Joint Controller Agreement Template for the United Arab Emirates

A Joint Controller Agreement is a critical legal document that establishes the framework when two or more organizations jointly determine the purposes and means of processing personal data in the United Arab Emirates. Under Federal Decree-Law No. 45 of 2021, joint controllers must clearly define their respective roles and responsibilities to ensure compliance with UAE data protection requirements.

When do you need this document?

You need a Joint Controller Agreement when your organization collaborates with another entity in processing personal data where both parties have decision-making authority. This includes joint marketing campaigns where customer data is shared, research partnerships involving personal information, shared customer loyalty programs, or collaborative projects between UAE companies and international partners. The agreement is particularly important in free zones like DIFC and ADGM, where additional regulatory requirements apply alongside federal law.

Key legal considerations

The agreement must clearly allocate responsibilities for data protection compliance between controllers, including data security measures, breach notification procedures, and handling data subject requests. Under UAE law, both controllers remain jointly liable for compliance failures, making clear responsibility allocation crucial. The document should address cross-border data transfers, especially important given the UAE's role as a regional business hub. You must also consider the appointment of Data Protection Officers where required, local representative obligations, and specific requirements for processing sensitive personal data categories under Federal Decree-Law No. 45 of 2021.

Legal requirements in United Arab Emirates

UAE data protection law requires joint controllers to establish transparent arrangements through a written agreement that complies with Federal Decree-Law No. 45 of 2021. If operating in free zones, additional compliance with DIFC Law No. 5 of 2020 or ADGM Data Protection Regulations 2021 may be required. The agreement must address data subject rights procedures, including access, rectification, and erasure requests, with clear timelines for response. For healthcare data, compliance with Federal Law No. 2 of 2019 concerning healthcare ICT use is mandatory. The document should also specify which controller will serve as the primary contact point for regulatory authorities and data subjects, ensuring seamless compliance with UAE notification and registration requirements.