Data Privacy & Protection Advisory

Under Federal Decree-Law No. 45 of 2021 (the PDPL), obligations extend to any entity established in the UAE that processes personal data, and to entities outside the UAE that process personal data of individuals located in the UAE in specified circumstances, subject to defined exclusions. This covers the great majority of operating businesses — anyone with employees, customers, or website visitors is processing personal data. DIFC and ADGM-registered entities fall under those centres' own, separate data protection laws instead of the federal PDPL. PNPC confirms the applicable regime and scope for each specific business rather than assuming a default answer.

The PDPL is the federal law applying to mainland UAE and most free zones without their own dedicated data protection regime. DIFC and ADGM are financial free zones with their own independent legal systems, and each has enacted its own data protection law — the DIFC Data Protection Law and ADGM's Data Protection Regulations respectively — supervised by that centre's own regulator (the DIFC Commissioner of Data Protection and the ADGM Office of Data Protection). A group with a mainland trading entity and a DIFC-registered financial services arm can genuinely be subject to two different regimes for different parts of its operation. PNPC identifies which regime governs which entity at the outset of every engagement.

Personal data broadly means any information relating to an identified or identifiable natural person — names, Emirates ID and passport numbers, contact details, employment and financial records, IP addresses and device identifiers, and biometric data used for access control are all typically in scope. Certain categories — health data, biometric data, data revealing racial or ethnic origin or religious belief, and criminal record data — are commonly treated as sensitive personal data requiring a higher standard of protection and, in most regimes, a narrower set of lawful grounds for processing.

Whether a formal Data Protection Officer appointment is required depends on the applicable regime and the entity's processing volume, sensitivity of data handled, and risk profile — the specific threshold is set out in the applicable law and its implementing guidance. Where an appointment is warranted, PNPC advises on structuring the role, defining its reporting line and authority, and can provide external DPO advisory support under a specifically scoped retainer; this is distinct from a standing, in-house appointment with day-to-day operational authority, which the entity itself typically holds.

UAE data protection regimes generally restrict or place conditions on transferring personal data outside the UAE (or, for DIFC/ADGM entities, outside the relevant free zone) unless an adequate level of protection exists in the receiving jurisdiction or another recognised safeguard — such as appropriate contractual clauses or the data subject's explicit consent — is in place. PNPC reviews each actual transfer the business makes, including transfers to a group parent, an offshore team, or a cloud hosting provider, against the specific safeguard requirements of the applicable regime.

A DPIA is a structured assessment of the privacy risks a specific processing activity creates, typically required or recommended before undertaking processing likely to result in higher risk to individuals — large-scale processing of sensitive data, systematic monitoring, or a new technology deployment with significant privacy implications, for example. PNPC assesses whether a given activity crosses the threshold warranting a DPIA under the applicable regime and, where it does, conducts the assessment before the activity goes live rather than as a retrospective exercise.

UAE data protection regimes typically grant individuals rights including access to their personal data, correction of inaccurate data, deletion in specified circumstances, and objection to certain processing, among others defined by the applicable law. PNPC designs an internal workflow so a request reaching any part of the business — customer service, HR, a general email inbox — is recognised, routed to an accountable owner, and actioned within the relevant timeframe, with the response properly documented.

A functioning breach response plan defines how a suspected incident is detected and escalated internally, who is accountable for assessing its scope and severity, how containment is actioned, how the business determines whether a notification obligation to a regulator or affected individuals has been triggered under the applicable law, and how internal and external communication is managed. PNPC builds this plan around the entity's actual systems and team structure, and walks the relevant staff through it so the first time it is used is not during a live incident.

UAE regulatory practice generally expects consumer-facing documentation, including privacy notices, to be accessible in a manner data subjects can genuinely understand, and Arabic-language availability is a common expectation for businesses serving UAE residents broadly, though the specific requirement can depend on the entity's sector, licensing authority, and audience. PNPC advises on the appropriate language approach for each specific business as part of the notice-drafting stage.

Yes — this is one of the more common engagements we see. A business adopts a privacy policy, often based on a template or a group-standard document, and never verifies it against what its own website forms, CRM, and vendor relationships actually collect and share. PNPC runs a gap assessment comparing the published policy against actual data flows and remediates the mismatch, rather than starting the policy from scratch unnecessarily.

The PDPL and the equivalent DIFC and ADGM laws provide for administrative penalties for non-compliance, with the specific fine amounts and enforcement mechanics set out in implementing regulations and applied by the relevant supervisory authority based on the facts of each case. PNPC does not quote specific penalty figures in general advisory conversations, since enforcement practice and any prescribed amounts can be updated by regulation; we advise clients to treat proportionate compliance investment as materially lower-cost than remediation after a finding or breach.

Data protection law requires 'reasonable' or 'appropriate' technical and organisational security measures proportionate to the sensitivity of the data held, but does not itself prescribe specific technical controls — that is the domain of cybersecurity and IT risk management. PNPC's data privacy advisory identifies what needs to be protected and to what standard, and coordinates with (or refers into) technical cybersecurity work — access controls, encryption, network security — that implements the actual protection, rather than duplicating that technical scope itself.

Yes. Employee personal data — contracts, payroll, visa and Emirates ID details, performance records, and any biometric access-control data — is personal data like any other and is subject to the same lawful-basis, security, and rights obligations under the applicable regime, with employment-specific nuances (such as the basis for processing being tied to the employment relationship rather than standalone consent in most cases). PNPC's data-flow mapping specifically includes HR and payroll systems, which are frequently overlooked when a business focuses primarily on customer-facing data.

PNPC charges a fixed, agreed advisory fee for the scoping, data-flow mapping, policy drafting, and roll-out phases, scoped to the entity's size, number of systems, and data complexity, and confirmed in writing before work begins. Ongoing retainer pricing for periodic review, new-processing assessments, and incident-response support is quoted separately once the initial scope is agreed.

For a single-entity business with a moderate number of systems and no prior programme, PNPC's engagement — from scoping through policy roll-out — typically runs a small number of weeks, depending on how quickly internal stakeholders can be interviewed for the data-flow mapping stage. Groups with multiple jurisdictions, sensitive-data processing, or complex vendor relationships should expect a longer, phased engagement.

Yes. Where the UAE Data Office, the DIFC Commissioner of Data Protection, the ADGM Office of Data Protection, or another relevant authority raises an inquiry, PNPC supports the entity in responding accurately and drawing on the documented data inventory, policies, and processes already built — or, where no programme exists yet, helps assemble a credible response and remediation plan as quickly as the circumstances allow.

No. Only the two financial free zones — DIFC and ADGM — have their own independent data protection law and regulator. Non-financial free zones such as JAFZA, DMCC, RAKEZ, IFZA, Meydan, RAK ICC, and Ajman Free Zone do not have a separate data protection statute; entities licensed in these free zones are governed by the federal PDPL in the same way a mainland entity is, even though their trade licence, ownership rules, and company law are administered by the free-zone authority.

A controller is the entity that determines the purpose and means of processing personal data — typically the business collecting data from its own customers or employees. A processor is an entity that processes personal data on the controller's behalf and instructions, such as a payroll bureau, a cloud hosting provider, or an outsourced call centre. UAE data protection regimes place distinct obligations on each role, and a business acting as a processor for a client (a SaaS platform storing its customers' data, for example) has its own set of processor-specific obligations separate from its controller obligations for its own employee and vendor data.

Both, in different ways. The processor typically has a contractual and, depending on the regime, statutory obligation to notify the controller promptly of any breach affecting the data it processes on the controller's behalf. The controller, however, generally retains the ultimate responsibility for assessing whether the breach triggers a notification obligation to a regulator or affected individuals and for managing that response, because the controller is the entity with the direct relationship to the data subject. A vendor contract silent on breach notification timelines leaves the controller unable to meet its own obligations promptly.

Yes. Any collection, storage, or use of a customer's name, phone number, or conversation content through a messaging app used for business purposes is processing of personal data, and the same lawful-basis, security, and retention principles apply as they would to any other customer data channel. Businesses using messaging apps for order confirmations, customer service, or sales frequently treat the channel informally, but the data protection obligations do not change simply because the channel feels conversational rather than formal.

There is no blanket size-based exemption in the PDPL for sole proprietorships or small businesses as such — if the entity processes personal data of customers or employees, the same core obligations apply regardless of headcount. What does vary with size is the proportionate scale of the programme: a sole proprietorship with a handful of customers needs a materially lighter privacy notice, retention approach, and governance structure than a large retailer, but it is not exempt from the underlying obligation to handle personal data lawfully.

Where a business's activity is also regulated by a sector-specific authority — health data under the relevant health authority's rules, financial and banking data under UAE Central Bank regulation — those sector rules typically layer on top of, and can be more specific than, the general PDPL, DIFC, or ADGM framework. PNPC's data-flow mapping identifies where sector-specific rules apply to a particular data category and coordinates the general privacy programme with any sector-specific requirement, rather than assuming the general framework alone is sufficient for regulated health or financial data.

Not every processing activity requires explicit consent — UAE data protection regimes generally recognise multiple lawful bases, including contractual necessity, legal obligation, and legitimate interest, alongside consent. Which basis applies depends on the specific processing activity: fulfilling an order relies on contractual necessity, not consent; sending marketing communications typically does require a specific, freely given consent in most regimes. PNPC maps the correct lawful basis to each processing activity individually rather than defaulting to consent-for-everything, which both over-complicates the customer experience and misstates the actual legal basis being relied on.

Whether re-consent is needed depends on the nature of the change. A clarifying update that does not change what data is collected or how it is used generally does not require fresh consent, though re-publishing the updated notice is good practice. A material change — a new category of data being collected, a new purpose, or a new third party the data is shared with — generally does require fresh notice and, where consent is the underlying lawful basis, fresh consent for the new activity specifically. PNPC reviews each policy update against this distinction before it is published.

A former employee's personal data — held for as long as the entity's retention schedule justifies, for example payroll and end-of-service records kept for a defined period after employment ends — remains subject to the same data subject rights as a current employee's data, including the right to request access. PNPC's data subject rights workflow is designed to route a request regardless of whether the individual is a current customer, current employee, or former employee, so a former staff member's request does not fall through a gap because no one is actively managing that relationship anymore.

The PDPL does not impose a blanket data-localisation requirement forcing all personal data to be stored on servers physically inside the UAE. What it does regulate is the conditions under which personal data can be transferred outside the UAE — requiring an adequate level of protection in the receiving jurisdiction or another recognised safeguard. Certain sector-specific rules (for example, some categories of banking or government-related data) can impose stricter localisation requirements separately from the general PDPL, which is why PNPC checks sector overlap alongside the general cross-border transfer analysis.

The UAE Data Office is the federal authority responsible for overseeing implementation of and compliance with the PDPL. Where a business's data processing also falls under a sector regulator's own rules — the UAE Central Bank for banking and financial data, or a health authority for patient data — that sector regulator's rules apply alongside the Data Office's general PDPL oversight, rather than one replacing the other. PNPC's scoping stage identifies which regulator(s) are actually relevant to a specific business's data processing, since more than one can be relevant simultaneously.

A franchise or joint-venture structure where two legally separate businesses both determine how shared customer data is used can create a joint-controller relationship, which typically requires the parties to have a clear, documented arrangement covering which party handles which obligation — who responds to a data subject request, who is responsible for the privacy notice, and how a breach affecting the shared data is managed. PNPC reviews the underlying franchise or joint-venture agreement specifically for this data-sharing dimension, which general commercial contract drafting frequently leaves unaddressed.

Precise location data is generally treated as personal data requiring the same lawful-basis and security standard as other personal data, though it is not automatically classified in the narrower 'sensitive personal data' category (which typically covers health, biometric, racial/ethnic origin, religious belief, and criminal record data) unless the location data reveals something inherently sensitive, such as regular visits to a place of religious worship or a medical facility. PNPC's data-flow mapping specifically flags location data collection in any mobile app in scope, since it is one of the more commonly under-assessed data categories in app-based businesses.

Personal data transferred as part of a merger, acquisition, or business sale is still subject to the applicable data protection law, and the transfer itself needs a lawful basis — due diligence disclosure to a prospective acquirer typically relies on legitimate interest with appropriate safeguards (such as a confidentiality agreement and data minimisation during the due diligence phase), while the post-completion transfer of the full customer or employee database to the acquiring entity needs to be assessed against the applicable transfer and notice requirements. PNPC advises on structuring the data-handling terms of a transaction alongside the corporate and financial due diligence workstreams.

There is no fixed universal sequence, but PNPC generally recommends confirming the entity's basic regulatory scope — which laws apply to which entity — as an early, shared step across data protection, AML/CFT, and other compliance workstreams, since the underlying group structure and licensing analysis overlaps. From there, the specific sequencing depends on which area carries the more immediate risk or deadline for a given business; a DNFBP facing an imminent AML/CFT inspection may need that workstream prioritised, while a business about to launch a new customer-facing app may need privacy addressed first.

Whether individual notification is required depends on whether the change is material to how the business described its data handling in the existing privacy notice — moving to a materially different hosting location (particularly one outside the UAE where the prior notice specified UAE-based hosting) or a provider with different security or sub-processing arrangements would generally warrant an updated notice and, in some cases, a fresh assessment of the cross-border transfer basis. A like-for-like hosting change within the same jurisdiction and security standard is less likely to require individual notification, though updating the vendor list in the privacy notice is still good practice.

Yes. PNPC can conduct a data protection due diligence review specifically for a transaction context, assessing the target entity's data-flow mapping accuracy, policy-to-practice alignment, cross-border transfer documentation, vendor contract coverage, and breach history, and format the findings for inclusion in a due diligence report or data room. This is a distinct, typically faster-turnaround engagement from a full programme build, focused on identifying and quantifying gaps for the transaction rather than remediating every one of them before the deal closes.

PNPC's engagement focuses on data protection compliance — what data a website collects, how it is used, and whether the notice and consent mechanisms match that collection — rather than website accessibility standards (readability for users with disabilities), which is a separate discipline. Where a client's accessibility work overlaps with privacy notice design (for example, ensuring a cookie consent banner is itself accessible), PNPC coordinates with the client's web team on that specific overlap rather than delivering accessibility compliance as part of the engagement scope.

A general gap assessment reviews the entity's overall data protection programme against applicable law — policies, consent mechanisms, vendor contracts, and governance — to identify where the existing programme falls short. A Data Protection Impact Assessment (DPIA) is narrower and forward-looking: it assesses the specific privacy risk of a single new or changed processing activity before it goes live, such as launching a new app feature or introducing a new monitoring tool. PNPC runs a gap assessment at the outset of most engagements and DPIAs specifically when a new higher-risk processing activity is being introduced or expanded.

For groups with entities in both jurisdictions, PNPC's UAE data protection advisory focuses specifically on the UAE entity's obligations under PDPL, DIFC, or ADGM law as applicable, while coordinating — through PNPC's India offices where relevant — on how data flows between the Indian and UAE entities are structured. This is treated as two related but distinct compliance analyses rather than a single blended framework, since Indian and UAE data protection law are separate legal regimes with their own specific requirements.

Yes. Data protection obligations attach to the processing of personal data regardless of the channel — a retail shop collecting customer details for a loyalty programme, a services office keeping client files, or any business maintaining employee records is processing personal data whether or not it has an online presence. The absence of a website removes website-specific considerations like cookie consent, but does not remove the underlying obligation to handle customer and employee data lawfully, securely, and with an appropriate retention approach.

PNPC's data privacy advisory team monitors updates to PDPL executive regulations, UAE Data Office guidance, and DIFC/ADGM data protection rule changes as part of the periodic review built into every ongoing advisory relationship. Where a regulatory development materially affects an existing client's programme — a new specific requirement for a particular sector, a clarified threshold for DPIAs, or an updated cross-border transfer mechanism — PNPC proactively flags the change and recommends the specific update needed, rather than waiting for the client's next scheduled review to raise it.

No, a request is not automatic in every case — data protection regimes generally allow a controller to decline or limit a request in defined circumstances, such as where a statutory retention obligation requires the data to be kept, where the request is manifestly unfounded or excessive, or where fulfilling it would infringe another individual's rights. What is not acceptable is an undocumented, ad hoc refusal; PNPC's workflow requires every declined or partially fulfilled request to record the specific ground relied on, so the decision is defensible if the individual escalates it.

Whether dedicated consent-management software is warranted depends on the complexity of the business's tracking and marketing technology stack — a website running a handful of first-party cookies can often manage consent adequately through a well-built banner and clear notice, while a business running multiple third-party advertising pixels, retargeting tools, and cross-site tracking typically needs a consent-management platform to keep actual tracking behaviour in sync with what the visitor selected. PNPC assesses the technology stack first and recommends proportionate tooling rather than defaulting to a platform sale.

Yes. CCTV footage that can identify an individual — a customer, visitor, or employee — is personal data, and its collection needs a lawful basis (typically legitimate interest for security purposes), proportionate retention (footage should not be kept indefinitely by default), and, in most regimes, visible signage informing individuals that recording is taking place. PNPC's employee monitoring and CCTV governance review covers customer-facing cameras as well as internal workplace monitoring, since both raise the same underlying obligations.

Using a purchased or rented contact list raises a lawful-basis question the business itself did not create — the individuals on that list gave whatever consent or notice they gave to the original collector, not to the business now contacting them, and that basis may not extend to a new, unrelated sender. PNPC reviews the provenance and terms of any third-party list before a client uses it for outbound marketing, since relying on someone else's undocumented consent is one of the more common and least defensible marketing practices we are asked to review.

Yes — commercial messaging in the UAE is also subject to telecommunications regulatory requirements administered by the UAE's telecom regulator, which layer on top of, rather than replace, the data protection lawful-basis analysis for using a customer's contact details for marketing. PNPC's marketing consent review checks both dimensions: whether the data protection basis for holding and using the contact detail is sound, and whether the messaging channel itself complies with the applicable telecom marketing rules.

Automated processing that produces a decision with a significant effect on an individual — automated credit scoring, algorithmic pricing, or automated eligibility screening, for example — is typically treated as higher-risk processing warranting closer scrutiny, including consideration of whether a DPIA is required and whether the individual has a right to understand or contest the automated outcome. PNPC's data-flow mapping specifically flags any automated decision-making or profiling tool in use, since these are treated with more caution than routine data processing.

Yes — where the formal DPO threshold is not reached, PNPC commonly recommends a named internal privacy owner or a small internal privacy committee with clearly defined responsibility for data subject requests, breach escalation, and reviewing new processing activity, without the full statutory DPO designation. This gives the business genuine accountability and a documented point of contact without over-engineering governance disproportionate to its size.

Yes. A cross-border transfer assessment needs to cover every location personal data is genuinely held, not only the primary production system — a UAE-hosted primary database with backups replicated to a data centre outside the UAE is still a cross-border transfer of that data, even though the business's day-to-day operational system appears to stay local. PNPC's data-flow mapping specifically asks about backup, disaster-recovery, and archival locations, which are frequently overlooked when a business describes its 'main' hosting location.

Yes. Recruitment data — CVs, interview notes, background-check results, and reference details — is personal data from the moment it is received, regardless of whether the candidate is ultimately hired, and is subject to the same lawful-basis, security, and retention obligations as employee data. A common gap is retaining unsuccessful candidates' CVs indefinitely with no defined retention period or purpose for keeping them.

Data protection regimes typically expect notification to a regulator, and in some cases to affected individuals, without undue delay once a breach is identified and its scope reasonably understood — in practice this means the first hours after detection matter far more than most businesses expect, since containment, initial scoping, and the decision on whether notification is triggered all need to happen quickly and in parallel, not sequentially. PNPC's breach response plan builds a realistic first-24-hours sequence, not just a policy statement that notification 'will occur promptly.'

This is a cross-border transfer requiring the same assessment as any other — confirming the receiving jurisdiction's adequacy or an alternative safeguard, updating the internal privacy notice if employees were not previously told their data would be shared with an overseas parent system, and reviewing the group's data-sharing agreement for the specific obligations it places on each party. A request from a parent company does not itself provide a lawful basis; the transfer still needs to be properly assessed and documented like any other.

Genuinely and irreversibly anonymised data — from which no individual can reasonably be re-identified — generally falls outside the scope of personal data protection obligations, but pseudonymised data (where identifying details are replaced with a code but the ability to re-link it to an individual still exists somewhere) remains personal data and stays fully in scope. PNPC reviews whether a business's claimed 'anonymised' analytics or reporting data is genuinely irreversible or merely pseudonymised before relying on that distinction.

A UAE-based marketplace seller is typically a data controller in its own right for the customer order, contact, and delivery data the marketplace platform shares with it to fulfil orders, even though the platform itself also processes that data as a controller or processor for its own purposes. Sellers frequently assume the marketplace's own privacy policy covers them, when in practice the seller has its own separate obligations for how it stores, uses, and retains the customer data it receives through the platform.

Real estate businesses typically hold tenant and landlord personal data, Emirates ID and passport copies, financial and income information for tenancy applications, and Dubai Land Department or equivalent registration data, often shared with multiple third parties — mortgage providers, insurers, facility management companies — as part of a single transaction. PNPC's data-flow mapping for this sector pays particular attention to how many third parties a single tenancy or sale transaction actually passes personal data through, since the sharing chain is often longer than the business itself initially describes.

Sharing loyalty-programme customer data with a partner brand for joint offers is a distinct disclosure requiring its own lawful basis and, in most cases, specific notice to the customer that their data may be shared with named partners for this purpose — a general 'we may share your data with partners' clause is weaker than a specific, transparent description of which partners and what data. PNPC reviews loyalty programme terms and consent flows specifically for this partner-sharing dimension.

A statutory retention obligation — such as the requirement under the Corporate Tax framework to retain relevant records for at least seven years — generally overrides a deletion request for the specific records that obligation covers, since data protection regimes typically permit a controller to decline deletion where retention is required by law. The correct response is not silent refusal, but a documented explanation to the customer that the specific financial or transaction records are retained under a defined statutory obligation, while any data outside that obligation's scope is still assessed for deletion on its own merits.

A public complaint raising a genuine data protection concern — for example, an allegation that the business shared their data without consent — should be treated as triggering the same internal data subject rights or complaint-handling process as a direct request, routed to the accountable internal owner rather than handled purely as a reputational or customer-service matter on the social platform itself. PNPC's workflow design specifically includes social media and public channels as an intake point for this reason.

Privacy by design and by default means considering data protection requirements at the point a new system, product, or feature is being designed — deciding what data actually needs to be collected, what the default privacy settings should be, and how long data will be kept — rather than building the system first and retrofitting privacy controls afterward. PNPC's DPIA and new-processing assessment stage exists specifically to apply this principle before launch, when design choices are still cheap to change.

Photography or video capturing identifiable individuals at a company event is personal data, and using it — for internal newsletters, social media, or marketing — generally needs either the individual's consent or a clearly communicated, proportionate basis (such as visible signage at the event stating that photography will occur and may be used for specified purposes) before publication, particularly for external-facing use. PNPC advises event organisers to build a simple notice-and-opt-out mechanism rather than assuming implied consent from attendance alone.

The applicable data protection law generally continues to apply to personal data an entity established in the UAE holds, regardless of where the individual is currently located, since the obligation attaches to the processing entity and its handling of the data, not solely to the individual's current physical presence. PNPC treats a data subject's relocation as a reason to review whether continued retention still serves a genuine purpose, not as a basis to assume the obligation has lapsed.

Even where the formal DPIA threshold is genuinely borderline, PNPC often recommends conducting a lighter-form risk assessment before launching a new higher-risk processing activity, because the cost of the assessment is small relative to the cost of redesigning a live system that turns out to have a material privacy gap, or explaining after the fact why a foreseeable risk was never assessed. We scope the assessment's depth to the actual risk rather than defaulting to a full formal DPIA when a proportionate lighter review will do.

Generally yes, in substance if not always in every document — each licensed entity is typically its own controller for the personal data it processes, even where day-to-day IT infrastructure, HR administration, or back-office staff are shared across related businesses, and a single shared programme needs to clearly identify which entity is responsible for which data set and processing activity rather than treating the group as a single undifferentiated controller. PNPC's group entity reconciliation stage is designed specifically to draw this line clearly rather than let a shared back office blur legal accountability.