Navigating UAE Personal Data Protection Law With Kiteworks

This guide outlines the UAE Federal Decree by Law No. (45) of 2021 concerning the protection of personal data, which establishes a comprehensive legal framework for the collection, processing, storage, and transfer of personal data within the United Arab Emirates. The regulation aims to safeguard the privacy and confidentiality of personal data while enabling lawful processing activities. It applies to any Controller or Processor handling personal data of Data Subjects in the UAE, regardless of their location. The document details the distinct obligations of Controllers and Processors, including the requirement for Data Protection Impact Assessments and the appointment of a Data Protection Officer in certain circumstances. It also describes the rights of Data Subjects, including access, correction, and erasure of their personal data, and outlines the conditions for cross-border data transfers. The guide emphasizes the importance of compliance with the law and the role of the UAE Data Bureau in enforcement and oversight.