Personal Data Consent Form Template for the United Arab Emirates

You need a Personal Data Consent Form when your organization collects, processes, or stores personal information from individuals in the United Arab Emirates. This legal document establishes explicit authorization from data subjects before you can handle their personal data, ensuring compliance with UAE Federal Decree-Law No. 45 of 2021 and protecting both your organization and individuals' privacy rights.

When do you need this document?

You require this consent form whenever your organization collects personal data from UAE residents or processes data within UAE jurisdiction. This includes customer registration processes, employee onboarding, marketing campaigns, website data collection, mobile app usage, and any business activities involving personal information. Healthcare providers need it for patient data, educational institutions for student records, and financial services for client information. E-commerce businesses must obtain consent before collecting customer details, while employers need it for processing employee personal data beyond basic employment requirements.

Key legal considerations

Your consent form must clearly identify your organization as the data controller, specify exact purposes for data collection, and list all types of personal data you plan to process. You must inform data subjects about their rights under UAE law, including access, correction, deletion, and data portability rights. The form should detail data retention periods, security measures, and any third-party data sharing arrangements. You must provide clear withdrawal procedures, allowing individuals to revoke consent easily. Special considerations apply for sensitive personal data categories, requiring enhanced protection measures and explicit consent language. If you transfer data internationally, you must disclose recipient countries and ensure adequate protection levels.

Legal requirements in United Arab Emirates

UAE Federal Decree-Law No. 45 of 2021 mandates specific consent requirements that your form must address. The Executive Regulations specify that consent must be freely given, specific, informed, and unambiguous, obtained through clear affirmative action. You must provide all information in Arabic or the data subject's preferred language if different. For organizations operating in Dubai International Financial Centre (DIFC), additional compliance with DIFC Law No. 5 of 2020 may be required. Abu Dhabi Global Market (ADGM) entities must follow ADGM Data Protection Regulations 2021. Your form must include mandatory disclosures about data processing lawful basis, controller contact details, and Data Protection Officer information if appointed. You must maintain consent records as proof of compliance and implement technical measures to ensure consent authenticity and integrity.