The United Arab Emirates (“UAE”) introduces a new data law as part of the
“Projects of the 50” – a series of initiatives the UAE has planned for the next
50 years to boost the country’s economy.
Background
Currently, data privacy in the UAE is generally governed by the UAE’s Constitution, Civil Code
and Penal Code which have embedded provisions related to privacy.
There are also some sector-specific regulations. One is the Federal Law No. 5 of 2012 on
Combatting Cybercrimes (amended by Federal Law No. 12 of 2016), which makes disclosing
confidential information through electronic means without consent illegal. Another is the Federal
Law No. 1 of 2006 on Electronic Commerce and Transactions, which governs the integrity and
reliability of electronic transactions. Lastly is the Internet Access Management policy, which
administrates online content.
Three of UAE’s economic free zones have also enacted specific data protection laws applicable
within their jurisdiction. These are the Dubai International Financial Centre (“DIFC”), Abu Dhabi
Global Market (“ADGM”) and the Dubai Healthcare City (“DHCC”).
Nonetheless, the UAE has until now not had federally applicable data law. The announcement of
the new UAE data law is therefore a big development.
The New Data Law
Drafted in partnership with major technology companies, the new data law is being introduced to
boost economic growth in the UAE. It will be applicable globally, allowing for a “seamless and
smooth transfer across borders.”
With technological advancements enabling companies to gather and store voluminous amounts
of personal data and information, data protection has become one of the main concerns of
institutions and private individuals alike. According to Mr. Al Oloma, Minister of State for Digital
Economy, AI and Remote Working System, the new data law shall have the lowest cost of
compliance. This ensures that compliance with the new data law will not be a burden to
institutions, no matter if they are SMEs or major commercial companies.
In addition to the above, the following is also expected to be addressed by the new data law:
- Protection of the right to privacy of both individuals and organisations;
- Individuals’ right to be forgotten, right of access and right to information; and
- Limitation on institutions profiting off of personal data unless consent was acquired.
Conclusion
Although the introduction of the new data law is highly welcomed, it remains to be seen what else
the provisions of the law may be. Nevertheless, the highly anticipated data law is a huge steppingstone for the UAE in its aim to ensuring data protection.
Disclaimer
This article is for informational purposes only and shall not be considered as legal advice or
opinion.