Describe your business, leave with a checklist you can assign

Regulation 10.3.1 requires any system used in products, services or use cases that may affect a data subject, positively or negatively, to be designed to be Ethical (unbiased algorithmic decisions and data lineage, with bias mitigated), Fair (treat individuals equally, avoid or mitigate bias leading to unfair outcomes), Transparent (processing explainable to data subjects and stakeholders in non-technical terms with appropriate supporting evidence), Secure (personal data protected and confidential, preventing breaches causing reputational, psychological, financial or professional harm) and Accountable (internal governance and control frameworks or regular external audit enabling assessment of algorithms, data and design processes). Regulation 10.3.2 prohibits commercial use of any system unless it can process personal data only for human-defined or human-approved purposes — or for purposes it defines itself solely on the basis of human-defined principles and strictly within human-defined constraints — and is designed in compliance with 10.3.1 and any further audit and certification requirements the Commissioner establishes. Regulation 10.3.4 deems the Deployer a Controller and the Operator a Processor, so liability follows.

Evidence: Conformity note against the five design requirements and design review records; Bias and fairness test reports including data lineage analysis; Technical evidence of the purpose constraint (system prompts, tool allow-lists, purpose validation and refusal logic, logs); Internal governance framework or external audit report covering algorithms, data and design processes

ISO/IEC 42001 AI management system implementation and certification readiness checklist

Regulation 10.3.3 provides that no person may use, operate, provide, offer or otherwise make available for commercial use a system to engage in High Risk Processing Activities unless: the Commissioner has established audit and certification requirements for such systems; the system complies with all of them; the system processes personal data solely for human-defined or human-approved purposes; and the Deployer or Operator has appointed an Autonomous Systems Officer with the same or substantially similar competencies, status, role and tasks as a DPO under Articles 17 and 18 of the Law. The Regulation’s guidance note states the regulatory intent that no system may be used for High Risk Processing Activities until the Commissioner has promulgated those requirements. DIFC has published a Regulation 10 certification framework, an accelerator framework and a list of Accredited Certification Bodies, together with an online certification application and a self-assessment tool.

Evidence: High Risk Processing Activity determination and Regulation 10.3.3 applicability analysis; Regulation 10 certification application and the Accredited Certification Body’s conclusion; Autonomous Systems Officer appointment and role description, mapped to Articles 17 and 18; Technical evidence and audit trail that the system processes data only for human-defined or human-approved purposes

ISO/IEC 42001 AI management system implementation and certification readiness checklist

Article 14(7) requires controllers and processors to register with the Commissioner by filing a notification of processing operations and to keep it current through amended notifications; Article 14(8) puts the notification on a publicly available register and attaches a prescribed fee. Article 14(5) requires a written data protection policy proportionate to the extent and type of processing and consistent with the Law. Article 15 requires controllers and processors each to maintain a written record of processing activities, including categories of recipients, third countries and international organisations, documentation of safeguards for Article 27 transfers, erasure time limits by category, and a general description of technical and organisational security measures.

Evidence: Commissioner registration confirmation and the latest amended notification; Written data protection policy with version history and approval trail; Record of processing activities covering the Article 15(1) fields; Documentation of Article 27 transfer safeguards and its filing index

Article 16(2)(b) requires a DPO where a controller or processor performs High Risk Processing Activities on a systematic or regular basis (DIFC Bodies must also appoint one). An entity that is not required to appoint a DPO must, under Article 16(4), clearly allocate responsibility for data protection oversight and compliance within the organisation and be able to give the Commissioner the details of the responsible persons on request. The DPO may be a member of staff, a group employee, or a third party under a service contract; a group may share one DPO if easily accessible from each entity. Note Article 16(7): the DPO must reside in the UAE unless they are employed within the organisation’s Group and perform a similar function for the Group internationally — check that proviso before assigning the role to a China-based team remotely. Article 16(8) also requires the DPO’s contact details to be published so a third party can reach them without disproportionate effort, and the identity confirmed to the Commissioner in writing on request.

Evidence: High Risk Processing Activity determination memo, per business line, with reasoning; DPO appointment document or the Article 16(4) allocation-of-responsibility document; Note on the DPO’s independence and resourcing; Response template for providing responsible-person details to the Commissioner

Carry out a DPIA for high-risk processing under Article 20; where the assessment indicates that, despite the measures referred to in Article 20(6)(e), risks to data subjects’ rights remain, Article 21 requires the controller to consult the Commissioner before processing, and the Commissioner may notify the controller and processor and use the Article 46 powers if the processing would infringe the Law. Wire the DPIA into model evaluation, red-teaming and launch approval so assessments are never retrofitted after go-live.

Evidence: DPIA report and the list of mitigating measures; Prior consultation submission and the Commissioner’s response, where triggered; Model evaluation and red-team test reports; Launch approval record showing the DPIA conclusion as a gating condition

Article 26 permits transfers to third countries or international organisations that the Commissioner has determined provide an adequate level of protection; the Commissioner publishes and maintains that list by Regulations, and such transfers need no specific authorisation. Otherwise Article 27 applies: rely on the Article 27(2) safeguards (a legally binding instrument between public authorities, Binding Corporate Rules, standard data protection clauses adopted by the Commissioner, or an approved code of conduct or certification mechanism with binding and enforceable commitments), or an Article 27(3) derogation; only where neither is available does the limited Article 27(4) route apply, and Article 27(5) then requires the controller to inform the Commissioner of the transfer. The Commissioner’s site publishes the Article 26 adequacy list and the Article 27(2)(c) model clauses — always use the current version.

Evidence: Export register (recipient, location, data categories, Article 26 or 27 route relied on); Executed DIFC model clauses / standard contractual clauses or BCR approval; Record of the Article 27(5) notification to the Commissioner, where applicable; Review record against the Commissioner’s current adequacy list

Open tool: Transfer Matrix

Article 41 requires the controller to notify the Commissioner “as soon as practicable in the circumstances” of any personal data breach that compromises a data subject’s confidentiality, security or privacy, with at least the nature of the breach (including, where possible, the categories and approximate numbers of data subjects and records), the DPO or other contact point, the likely consequences, and the measures taken or proposed; information may be provided in phases. A processor must notify the relevant controller without undue delay. Article 42 requires communication to affected data subjects as soon as practicable where the breach is likely to result in a high risk to their security or rights, and prompt communication where there is an immediate risk of damage; the communication must be in clear and plain language and contain at least Articles 41(4)(b)–(d), with mitigation recommendations where possible. Article 41(6) requires a written record of all breaches, their effects and remedial action, available to the Commissioner without delay on request.

Evidence: Breach response plan and Commissioner notification template aligned to the four elements of Article 41(4); Written breach register recording facts, effects and remedial action; Data subject communication text and proof of delivery; Timing records for processor-to-controller notifications

AI incident and serious incident reporting record (register plus report drafts)

A data subject has the right to object to any decision based solely on automated processing, including profiling, which produces legal consequences or other seriously impactful consequences, and to require manual review. The Article 38(2) exceptions are: necessity for entering into or performing a contract between the data subject and the controller; authorisation by applicable law that also lays down suitable safeguards; or the data subject’s explicit consent. Where the controller relies on contract necessity or explicit consent, Article 38(5) requires suitable safeguards including, at minimum, the ability for the processing to be reviewed manually. Article 38(4) disapplies all the exceptions where the data subject is a minor by reference to the UAE age of majority. Article 38(6) further bars decisions affecting a data subject based solely on automated processing of special category data unless explicit consent is given or the processing is necessary for reasons of substantial public interest on the basis of applicable law, proportionate, and accompanied by suitable safeguards.

Evidence: Automated decision inventory with legal analysis of the exception relied on; Manual review procedure and sample review records; Age assurance / minor routing mechanism description and test records; Lawfulness reasoning and safeguards list for automated decisions on special category data

Where an application or website service uses autonomous or semi-autonomous systems to process personal data, the Deployer or Operator must, on first use of or access to the system, give notice in clear and explicit terms of the underlying technology and processes that may process personal data in ways that are not human-initiated, controlled or directed (for example whether the system is restricted to specific human-defined purposes or can define further purposes itself), and of the impact of using the system on the exercise of individual rights under Article 29(1)(h)(ix). The notice must also give a comprehensive, true and plain description of: the human-defined purposes for which the system processes personal data; all human-defined principles and limits within which the system may define further purposes; the output produced and how it is used; the principles on which the system was designed to operate, including safeguards built in by design; and the codes, certifications or principles the system was designed or developed to — the Regulation names the Dubai Digital Authority, the OECD, UNESCO, the NIST AI Framework and the Guidelines for Financial Institutions adopting Enabling Technologies issued by the UAE Central Bank, the Securities and Commodities Authority, the DFSA and the FSRA as examples, and lets the Commissioner designate further codes and certifications.

Evidence: Final first-use notice copy and screenshots of where it is shown; System description (human-defined purposes, principles and limits for self-defined purposes, outputs and their use); Inventory of safeguards built in by design and evidence of implementation; List of codes/certifications relied on (for example OECD, NIST AI RMF, UNESCO, Central Bank or DFSA guidelines)

Model Card

Under Article 7(4) keep a dedicated personal data record containing the controller’s and DPO’s details, a description of data categories, the list of persons authorised to access the data, processing times, limits and scope, the erasure and modification mechanism, the purpose of processing, any data relating to cross-border movement and processing, and the technical and organisational information-security measures; produce it to the Data Office on request. Article 20 additionally requires encryption and pseudonymisation, continuous confidentiality and integrity of processing systems, timely restoration of access after failure, and regular testing and evaluation of the measures, in line with international best practice.

Evidence: Personal data processing record covering each element of Article 7(4); Access authorisation list and periodic review records; Encryption and pseudonymisation implementation note and key management policy; Testing and evaluation reports on the effectiveness of security measures

Article 10 requires a DPO with sufficient skills and knowledge in three cases: processing that would create a high-level risk to confidentiality and privacy because of new technologies or data volume; processing involving a systematic and comprehensive assessment of sensitive personal data, including profiling and automated processing; and processing of a large volume of sensitive personal data. The DPO may sit inside or outside the UAE but their contact details must be notified to the Data Office. Article 21 requires an impact assessment before using new technologies posing high risk, and makes it mandatory in the two cases above; it must contain at least a systematic description of the operations and purpose, an assessment of necessity and proportionality, a risk assessment and mitigation measures, must be done in coordination with the DPO, and must be reviewed as risk levels change.

Evidence: DPO appointment letter, role description and qualifications; Record of notifying the Data Office of the DPO’s contact details; Impact assessment report covering the four elements in Article 21(3); Periodic review records and the trigger criteria for reassessment

Article 18 gives data subjects the right to object to decisions resulting from automated processing, including profiling, in particular those with a legal impact on or adverse effect for them. The objection is unavailable only where the automated processing is agreed in the contract with the controller, required by other applicable legislation, or covered by the data subject’s prior consent. Even then the controller must adopt appropriate measures to protect the privacy and confidentiality of the data and must not prejudice the data subject’s rights, and must include a human element in reviewing automated decisions at the data subject’s request.

Evidence: Automated decision inventory with the Article 18(2) exception relied on for each; Human review procedure and sample review records; Objection intake channel and case log; Retained contract or consent wording covering the automated processing

Article 9 requires the controller, on becoming aware of any breach or violation that would prejudice the privacy, confidentiality or security of a data subject’s personal data, to notify the Data Office within the period and under the procedures set by the Executive Regulations, attaching the nature and form of the breach, its causes, the approximate number and records affected, the DPO’s details, likely effects, corrective measures taken or proposed, and supporting documents; the data subject must also be notified where the breach would prejudice the privacy and confidentiality of their data, and a processor must notify the controller as soon as it becomes aware. On transfers, Article 22 permits transfers to states or provinces with data protection legislation and a judicial or regulatory authority able to impose measures, or with which the UAE has a bilateral or multilateral data protection agreement; Article 23 provides six alternative routes where an adequate level is not available — a binding contract, explicit data-subject consent, judicial claims, performance of a contract, international judicial cooperation, and public interest. Select and document a route for each flow.

Evidence: Breach response plan and notification template covering the six elements of Article 9(1); Breach register and evidence of notifications to the Data Office and data subjects; Transfer register (flow, recipient, Article 22 or 23 route relied on); Executed transfer contract under Article 23(1)(a) and its enforceable-measures clauses

AI incident and serious incident reporting record (register plus report drafts)

Open tool: Transfer Matrix

Section 24(1) requires a controller, before or as soon as reasonably practicable after it starts processing personal data, to pay the Data Protection Fee for the twelve months from that date and to notify the Commissioner of its name and address (registered office for a registered company) and the date processing began. Section 24(2) requires a Renewal Fee each year within one month of the anniversary of that date, in the amount set by Board rules. The ADGM Office of Data Protection confirms that all ADGM registered entities processing personal data must register as Data Controllers.

Evidence: Registration confirmation and a screenshot of the registered particulars; Receipts for the Data Protection Fee and each Renewal Fee; Internal record establishing the date processing began; Change log for registered particulars (name, address, DPO)

Section 35(1) requires a DPO where processing is carried out by a public authority (other than courts acting judicially); where the core activities of the controller or processor consist of processing operations that by their nature, scope and purposes require regular and systematic monitoring of data subjects on a large scale; or where core activities consist of large-scale processing of special category data. The DPO may serve one entity, a group or multiple independent entities, may hold other roles, need not be an employee (a written agreement is required) and need not reside in ADGM, provided they are easily accessible to each entity served and no other role conflicts with their duties. Section 35(3) requires appointment on the basis of professional qualities, in particular expert knowledge of data protection law and practice. Section 35(4) requires notification to the Commissioner within one month of appointment or resignation, with the new DPO’s contact details and, on resignation, the reasons.

Evidence: Memo on whether section 35(1) is triggered; DPO appointment document or written service agreement; Record of the appointment/resignation notification to the Commissioner, evidencing the one-month deadline; DPO qualifications and independence note

Section 32(1) requires the controller to notify the Commissioner without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach, unless it is unlikely to result in a risk to the rights of natural persons; a later notification must be accompanied by reasons for the delay. Section 32(2) requires a processor to notify the controller without undue delay. The notification must describe the nature of the breach (including categories and approximate numbers of data subjects and records), give the DPO or contact point, describe likely consequences and the measures taken or proposed; information may be provided in phases without undue further delay. Section 32(5) requires documentation of all breaches, their effects and remedial action, sufficient for the Commissioner to verify compliance.

Evidence: Breach response plan and the rule for determining when the 72-hour clock starts; Breach register recording facts, effects and remedial action; Submission record of the Commissioner notification and any delay reasoning; Text and proof of delivery of data subject communications where section 33 is triggered

AI incident and serious incident reporting record (register plus report drafts)

On exports: section 41 permits transfers under a Commissioner adequacy decision, and the Commissioner may take into account a European Commission adequacy decision under GDPR Article 45(3). Absent adequacy, section 42 allows reliance without specific authorisation on a legally binding instrument between public authorities, binding corporate rules, standard data protection clauses adopted by the Commissioner under section 42(2) (the Commissioner may approve the European Commission’s or another supervisory authority’s standard contractual clauses, which are then incorporated by reference), or an approved code of conduct or certification mechanism with binding and enforceable commitments; bespoke contractual clauses and administrative arrangements under section 42(4) need the Commissioner’s authorisation. Only if none is available do the section 44 derogations apply, including explicit consent after being informed of the risks of the absence of adequacy and safeguards. On automated decisions: section 20(1) gives the right not to be subject to solely automated decisions with legal or similarly significant effects, with exceptions for contract necessity, explicit consent, and where required or authorised by applicable law (including fraud prevention, AML, and security and integrity purposes). For that third exception the controller must, as soon as reasonably practicable, notify the data subject in writing that a solely automated decision has been taken, and the exception holds only if within one month of receiving that notification the data subject has not asked the controller to reconsider or to take a new decision that is not solely automated. Section 20(3) requires suitable measures for the contract and consent cases, at least the right to obtain human intervention, express a point of view and contest the decision.

Evidence: Export register mapping each flow to section 41, 42 or 44; Executed standard data protection clauses, BCR approval or Commissioner authorisation; Written notification template for solely automated decisions and the sending log; Tracking of the one-month objection window and the outcomes of reconsideration or new human decisions

Open tool: Transfer Matrix