Faqs

The Commissioner of Data Protection is responsible for administering the Data Protection Law.

DP Law 2020 applies in the jurisdiction of the DIFC, to the Processing of Personal Data: (a) by automated means; and (b) other than by automated means where the Personal Data forms part of a Filing System or is intended to form part of a Filing System.

It applies to the Processing of Personal Data by a Controller or Processor incorporated in the DIFC, regardless of whether the Processing takes place in the DIFC or not. It also applies to a Controller or Processor, regardless of its place of incorporation, that Processes Personal Data in the DIFC as part of stable arrangements, other than on an occasional basis. The important thing to understand for this application is the context of the Processing activity of the non-DIFC entity within the DIFC (i.e., and not in a Third Country), including transfers of Personal Data out of the DIFC.

Processing "in the DIFC" occurs when the means or personnel used to conduct the Processing activity are physically located in the DIFC, and Processing "outside the DIFC" is to be interpreted accordingly.

So even though an entity may be outside or not even registered or licensed in the DIFC, the DP Law 2020 will apply to Processing operations performed as a result of an engagement with a DIFC entity that is ongoing, contractual, or any other means of demonstrating that it is more than a simply one-off instance of processing. The non-DIFC entity ordinarily would not be required to notify the Commissioner or perform other administrative tasks like appointing a DPO, although it may do so if it wishes anyway, as best practice. The non-DIFC entity may also be subject to liabilities such as fines or third party claims.

DP Law 2020 does not apply to the Processing of Personal Data by natural persons in the course of a purely personal or household activity that has no connection to a commercial purpose.

Please see Article 6 of the DP Law 2020 for further information.

Personal Data is any information relating to an identified natural person or Identifiable Natural Person. For example, Personal Data may include an individual’s name, age, home address, income, marital status, education, or employment information, or any combination of these things. If one element of information does not identify someone on its own, such as the name “John Smith”, other elements should ordinarily contribute to identifying a person. In accordance with DIFC law, a legal entity or organization does not have personal data.

Special Category Data is Personal Data revealing or concerning (directly or indirectly) racial or ethnic origin, communal origin, political affiliations or opinions, religious or philosophical beliefs, criminal record, trade-union membership and health or sex life and including genetic data and biometric data where it is used for the purpose of uniquely identifying a natural person. General information like names and addresses do not traditionally constitute Special Category Data. Any possible exceptions should be discussed with the Commissioner of Data Protection.

Whether information relates to a particular individual will be a question of fact in each case. If a connection can be made between the information and an individual, then the information is Personal Data. Personal Data can relate to more than one individual. For example, information concerning a joint bank account relates to both account holders and therefore is the Personal Data of each account holder and would be protected as such.

A Controller is any person in the DIFC who determines the purposes for which, and the manner in which, any Personal Data is to be Processed.

Any person who processes Personal Data on behalf of a Controller.

A Data Subject is the individual to whom the Personal Data relates. For example, where an organisation holds Personal Data about its employees, the employees are Data Subjects.

Any person other than the Data Subject, the Data Controller, the Data Processor and the persons who, under the direct control of the Data Controller or the Data Processor, is authorised to process the Personal Data

Processing is any operation or set of operations performed upon Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage and archiving, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, transfer or otherwise making available, alignment or combination, restricting (meaning the marking of stored Personal Data with the aim of limiting Processing of it in the future), erasure or destruction, but excluding operations or sets of operations performed on Personal Data by:

1. a natural person in the course of a purely personal or household activity that has no connection to a commercial purpose; or
2. law enforcement authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and preventing threats to public security.

Accountability is captured in Articles 14 to 22 of the DP Law 2020. It is, in a nutshell, a means of showing transparency and proper management and handling of a very important asset: your Personal Data.

It includes taking such measure as appointing a Data Protection Officer or “DPO”, who is someone that independently manages accountability and DP compliance within a company. It also includes carrying out impact assessments to understand the risks (security, sharing, access, etc) to your Personal Data.

The Controller must notify the Commissioner of Data Protection when it is:

• Processing Personal Data, Special Category Data; and/or transferring Personal Data outside the DIFC to a jurisdiction that does not have adequate levels of data protection. It must also notify of activities and operations, accountability measures and data breaches (if any).
• The notification to the Commissioner of Data Protection must be updated annually.
• If during the year, the manner of Processing is changed, a notification reflecting this must be submitted to the Commissioner of Data Protection.

Notification by a Controller is carried out by completing a notification available in Client Portal and sending it to the Commissioner of Data Protection at the DIFC.

Dealing With The Data Subject

A Controller must securely keep any Personal Data it collects and process it fairly and lawfully. At or before the time Personal Data is collected from a Data Subject, a Controller should take reasonable steps to ensure that the Data Subject is aware of:

• the identity of the Controller and how to contact it;
• the fact that the Data Subject is able to gain access to their Personal Data;
• the purposes for which their Personal Data is collected;
• other persons to whom the Controller usually discloses data of that kind; and
• the main consequence for the Data Subject if all or part of the data is not

  provided.

If a Controller intends to Process the Personal Data collected from a Data Subject, it is suggested that when the Controller collects that Personal Data, the Data Controller obtain the Data Subject’s written consent to such Processing at the same time.

Initial Internal Procedures

The Controller should consider the following for all Personal Data:

• purpose for which it holds Personal Data;
• number of individuals identified in the Personal Data it holds;
• nature of the Personal Data;
• length of time it holds Personal Data;
• procedure for individuals identified by the Personal Data it holds to obtain access to their Personal Data; and
• the possible consequences for individuals identified by the Personal Data it holds as a result of the way it holds, erases or Processes Personal Data.

Ongoing Internal Procedure

The Controller should consider the following matters:

• is there a record of when the Personal Data it holds was recorded or last updated?
• are all those involved with the collection and Processing of Personal Data, including people to whom they are disclosed as well as employees of the Data Controller, aware that the Personal Data may not necessarily be up to date and accurate?
• are steps taken to update the Personal Data, for example, by checking back at intervals with the original source or with the Data Subject? If so, how effective are these steps?
• if the Personal Data is out of date is it likely to cause damage or distress to the Data

  Subject?

Transfers

Before Personal Data is transferred outside the DIFC the Controller should consider the following matters:

• has the Data Subject unambiguously consented to the proposed transfer?
• is the transfer necessary for the performance of a contract between the Data Subject and the Controller?
• is the transfer necessary or legally required on grounds important in the interests of the DIFC, or for the establishment, exercise or defence of legal claims?
• is the transfer necessary in order to protect the vital interests of the Data Subject?
• is the transfer intended to provide information to the public which is open to consultation?
• is the transfer necessary to comply with any legal obligation?
• is the transfer necessary to uphold the legitimate interests of the Controller recognised in the international financial markets?
• is the transfer necessary to comply with auditing, accounting or anti-money laundering obligations that apply to a Controller?

Under the DP Law 2020, Processors (and where applicable, Sub-processors) have certain compliance obligations and notification requirements as well. Please review the DP Law 2020 particularly at Articles 14 to 22 and Article 24.

The data protection legislation gives certain rights to Data Subjects concerning their Personal Data and Sensitive Personal Data. Generally, a Data Subject has the right to access any Personal Data that is kept about them.

If the Personal Data Processed by the Data Controller is inaccurate, then the Data Subject can request the Data Controller to take action to rectify, block or destroy the inaccurate data. However, there are certain circumstances, or exemptions, where it is legal for a Data Controller not to have to notify a Data Subject that Personal Data is being Processed. For example, where Personal Data is being released to a legitimate authority to comply with anti money laundering obligations.

A Data Subject can object on reasonable grounds to the Processing of their Personal Data, and request their Personal Data not be disclosed to third parties. This may include circumstances where an individual requests a Data Controller to cease Processing Personal Data for the purposes of direct marketing. If the Data Controller objects to the request, the Data Subject may file a complaint with the Commissioner of Data Protection at DIFC who may refer the matter to mediation.

Personal Data includes Data relating to an individual. Therefore this may include an employer’s appraisal or opinion of an employee.

A Recipient is any person to whom Personal Data is disclosed. An example of a Recipient is a member of the human resources department in an organisation who receives Personal Data or Sensitive Personal Data about employees of that organisation.