UAE Federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021)

Under Article 7(4) keep a dedicated personal data record containing the controller’s and DPO’s details, a description of data categories, the list of persons authorised to access the data, processing times, limits and scope, the erasure and modification mechanism, the purpose of processing, any data relating to cross-border movement and processing, and the technical and organisational information-security measures; produce it to the Data Office on request. Article 20 additionally requires encryption and pseudonymisation, continuous confidentiality and integrity of processing systems, timely restoration of access after failure, and regular testing and evaluation of the measures, in line with international best practice.

Applies when

All controllers within scope; processors carry corresponding record and security duties under Article 8.

Evidence to retain

• · Personal data processing record covering each element of Article 7(4)
• · Access authorisation list and periodic review records
• · Encryption and pseudonymisation implementation note and key management policy
• · Testing and evaluation reports on the effectiveness of security measures

Estimated first-time effort: 6–15 person-days (estimate, not a commitment)

Article 10 requires a DPO with sufficient skills and knowledge in three cases: processing that would create a high-level risk to confidentiality and privacy because of new technologies or data volume; processing involving a systematic and comprehensive assessment of sensitive personal data, including profiling and automated processing; and processing of a large volume of sensitive personal data. The DPO may sit inside or outside the UAE but their contact details must be notified to the Data Office. Article 21 requires an impact assessment before using new technologies posing high risk, and makes it mandatory in the two cases above; it must contain at least a systematic description of the operations and purpose, an assessment of necessity and proportionality, a risk assessment and mitigation measures, must be done in coordination with the DPO, and must be reviewed as risk levels change.

Applies when

AI companies training or running models on biometric, behavioural, health or in-vehicle sensing data will almost always trigger Articles 10 and 21.

Evidence to retain

• · DPO appointment letter, role description and qualifications
• · Record of notifying the Data Office of the DPO’s contact details
• · Impact assessment report covering the four elements in Article 21(3)
• · Periodic review records and the trigger criteria for reassessment

Estimated first-time effort: 8–18 person-days (estimate, not a commitment)

Article 18 gives data subjects the right to object to decisions resulting from automated processing, including profiling, in particular those with a legal impact on or adverse effect for them. The objection is unavailable only where the automated processing is agreed in the contract with the controller, required by other applicable legislation, or covered by the data subject’s prior consent. Even then the controller must adopt appropriate measures to protect the privacy and confidentiality of the data and must not prejudice the data subject’s rights, and must include a human element in reviewing automated decisions at the data subject’s request.

Applies when

Controllers running automated approvals, scoring, screening, content actions or personalised pricing in the UAE mainland, and vendors supplying the decisioning models.

Evidence to retain

• · Automated decision inventory with the Article 18(2) exception relied on for each
• · Human review procedure and sample review records
• · Objection intake channel and case log
• · Retained contract or consent wording covering the automated processing

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)

Article 9 requires the controller, on becoming aware of any breach or violation that would prejudice the privacy, confidentiality or security of a data subject’s personal data, to notify the Data Office within the period and under the procedures set by the Executive Regulations, attaching the nature and form of the breach, its causes, the approximate number and records affected, the DPO’s details, likely effects, corrective measures taken or proposed, and supporting documents; the data subject must also be notified where the breach would prejudice the privacy and confidentiality of their data, and a processor must notify the controller as soon as it becomes aware. On transfers, Article 22 permits transfers to states or provinces with data protection legislation and a judicial or regulatory authority able to impose measures, or with which the UAE has a bilateral or multilateral data protection agreement; Article 23 provides six alternative routes where an adequate level is not available — a binding contract, explicit data-subject consent, judicial claims, performance of a contract, international judicial cooperation, and public interest. Select and document a route for each flow.

Applies when

All controllers and processors in scope, especially Chinese AI companies sending UAE user data back to China for training or hosting it on non-UAE cloud.

Deadline: The notification deadline is set by the Executive Regulations; as none was obtained in this review, operate on an “immediately on becoming aware” basis.

Evidence to retain

• · Breach response plan and notification template covering the six elements of Article 9(1)
• · Breach register and evidence of notifications to the Data Office and data subjects
• · Transfer register (flow, recipient, Article 22 or 23 route relied on)
• · Executed transfer contract under Article 23(1)(a) and its enforceable-measures clauses

Estimated first-time effort: 6–14 person-days (estimate, not a commitment)