Data Controller Agreement Template for the United Arab Emirates

A Data Controller Agreement is a critical legal document that establishes the framework for how organizations handle personal data in the United Arab Emirates. Under UAE Federal Decree-Law No. 45 of 2021, any entity that determines the purposes and means of processing personal data must have clear contractual arrangements that define responsibilities, obligations, and compliance requirements.

When do you need this document?

You need a Data Controller Agreement when your organization processes personal data of UAE residents or operates within UAE jurisdiction. This includes situations where you engage service providers to process data on your behalf, transfer data across borders, or work with sub-processors. The agreement is essential for multinational companies with UAE operations, local businesses handling customer data, healthcare providers managing patient information, and financial institutions processing client data. Free zone entities in DIFC and ADGM require specific provisions that align with their respective data protection regulations.

Key legal considerations

Your agreement must clearly define the roles of data controllers and processors, specify lawful bases for processing under UAE law, and establish robust data security measures. Key clauses should address data retention periods, breach notification procedures within 72 hours to authorities, and mechanisms for handling data subject rights requests. The agreement must include provisions for conducting data protection impact assessments for high-risk processing activities and maintaining records of processing activities. Cross-border data transfer clauses are crucial, as they must demonstrate adequate protection levels or implement appropriate safeguards. You should also include termination clauses that specify data deletion or return obligations.

Legal requirements in United Arab Emirates

Under Federal Decree-Law No. 45 of 2021, data controllers must implement technical and organizational measures to ensure data security and confidentiality. Your agreement must comply with specific requirements for sensitive personal data, including health data under UAE Federal Law No. 2 of 2019. If operating in DIFC, you must adhere to DIFC Law No. 5 of 2020, which follows GDPR-like principles with stricter consent requirements. ADGM entities must comply with ADGM Data Protection Regulations 2021, which include specific provisions for automated decision-making. Financial institutions must also consider UAE Cabinet Resolution No. 31 of 2019 regarding cybersecurity requirements. The agreement should designate a Data Protection Officer where required and establish clear reporting lines to relevant regulatory authorities including the UAE Data Office and applicable free zone authorities.