Model Consent Form Template for the United Arab Emirates

A Model Consent Form is a standardized legal document template that enables organizations in the United Arab Emirates to obtain valid consent for personal data processing activities. Under Federal Decree Law No. 45 of 2021, organizations must secure explicit consent from individuals before collecting, processing, or transferring their personal data, making this document essential for legal compliance.

When do you need this document?

You need a Model Consent Form whenever your organization processes personal data that requires explicit consent under UAE law. This includes collecting customer information for marketing purposes, processing employee data beyond employment requirements, handling medical records in healthcare settings, or transferring personal data to third parties. The form is particularly crucial when processing special category data such as health information, biometric data, or financial records. Organizations operating in free zones like DIFC must also use consent forms when transferring data across jurisdictions or engaging in cross-border data processing activities.

Key legal considerations

Your consent form must clearly specify the purpose of data collection and processing, ensuring individuals understand exactly how their information will be used. The document should identify all parties involved, including data controllers, processors, and any third-party recipients who may access the data. You must include provisions for data subjects to withdraw consent at any time, as this right is fundamental under UAE data protection law. The form should specify data retention periods and outline security measures for protecting personal information. When dealing with minors or individuals lacking legal capacity, you must obtain consent from legal guardians or authorized representatives. Electronic consent mechanisms are permissible under UAE Federal Law No. 1 of 2006, but you must ensure proper authentication and record-keeping.

Legal requirements in United Arab Emirates

Under Federal Decree Law No. 45 of 2021, your consent form must be freely given, specific, informed, and unambiguous. The law requires that consent requests be presented in clear, plain language that individuals can easily understand. You must provide your organization's full details, including license numbers and contact information for data protection inquiries. For healthcare organizations, UAE Federal Law No. 7 of 2019 and Federal Law No. 2 of 2019 impose additional requirements for medical consent forms, including specific provisions for electronic health information processing. If operating within DIFC jurisdiction, you must comply with DIFC Law No. 5 of 2020, which may have stricter requirements for international data transfers. The form must include mandatory disclosures about data subject rights, including access, rectification, erasure, and portability rights. You should also specify the legal basis for processing and provide clear opt-out mechanisms for direct marketing activities.