Data Privacy Notice Template for the United Arab Emirates
Generate a bespoke document
What is a Data Privacy Notice?
The Data Privacy Notice serves as a fundamental document required under UAE Federal Decree Law No. 45/2021, designed to inform data subjects about how their personal data is collected, processed, and protected. Organizations operating in the UAE must maintain transparency in their data processing activities through this notice, which needs to comply with both federal requirements and, where applicable, specific free zone regulations such as DIFC and ADGM data protection laws. The document should be implemented when an organization collects or processes personal data, requiring regular updates to reflect changes in data processing activities or regulatory requirements. It forms a crucial part of an organization's data protection framework and demonstrates compliance with UAE privacy laws.
About the Data Privacy Notice
A Data Privacy Notice is a critical legal document that you must provide to individuals whose personal data you collect or process in the United Arab Emirates. Under Federal Decree Law No. 45/2021, this notice serves as your primary tool for maintaining transparency with data subjects and demonstrating compliance with UAE's comprehensive data protection framework.
When do you need this document?
You need a Data Privacy Notice whenever you collect personal data from individuals, whether through websites, mobile applications, customer registration forms, employment processes, or business transactions. This requirement applies to all organizations operating in the UAE, including companies in free zones such as DIFC and ADGM, which have additional specific obligations. The notice must be provided at the time of data collection or before processing begins, and you must update it whenever your data processing activities change significantly.
Key legal considerations
Your Data Privacy Notice must include specific information required under UAE law, including your identity as the data controller, contact details of your Data Protection Officer if applicable, and clear descriptions of data processing purposes. You must specify the legal basis for processing, retention periods, and data subjects' rights including access, rectification, and erasure. The notice should detail any data sharing with third parties, international transfers, and security measures you implement. Consider including information about automated decision-making processes and profiling activities if relevant to your operations. Ensure the language is clear and accessible, avoiding complex legal jargon that might confuse data subjects.
Legal requirements in United Arab Emirates
Under Federal Decree Law No. 45/2021 and Cabinet Resolution No. 100/2022, your Data Privacy Notice must comply with specific UAE requirements for content and format. The law mandates that you provide notice in Arabic, though English translations are acceptable for international businesses. You must clearly identify yourself as the data controller and provide UAE-based contact information for data protection inquiries. If operating in DIFC or ADGM, additional requirements under their respective data protection laws apply, including enhanced disclosure obligations and specific formatting requirements. The notice must be easily accessible, prominently displayed on your website's homepage, and available in physical locations where you collect data. You're required to maintain records demonstrating when and how the notice was provided to data subjects, as this documentation may be requested during regulatory audits by UAE authorities.
GOVERNING LAW
Applicable law
This Data Privacy Notice is drafted to comply with United Arab Emirates law. Key legislation includes:
Cabinet Resolution No. 100/2022: Executive Regulations of Federal Decree Law No. 45/2021, providing detailed implementation requirements and specific obligations for data controllers and processors.
DIFC Law No. 5 of 2020: Data Protection Law specific to Dubai International Financial Centre (DIFC), relevant if the business operates within or deals with DIFC entities. This law is largely aligned with GDPR principles.
ADGM Data Protection Regulations 2021: Abu Dhabi Global Market's data protection regulations, applicable to entities operating within ADGM. These regulations are also aligned with international standards.
Federal Law No. 2 of 2019: Law concerning the use of ICT in healthcare, which includes specific provisions for handling health data and medical information.
UAE Consumer Protection Law: Federal Law No. 15 of 2020 concerning consumer protection, which includes provisions related to consumer data protection and privacy in commercial transactions.
UAE Cyber Crime Law: Federal Decree Law No. 34 of 2021 concerning combating cybercrime, which includes provisions related to data privacy and security in the digital space.
Explore 208,390+ legal templates
Explore 208,390+ legal templates
Genie's Security Promise
Genie is the safest place to draft. Here's how we prioritise your privacy and security.
Your data is private:
We do not train on your data; Genie's AI improves independently
All data stored on Genie is private to your organisation
Your documents are protected:
Your documents are protected by ultra-secure 256-bit encryption
We are ISO27001 certified, so your data is secure
Organizational security:
You retain IP ownership of your documents and their information
You have full control over your data and who gets to see it