ADGM Data Protection Regulations 2021 (Abu Dhabi Global Market)

Section 24(1) requires a controller, before or as soon as reasonably practicable after it starts processing personal data, to pay the Data Protection Fee for the twelve months from that date and to notify the Commissioner of its name and address (registered office for a registered company) and the date processing began. Section 24(2) requires a Renewal Fee each year within one month of the anniversary of that date, in the amount set by Board rules. The ADGM Office of Data Protection confirms that all ADGM registered entities processing personal data must register as Data Controllers.

Applies when

Every ADGM-registered entity that processes personal data, including holding or fund vehicles that only process employee data.

Deadline: Before, or as soon as reasonably practicable after, processing begins; renewal within one month of the anniversary.

Evidence to retain

• · Registration confirmation and a screenshot of the registered particulars
• · Receipts for the Data Protection Fee and each Renewal Fee
• · Internal record establishing the date processing began
• · Change log for registered particulars (name, address, DPO)

Estimated first-time effort: 1–3 person-days (estimate, not a commitment)

Section 35(1) requires a DPO where processing is carried out by a public authority (other than courts acting judicially); where the core activities of the controller or processor consist of processing operations that by their nature, scope and purposes require regular and systematic monitoring of data subjects on a large scale; or where core activities consist of large-scale processing of special category data. The DPO may serve one entity, a group or multiple independent entities, may hold other roles, need not be an employee (a written agreement is required) and need not reside in ADGM, provided they are easily accessible to each entity served and no other role conflicts with their duties. Section 35(3) requires appointment on the basis of professional qualities, in particular expert knowledge of data protection law and practice. Section 35(4) requires notification to the Commissioner within one month of appointment or resignation, with the new DPO’s contact details and, on resignation, the reasons.

Applies when

AI businesses built on behavioural analytics, recommendation or fraud monitoring, and products processing biometric or health data, will usually trigger section 35(1)(b) or (c).

Deadline: Notify the Commissioner within one month of appointment or resignation.

Evidence to retain

• · Memo on whether section 35(1) is triggered
• · DPO appointment document or written service agreement
• · Record of the appointment/resignation notification to the Commissioner, evidencing the one-month deadline
• · DPO qualifications and independence note

Estimated first-time effort: 2–6 person-days (estimate, not a commitment)

Section 32(1) requires the controller to notify the Commissioner without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach, unless it is unlikely to result in a risk to the rights of natural persons; a later notification must be accompanied by reasons for the delay. Section 32(2) requires a processor to notify the controller without undue delay. The notification must describe the nature of the breach (including categories and approximate numbers of data subjects and records), give the DPO or contact point, describe likely consequences and the measures taken or proposed; information may be provided in phases without undue further delay. Section 32(5) requires documentation of all breaches, their effects and remedial action, sufficient for the Commissioner to verify compliance.

Applies when

All controllers and processors subject to the ADGM Regulations.

Deadline: Without undue delay and, where feasible, within 72 hours of becoming aware.

Evidence to retain

• · Breach response plan and the rule for determining when the 72-hour clock starts
• · Breach register recording facts, effects and remedial action
• · Submission record of the Commissioner notification and any delay reasoning
• · Text and proof of delivery of data subject communications where section 33 is triggered

Estimated first-time effort: 4–10 person-days (estimate, not a commitment)

On exports: section 41 permits transfers under a Commissioner adequacy decision, and the Commissioner may take into account a European Commission adequacy decision under GDPR Article 45(3). Absent adequacy, section 42 allows reliance without specific authorisation on a legally binding instrument between public authorities, binding corporate rules, standard data protection clauses adopted by the Commissioner under section 42(2) (the Commissioner may approve the European Commission’s or another supervisory authority’s standard contractual clauses, which are then incorporated by reference), or an approved code of conduct or certification mechanism with binding and enforceable commitments; bespoke contractual clauses and administrative arrangements under section 42(4) need the Commissioner’s authorisation. Only if none is available do the section 44 derogations apply, including explicit consent after being informed of the risks of the absence of adequacy and safeguards. On automated decisions: section 20(1) gives the right not to be subject to solely automated decisions with legal or similarly significant effects, with exceptions for contract necessity, explicit consent, and where required or authorised by applicable law (including fraud prevention, AML, and security and integrity purposes). For that third exception the controller must, as soon as reasonably practicable, notify the data subject in writing that a solely automated decision has been taken, and the exception holds only if within one month of receiving that notification the data subject has not asked the controller to reconsider or to take a new decision that is not solely automated. Section 20(3) requires suitable measures for the contract and consent cases, at least the right to obtain human intervention, express a point of view and contest the decision.

Applies when

Every export of data held by an ADGM entity, and any controller running automated AML/fraud blocking, credit scoring or account actions in ADGM.

Deadline: Notification of a solely automated decision: as soon as reasonably practicable. Objection window: one month from the data subject’s receipt of the notification.

Evidence to retain

• · Export register mapping each flow to section 41, 42 or 44
• · Executed standard data protection clauses, BCR approval or Commissioner authorisation
• · Written notification template for solely automated decisions and the sending log
• · Tracking of the one-month objection window and the outcomes of reconsideration or new human decisions

Estimated first-time effort: 8–18 person-days (estimate, not a commitment)