Faqs

The Commissioner of Data Protection is responsible for administering the Data Protection Law.

Sensitive Personal Data is personal data relating to an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, offences and criminal convictions, trade union membership, health or sex life.

A Recipient is any person to whom Personal Data is disclosed. An example of a Recipient is a member of the human resources department in an organisation who receives Personal Data or Sensitive Personal Data about employees of that organisation.

Processing is any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.

Personal Data includes Data relating to an individual. Therefore this may include an employer’s appraisal or opinion of an employee.

The Data Controller must notify the Commissioner of Data Protection when it is:

• Processing Sensitive Personal Data; and/or transferring Personal Data outside the DIFC to a jurisdiction that does not have adequate levels of data protection.
• If Processing of Personal Data continues, the Commissioner of Data Protection must be notified annually.
• If during the year, the manner of Processing is changed, a notification reflecting this must be submitted to the Commissioner of Data Protection.

Notification by a Data Controller is carried out by completing a notification available in Client Portal and sending it to the Commissioner of Data Protection at the DIFC.

The Data Controller must notify the Commissioner of Data Protection when it is:

Processing Sensitive Personal Data; and/or transferring Personal Data outside the DIFC to a jurisdiction that does not have adequate levels of data protection.

A Data Controller may obtain a permit by completing the applicable notification in Client Portal and sending it to the Commissioner of Data Protection at the DIFC. There is a separate permit application form for Processing Sensitive Personal Data and transferring Personal Data outside the DIFC.

The data protection legislation gives certain rights to Data Subjects concerning their Personal Data and Sensitive Personal Data. Generally, a Data Subject has the right to access any Personal Data that is kept about them.

If the Personal Data Processed by the Data Controller is inaccurate, then the Data Subject can request the Data Controller to take action to rectify, block or destroy the inaccurate data. However, there are certain circumstances, or exemptions, where it is legal for a Data Controller not to have to notify a Data Subject that Personal Data is being Processed. For example, where Personal Data is being released to a legitimate authority to comply with anti money laundering obligations.

A Data Subject can object on reasonable grounds to the Processing of their Personal Data, and request their Personal Data not be disclosed to third parties. This may include circumstances where an individual requests a Data Controller to cease Processing Personal Data for the purposes of direct marketing. If the Data Controller objects to the request, the Data Subject may file a complaint with the Commissioner of Data Protection at DIFC who may refer the matter to mediation.

Any person who processes Personal Data on behalf of a Data Controller.

Personal Data is any information relating to an identified natural person or Identifiable Natural Person. For example, Personal Data may include an individual’s name, age, home address, race, sexual orientation, income, blood type, marital status, education, and employment information.

A Data Subject is the individual to whom the Personal Data relates. For example, where an organisation holds Personal Data about its employees, the employees are Data Subjects.

A Data Controller is any person in the DIFC who determines the purposes for which, and the manner in which, any Personal Data is to be Processed.

The data protection legislation is intended to protect the confidentiality of Personal Data. It creates a legal and procedural framework which ensures that an individual’s Personal Data in the DIFC is treated fairly, lawfully and securely when it is stored, used or released.

Thedata protection legislation strikes a balance between a Data Subject’s right to control access to, and the use of, their Personal Data with a Data Controller’s need to collect and use Personal Data for legitimate purposes.

Whether information relates to a particular individual will be a question of fact in each case. If a connection can be made between the information and an individual, then the information is Personal Data. Personal Data can relate to more than one individual. For example, information concerning a joint bank account relates to both account holders and therefore is the Personal Data of each account holder and would be protected as such.

Yes, click here to view schedule of fees.

An application for a permit may be made to the DIFCA by a Data Controller if it is:

• Processing an individual’s Sensitive Personal Data under Article 10(2) of the Data Protection Law; or
• transferring an individual’s Personal Data outside the DIFC under Article 12(1)(a) of the Data Protection Law.

The Commissioner of Data Protection may in its absolute discretion refuse to grant applications for permits.

Yes, click here to view schedule of fees.

Dealing With The Data Subject

A Data Controller must securely keep any Personal Data it collects and process it fairly and lawfully. At or before the time Personal Data is collected from a Data Subject, a Data Controller should take reasonable steps to ensure that the Data Subject is aware of:

• the identity of the Data Controller and how to contact it;
• the fact that the Data Subject is able to gain access to their Personal Data;
• the purposes for which their Personal Data is collected;
• other persons to whom the Data Controller usually discloses data of that kind; and
• the main consequence for the Data Subject if all or part of the data is not

  provided.

If a Data Controller intends to Process the Personal Data collected from a Data Subject, it is suggested that when the Data Controller collects that Personal Data, the Data Controller obtain the Data Subject’s written consent to such Processing at the same time.

Initial Internal Procedures

The Data Controller should consider the following for all Personal Data:

• purpose for which it holds Personal Data;
• number of individuals identified in the Personal Data it holds;
• nature of the Personal Data;
• length of time it holds Personal Data;
• procedure for individuals identified by the Personal Data it holds to obtain access to their Personal Data; and
• the possible consequences for individuals identified by the Personal Data it holds as a result of the way it holds, erases or Processes Personal Data.

Ongoing Internal Procedure

The Data Controller should consider the following matters:

• is there a record of when the Personal Data it holds was recorded or last updated?
• are all those involved with the collection and Processing of Personal Data, including people to whom they are disclosed as well as employees of the Data Controller, aware that the Personal Data may not necessarily be up to date and accurate?
• are steps taken to update the Personal Data, for example, by checking back at intervals with the original source or with the Data Subject? If so, how effective are these steps?
• if the Personal Data is out of date is it likely to cause damage or distress to the Data

  Subject?

Transfers

Before Personal Data is transferred outside the DIFC the Data Controller should consider the following matters:

• does it need a permit?
• has the Commissioner of Data Protection at DIFC granted a permit to transfer the Personal Data?
• has the Data Subject unambiguously consented to the proposed transfer?
• is the transfer necessary for the performance of a contract between the Data Subject and the Data Controller?
• is the transfer necessary or legally required on grounds important in the interests of the DIFC, or for the establishment, exercise or defence of legal claims?
• is the transfer necessary in order to protect the vital interests of the Data Subject?
• is the transfer intended to provide information to the public which is open to consultation?
• is the transfer necessary to comply with any legal obligation?
• is the transfer necessary to uphold the legitimate interests of the Data Controller recognised in the international financial markets?
• is the transfer necessary to comply with auditing, accounting or anti-money laundering obligations that apply to a Data Controller?

Any person other than the Data Subject, the Data Controller, the Data Processor and the persons who, under the direct control of the Data Controller or the Data Processor, is authorised to process the Personal Data