Data Privacy Consent Statement Template for the United Arab Emirates
Generate a bespoke document
What is a Data Privacy Consent Statement?
The Data Privacy Consent Statement is a mandatory document required under UAE data protection laws, particularly Federal Decree-Law No. 45/2021, for organizations collecting and processing personal data. This document must be obtained before collecting personal information from individuals and should clearly outline the scope of data collection, processing purposes, and data subject rights. The statement needs to comply with both federal requirements and, where applicable, specific free zone regulations such as DIFC and ADGM data protection laws. It should be provided in both English and Arabic, clearly written, and easily accessible to data subjects. The document is particularly crucial given the UAE's strict penalties for data protection violations and its growing emphasis on digital privacy rights.
About the Data Privacy Consent Statement
When you collect personal data in the United Arab Emirates, you need a compliant Data Privacy Consent Statement to meet strict legal requirements under federal law. This document serves as your legal foundation for processing personal information and protects both your organization and the individuals whose data you collect.
When do you need this document?
You must obtain written consent before collecting any personal data from customers, employees, or website visitors in the UAE. This includes collecting email addresses for marketing, processing job applications, gathering customer information for service delivery, or storing health records in healthcare settings. E-commerce businesses need consent for payment processing and order fulfillment, while educational institutions require it for student records. If you operate in free zones like DIFC or ADGM, additional consent requirements may apply alongside federal regulations.
Key legal considerations
Your consent statement must be specific, informed, and freely given under UAE law. You cannot use pre-ticked boxes or bundle consent with terms of service agreements. The document must clearly identify your organization as the data controller and specify exactly what personal data you collect, why you need it, and how long you will retain it. You must explain data subject rights including access, correction, and deletion rights. If you share data with third parties or transfer it outside the UAE, explicit consent is required with clear disclosure of recipients and security measures. For sensitive personal data like health information or biometric data, enhanced consent procedures apply with additional safeguards.
Legal requirements in United Arab Emirates
Federal Decree-Law No. 45/2021 mandates that consent statements be written in clear, plain language and available in both English and Arabic. You must provide the statement before data collection begins and allow individuals reasonable time to review it. The law requires you to maintain records of consent and demonstrate compliance during regulatory inspections. Healthcare organizations must also comply with Federal Law No. 2 of 2019 for health data processing. Companies in DIFC must follow DIFC Law No. 5 of 2020, which implements GDPR-like standards for consent. Violations can result in fines up to AED 2 million for individuals and AED 10 million for companies, plus potential criminal charges under the UAE Penal Code for privacy breaches.
GOVERNING LAW
Applicable law
This Data Privacy Consent Statement is drafted to comply with United Arab Emirates law. Key legislation includes:
DIFC Law No. 5 of 2020: Data Protection Law specifically applicable to companies operating in Dubai International Financial Centre, which follows GDPR-like principles
UAE Federal Law No. 3 of 1987 (Penal Code): Contains provisions relating to privacy violations and unauthorized disclosure of confidential information
Federal Law No. 2 of 2019: Concerning the Use of Information and Communication Technology in Healthcare, which provides specific requirements for handling health-related personal data
UAE Federal Law No. 24 of 2006: Consumer Protection Law that includes provisions about handling customer data in commercial contexts
Federal Decree-Law No. 3 of 2003: Telecom Law which includes provisions about data transmission and privacy in telecommunications
ADGM Data Protection Regulations 2021: Specific data protection regulations applicable to companies operating in Abu Dhabi Global Market free zone
Explore 208,390+ legal templates
Explore 208,390+ legal templates
Genie's Security Promise
Genie is the safest place to draft. Here's how we prioritise your privacy and security.
Your data is private:
We do not train on your data; Genie's AI improves independently
All data stored on Genie is private to your organisation
Your documents are protected:
Your documents are protected by ultra-secure 256-bit encryption
We are ISO27001 certified, so your data is secure
Organizational security:
You retain IP ownership of your documents and their information
You have full control over your data and who gets to see it