Faqs

The Commissioner of Data Protection is responsible for administering the Data Protection Law.

DP Law 2020 applies in the jurisdiction of the DIFC, to the Processing of Personal Data: (a) by automated means; and (b) other than by automated means where the Personal Data forms part of a Filing System or is intended to form part of a Filing System.

It applies to the Processing of Personal Data by a Controller or Processor incorporated in the DIFC, regardless of whether the Processing takes place in the DIFC or not. It also applies to a Controller or Processor, regardless of its place of incorporation, that Processes Personal Data in the DIFC as part of stable arrangements, other than on an occasional basis. The important thing to understand for this application is the context of the Processing activity of the non-DIFC entity within the DIFC (i.e., and not in a Third Country), including transfers of Personal Data out of the DIFC.

Processing "in the DIFC" occurs when the means or personnel used to conduct the Processing activity are physically located in the DIFC, and Processing "outside the DIFC" is to be interpreted accordingly.

So even though an entity may be outside or not even registered or licensed in the DIFC, the DP Law 2020 will apply to Processing operations performed as a result of an engagement with a DIFC entity that is ongoing, contractual, or any other means of demonstrating that it is more than a simply one-off instance of processing. The non-DIFC entity ordinarily would not be required to notify the Commissioner or perform other administrative tasks like appointing a DPO, although it may do so if it wishes anyway, as best practice. The non-DIFC entity may also be subject to liabilities such as fines or third party claims.

DP Law 2020 does not apply to the Processing of Personal Data by natural persons in the course of a purely personal or household activity that has no connection to a commercial purpose.

Please see Article 6 of the DP Law 2020 for further information.

Personal Data is any information relating to an identified natural person or Identifiable Natural Person. For example, Personal Data may include an individual’s name, age, home address, race, sexual orientation, income, blood type, marital status, education, and employment information.

Special Category Data is Personal Data revealing or concerning (directly or indirectly) racial or ethnic origin, communal origin, political affiliations or opinions, religious or philosophical beliefs, criminal record, trade-union membership and health or sex life and including genetic data and biometric data where it is used for the purpose of uniquely identifying a natural person.

Whether information relates to a particular individual will be a question of fact in each case. If a connection can be made between the information and an individual, then the information is Personal Data. Personal Data can relate to more than one individual. For example, information concerning a joint bank account relates to both account holders and therefore is the Personal Data of each account holder and would be protected as such.

A Controller is any person in the DIFC who determines the purposes for which, and the manner in which, any Personal Data is to be Processed.

Any person who processes Personal Data on behalf of a Controller.

A Data Subject is the individual to whom the Personal Data relates. For example, where an organisation holds Personal Data about its employees, the employees are Data Subjects.

Any person other than the Data Subject, the Data Controller, the Data Processor and the persons who, under the direct control of the Data Controller or the Data Processor, is authorised to process the Personal Data

Processing is any operation or set of operations performed upon Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage and archiving, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, transfer or otherwise making available, alignment or combination, restricting (meaning the marking of stored Personal Data with the aim of limiting Processing of it in the future), erasure or destruction, but excluding operations or sets of operations performed on Personal Data by:

1. a natural person in the course of a purely personal or household activity that has no connection to a commercial purpose; or
2. law enforcement authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and preventing threats to public security.

Accountability is captured in Articles 14 to 22 of the DP Law 2020. It is, in a nutshell, a means of showing transparency and proper management and handling of a very important asset: your Personal Data.

It includes taking such measure as appointing a Data Protection Officer or “DPO”, who is someone that independently manages accountability and DP compliance within a company. It also includes carrying out impact assessments to understand the risks (security, sharing, access, etc) to your Personal Data.

The Controller must notify the Commissioner of Data Protection when it is:

• Processing Personal Data, Special Category Data; and/or transferring Personal Data outside the DIFC to a jurisdiction that does not have adequate levels of data protection. It must also notify of activities and operations, accountability measures and data breaches (if any).
• The notification to the Commissioner of Data Protection must be updated annually.
• If during the year, the manner of Processing is changed, a notification reflecting this must be submitted to the Commissioner of Data Protection.

Notification by a Controller is carried out by completing a notification available in Client Portal and sending it to the Commissioner of Data Protection at the DIFC.

Dealing With The Data Subject

A Controller must securely keep any Personal Data it collects and process it fairly and lawfully. At or before the time Personal Data is collected from a Data Subject, a Controller should take reasonable steps to ensure that the Data Subject is aware of:

• the identity of the Controller and how to contact it;
• the fact that the Data Subject is able to gain access to their Personal Data;
• the purposes for which their Personal Data is collected;
• other persons to whom the Controller usually discloses data of that kind; and
• the main consequence for the Data Subject if all or part of the data is not

  provided.

If a Controller intends to Process the Personal Data collected from a Data Subject, it is suggested that when the Controller collects that Personal Data, the Data Controller obtain the Data Subject’s written consent to such Processing at the same time.

Initial Internal Procedures

The Controller should consider the following for all Personal Data:

• purpose for which it holds Personal Data;
• number of individuals identified in the Personal Data it holds;
• nature of the Personal Data;
• length of time it holds Personal Data;
• procedure for individuals identified by the Personal Data it holds to obtain access to their Personal Data; and
• the possible consequences for individuals identified by the Personal Data it holds as a result of the way it holds, erases or Processes Personal Data.

Ongoing Internal Procedure

The Controller should consider the following matters:

• is there a record of when the Personal Data it holds was recorded or last updated?
• are all those involved with the collection and Processing of Personal Data, including people to whom they are disclosed as well as employees of the Data Controller, aware that the Personal Data may not necessarily be up to date and accurate?
• are steps taken to update the Personal Data, for example, by checking back at intervals with the original source or with the Data Subject? If so, how effective are these steps?
• if the Personal Data is out of date is it likely to cause damage or distress to the Data

  Subject?

Transfers

Before Personal Data is transferred outside the DIFC the Controller should consider the following matters:

• has the Data Subject unambiguously consented to the proposed transfer?
• is the transfer necessary for the performance of a contract between the Data Subject and the Controller?
• is the transfer necessary or legally required on grounds important in the interests of the DIFC, or for the establishment, exercise or defence of legal claims?
• is the transfer necessary in order to protect the vital interests of the Data Subject?
• is the transfer intended to provide information to the public which is open to consultation?
• is the transfer necessary to comply with any legal obligation?
• is the transfer necessary to uphold the legitimate interests of the Controller recognised in the international financial markets?
• is the transfer necessary to comply with auditing, accounting or anti-money laundering obligations that apply to a Controller?

Under the DP Law 2020, Processors (and where applicable, Sub-processors) have certain compliance obligations and notification requirements as well. Please review the DP Law 2020 particularly at Articles 14 to 22 and Article 24.

The data protection legislation gives certain rights to Data Subjects concerning their Personal Data and Sensitive Personal Data. Generally, a Data Subject has the right to access any Personal Data that is kept about them.

If the Personal Data Processed by the Data Controller is inaccurate, then the Data Subject can request the Data Controller to take action to rectify, block or destroy the inaccurate data. However, there are certain circumstances, or exemptions, where it is legal for a Data Controller not to have to notify a Data Subject that Personal Data is being Processed. For example, where Personal Data is being released to a legitimate authority to comply with anti money laundering obligations.

A Data Subject can object on reasonable grounds to the Processing of their Personal Data, and request their Personal Data not be disclosed to third parties. This may include circumstances where an individual requests a Data Controller to cease Processing Personal Data for the purposes of direct marketing. If the Data Controller objects to the request, the Data Subject may file a complaint with the Commissioner of Data Protection at DIFC who may refer the matter to mediation.

Personal Data includes Data relating to an individual. Therefore this may include an employer’s appraisal or opinion of an employee.

A Recipient is any person to whom Personal Data is disclosed. An example of a Recipient is a member of the human resources department in an organisation who receives Personal Data or Sensitive Personal Data about employees of that organisation.

The data protection legislation is intended to protect the processing of Personal Data by a Controller or Processor or any Third Party related thereto. It also reinforces ethical data management through accountability requirements. It creates a legal and procedural framework which ensures that an individual’s Personal Data in the DIFC is treated fairly, lawfully and securely when it is stored, used or released.

The data protection legislation strikes a balance between a Data Subject’s right to control access to, and the use of, their Personal Data with a Controller’s need to collect and use Personal Data for legitimate or other specific legal purposes.

Yes, click here to view schedule of fees.

Fees:

• Category I includes entities regulated by the DFSA
• Category II includes DFSA non-regulated entities, except retail; and
• Category III includes retail entities.

Permits for processing Special Category Data and for Transfers out of the DIFC are no longer required or available. Please ensure your entity can justify such processing on another legitimate basis set out in the DP Law 2020.

A DPO is not always required. It is mandatory to appoint someone to this role in only 3 specific instances, the most applicable being where an entity engages in High Risk Processing or when the Commissioner directs an entity to do so. Please review Articles 16 to 18 of the DP Law 2020 for further details about the role, skills and task of the DPO.

Upon the enforcement of the DIFC Data Protection Law, DIFC registered entities with an appointed Data Protection Officer (DPO) will be required to submit an annual Assessment as per Article 19 of the DIFC Data Protection Law, DIFC Law No. 5 of 2020

The first submission of the Annual Assessment (if required in accordance with Article 19, i.e., where a DPO must be appointed) will be made on the first license renewal date after July 1, 2021.

Example:

• If your license renewal date is April 3, 2021, your first Annual Assessment filing date will be April 3, 2022.
• If your license renewal date is October 3, 2021, your first Annual Assessment filing date will be October 3, 2021.

If you are required to submit the Annual Assessment as per Article 19, we recommend that you to review the form and prepare for your first submission. To access and download the form, please click here.

Please note that this form will be made available in an electronic format by the entity’s first Annual Assessment due date and will be submitted on the DIFC Client Portal. Submissions by email will not accepted.

Please submit your group BCRs to commissioner@dp.difc.ae

The DIFC Standard DP Clauses have been adapted from the EU Standard Contractual Clauses (the SCCs, aka Model Clauses). The content has only been adapted regarding article references to the DIFC DP Law 2020. However, the transfer from DIFC to a non-DIFC jurisdiction must be covered if you only use the EU SCCs. So if there is a way that can be addressed in any additional text added to the EU MCs in the appendices for example (i.e., also covers transfers from DIFC to non-DIFC jurisdictions) or there is some clarity on this point in some way, that may suffice. If you have any questions please contact commissioner@dp.difc.ae