Privacy Information Notice Template for the United Arab Emirates

A Privacy Information Notice is a legally required document that organizations in the United Arab Emirates must provide to individuals when collecting or processing their personal data. Under Federal Decree-Law No. 45/2021 and Cabinet Resolution No. 100/2022, you must ensure transparency about your data processing activities by clearly communicating how you handle personal information. This notice serves as a bridge between your organization and data subjects, establishing trust while meeting strict regulatory compliance requirements.

When do you need this document?

You need a Privacy Information Notice whenever your organization collects, stores, or processes personal data of individuals in the UAE. This includes situations such as collecting customer information for service delivery, processing employee data for HR purposes, gathering website visitor data through cookies, or handling client information for professional services. The notice is particularly critical for businesses operating across multiple UAE jurisdictions, including free zones like DIFC and ADGM, which have specific data protection requirements. E-commerce platforms, healthcare providers, financial institutions, and any organization with an online presence must implement this notice to ensure legal compliance from the moment data collection begins.

Key legal considerations

Your Privacy Information Notice must include several mandatory elements under UAE law, including the identity and contact details of the data controller, categories of personal data collected, legal basis for processing, and specific purposes for data use. You must clearly outline data subject rights, including access, rectification, deletion, and objection rights as established under Federal Decree-Law No. 45/2021. The notice should specify data retention periods, security measures implemented to protect personal information, and procedures for exercising individual rights. Additionally, you must disclose any international data transfers, third-party data sharing arrangements, and provide contact information for your Data Protection Officer if appointed. Regular updates to the notice are essential when processing activities change or new legal requirements emerge.

Legal requirements in United Arab Emirates

Under UAE Federal Decree-Law No. 45/2021 and its Executive Regulations, your Privacy Information Notice must be provided at the point of data collection or before processing begins. The notice must be written in Arabic or English, easily accessible, and presented in clear, plain language that ordinary individuals can understand. For organizations operating in DIFC, compliance with DIFC Law No. 5 of 2020 requires additional considerations similar to GDPR standards. ADGM entities must align with the ADGM Data Protection Regulations 2021, which may impose stricter requirements for certain processing activities. The UAE Data Office has enforcement authority and can impose significant penalties for non-compliance, making proper notice implementation crucial for avoiding regulatory sanctions. Your notice must also accommodate the cultural and linguistic diversity of the UAE population, ensuring accessibility for all data subjects regardless of their background.