that implements the actual protection, rather than duplicating that technical scope itself.

Yes. Employee personal data — contracts, payroll, visa and Emirates ID details, performance records, and any biometric access-control data — is personal data like any other and is subject to the same lawful-basis, security, and rights obligations under the applicable regime, with employment-specific nuances (such as the basis for processing being tied to the employment relationship rather than standalone consent in most cases). PNPC's data-flow mapping specifically includes HR and payroll systems, which are frequently overlooked when a business focuses primarily on customer-facing data.

PNPC charges a fixed, agreed advisory fee for the scoping, data-flow mapping, policy drafting, and roll-out phases, scoped to the entity's size, number of systems, and data complexity, and confirmed in writing before work begins. Ongoing retainer pricing for periodic review, new-processing assessments, and incident-response support is quoted separately once the initial scope is agreed.

For a single-entity business with a moderate number of systems and no prior programme, PNPC's engagement — from scoping through policy roll-out — typically runs a small number of weeks, depending on how quickly internal stakeholders can be interviewed for the data-flow mapping stage. Groups with multiple jurisdictions, sensitive-data processing, or complex vendor relationships should expect a longer, phased engagement.

Yes. Where the UAE Data Office, the DIFC Commissioner of Data Protection, the ADGM Office of Data Protection, or another relevant authority raises an inquiry, PNPC supports the entity in responding accurately and drawing on the documented data inventory, policies, and processes already built — or, where no programme exists yet, helps assemble a credible response and remediation plan as quickly as the circumstances allow.