General Privacy Notice Template for the United Arab Emirates
Generate a bespoke document
What is a General Privacy Notice?
This General Privacy Notice serves as a fundamental compliance document for organizations operating in the United Arab Emirates that collect and process personal data. It is designed to meet the requirements of Federal Decree-Law No. 45/2021, as well as other applicable data protection regulations including those specific to free zones like DIFC and ADGM. The document should be implemented by any organization handling personal data to inform data subjects about their data processing activities, ensure transparency, and demonstrate compliance with UAE privacy laws. It is particularly important given the UAE's increasing focus on data protection and the significant penalties for non-compliance. The notice must be regularly reviewed and updated to reflect changes in data processing activities or regulatory requirements.
About the General Privacy Notice
A General Privacy Notice is a legally required document in the United Arab Emirates that informs individuals about how your organization collects, uses, and protects their personal data. Under Federal Decree-Law No. 45/2021, you must provide clear and accessible information about your data processing activities before collecting any personal information from data subjects.
When do you need this document?
You need a General Privacy Notice whenever your organization collects personal data from individuals, whether through websites, mobile apps, customer registration forms, employment applications, or any other means. This applies to all sectors including healthcare facilities collecting patient information, financial institutions processing customer data, retail businesses gathering customer details, educational institutions managing student records, and technology companies collecting user data. The notice must be prominently displayed and easily accessible to data subjects before they provide their personal information.
Key legal considerations
Your privacy notice must clearly specify the legal basis for processing personal data under UAE law, which may include consent, contractual necessity, legal obligations, vital interests, or legitimate interests. You must detail the types of personal data collected, the purposes for processing, retention periods, and any third parties with whom data is shared. The notice should outline data subjects' rights including access, rectification, deletion, and objection to processing. You must also include information about data transfers outside the UAE and the security measures implemented to protect personal data. Regular updates to the privacy notice are essential when processing activities change or new legal requirements emerge.
Legal requirements in United Arab Emirates
Under Federal Decree-Law No. 45/2021, organizations must ensure their privacy notices are written in clear, plain language that data subjects can easily understand. The notice must be provided in Arabic and may also be provided in other languages as appropriate. Companies operating in the Dubai International Financial Centre (DIFC) must comply with DIFC Law No. 5 of 2020, which follows GDPR-like principles for privacy notices. Organizations in the Abu Dhabi Global Market (ADGM) must adhere to the ADGM Data Protection Regulations 2021. Healthcare entities must also consider Federal Law No. 2 of 2019 for health-related data processing. The privacy notice must be easily accessible, preferably through your organization's website, and provided at the point of data collection. Failure to provide adequate privacy notices can result in significant fines and regulatory sanctions under UAE data protection laws.
GOVERNING LAW
Applicable law
This General Privacy Notice is drafted to comply with United Arab Emirates law. Key legislation includes:
DIFC Law No. 5 of 2020: Dubai International Financial Centre's Data Protection Law, which follows GDPR-like principles and applies to companies operating in the DIFC
ADGM Data Protection Regulations 2021: Abu Dhabi Global Market's data protection regulations that govern personal data processing within the ADGM free zone
Federal Law No. 2 of 2019: Concerning the Use of Information and Communication Technology in Healthcare, which includes specific provisions for handling health-related personal data
UAE Cyber Crime Law (Federal Decree-Law No. 5 of 2012): Contains provisions relating to privacy violations and unauthorized access to personal data in digital format
Federal Law No. 15 of 2020: Consumer Protection Law that includes provisions related to consumer privacy and data protection in commercial transactions
UAE Central Bank Consumer Protection Regulation: Includes specific requirements for handling financial consumer data and privacy protection in the banking sector
Telecommunications and Digital Government Regulatory Authority (TDRA) regulations: Guidelines and regulations concerning digital privacy and data protection in telecommunications and digital services
Explore 208,390+ legal templates
Explore 208,390+ legal templates
Genie's Security Promise
Genie is the safest place to draft. Here's how we prioritise your privacy and security.
Your data is private:
We do not train on your data; Genie's AI improves independently
All data stored on Genie is private to your organisation
Your documents are protected:
Your documents are protected by ultra-secure 256-bit encryption
We are ISO27001 certified, so your data is secure
Organizational security:
You retain IP ownership of your documents and their information
You have full control over your data and who gets to see it