Personal Information Consent Form Template for the United Arab Emirates

A Personal Information Consent Form is a legally binding document that organizations in the United Arab Emirates must use to obtain explicit permission before collecting, processing, or storing personal data. Under UAE Federal Decree Law No. 45 of 2021, this document serves as crucial evidence that individuals have voluntarily agreed to data processing activities, protecting both organizations and data subjects while ensuring regulatory compliance.

When do you need this document?

You need this consent form whenever your organization collects personal information from individuals in the UAE, whether they are customers registering for services, employees providing employment details, or visitors sharing contact information. This document is essential for businesses operating websites with data collection features, healthcare providers gathering patient information, educational institutions enrolling students, or financial services companies onboarding clients. The form becomes particularly critical when processing sensitive personal data, transferring information internationally, or engaging third-party processors. Organizations operating within special economic zones like DIFC or ADGM must ensure their consent forms meet additional jurisdictional requirements beyond federal law.

Key legal considerations

Your consent form must clearly identify the data controller, specify the exact purposes for data collection, and list the types of personal information being processed. The document should outline how long data will be retained, whether it will be shared with third parties, and the legal basis for processing. You must include comprehensive information about individual rights, including the right to access, rectify, delete, and port personal data. The form should provide clear instructions for withdrawing consent and ensure that withdrawal is as easy as giving consent. Special provisions are required when collecting data from minors, necessitating parental or guardian consent. Your organization must also address cross-border data transfers and implement appropriate safeguards when personal information leaves the UAE.

Legal requirements in United Arab Emirates

UAE Federal Decree Law No. 45 of 2021 mandates that consent must be freely given, specific, informed, and unambiguous, requiring active opt-in rather than pre-checked boxes or implied consent. Your consent form must be written in clear, plain language that individuals can easily understand, avoiding legal jargon or complex terminology. The law requires you to maintain detailed records of consent, including when it was obtained, what was consented to, and any subsequent changes or withdrawals. Organizations must implement robust data protection measures and may need to appoint a Data Protection Officer depending on their processing activities. If you operate in the Dubai International Financial Centre, you must also comply with DIFC Data Protection Law No. 5 of 2020, which has additional requirements for consent documentation. Abu Dhabi Global Market entities must follow ADGM Data Protection Regulations 2021, which may impose stricter standards for certain types of processing activities.