Global Privacy Notice Template for the United Arab Emirates

A Global Privacy Notice is your organization's comprehensive statement explaining how you collect, use, and protect personal data in compliance with UAE data protection laws. This document serves as the foundation of your privacy compliance program, providing transparency to customers, employees, and other stakeholders about your data handling practices.

When do you need this document?

You need a Global Privacy Notice before beginning any personal data collection activities in the UAE. This includes launching a website with data collection forms, implementing customer relationship management systems, processing employee information, or engaging with third-party service providers who handle personal data on your behalf. If your organization operates across multiple UAE jurisdictions, including DIFC or ADGM free zones, you must ensure your notice addresses the varying regulatory requirements. Companies expanding internationally also require this document to demonstrate compliance when transferring data across borders or working with global partners.

Key legal considerations

Your Global Privacy Notice must clearly identify your legal basis for processing personal data under UAE law, whether for contract performance, legal compliance, legitimate interests, or consent. The document should specify data retention periods, outline data subject rights including access and deletion requests, and explain your security measures for protecting personal information. You must also address cross-border data transfers, particularly if you share data with processors outside the UAE or operate in multiple jurisdictions. Include clear contact information for privacy inquiries and detail your complaint handling procedures. The notice should also specify how you handle sensitive personal data categories and any automated decision-making processes.

Legal requirements in United Arab Emirates

Under Federal Decree-Law No. 45/2021 and its Executive Regulations, your Global Privacy Notice must be written in clear, plain language and made easily accessible to data subjects. The law requires specific disclosures about data processing purposes, recipient categories, and international transfers. If operating in DIFC, you must also comply with DIFC Law No. 5 of 2020, which incorporates GDPR-like principles including enhanced consent requirements and stricter transfer restrictions. ADGM entities must follow the ADGM Data Protection Regulations 2021, which similarly align with international standards. Your notice must be available in Arabic for UAE mainland operations, and you're required to notify the UAE Data Office of certain high-risk processing activities. Regular updates to your notice trigger notification obligations to data subjects, and you must maintain records demonstrating compliance with all applicable privacy laws across your operational jurisdictions.