Processes personal data, in the United Arab Emirates

DIFC Law No. 5 of 2020 · Read the law's page

• An app whose Controller or Processor is incorporated in the DIFC, or that Processes Personal Data in the DIFC as part of stable arrangements, must have a lawful basis under Article 10 for Processing Personal Data, and must obtain the Data Subject's explicit consent or satisfy another condition in Article 11 before Processing a faceprint, voiceprint, or other biometric identifier used to uniquely identify a natural person, including one derived from a photo, video, or audio recording.

ADGM Data Protection Regulations 2021 (consolidated February 2024) · Read the law's page

• An app that is a controller or processor established in or targeting the ADGM free zone must establish a lawful basis for processing personal data, and must obtain explicit consent or another qualifying condition before processing a faceprint, voiceprint, or other biometric identifier, including one derived from a photo, video, or audio recording.

ADGM Data Protection Regulations 2021, personal data breach notification provisions · Read the law's page

• An app that is a Controller established in or targeting the ADGM free zone and that suffers a personal data breach must notify the Commissioner of Data Protection without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights of natural persons.
• An app that is a Processor established in or targeting the ADGM free zone must notify the Controller without undue delay after becoming aware of a personal data breach.

Federal Decree-Law No. 45 of 2021, Art. 9 · Read the law's page

• An app that is a Controller and suffers a breach of the personal data of an individual in the onshore UAE that would prejudice the privacy, confidentiality and security of that data must notify the Bureau at the time it becomes aware of the breach; the Decree-Law defers the specific notification window to Executive Regulations whose text could not be confirmed at primary source, so an app should not assume a specific hour count without checking current regulator guidance.

Federal Decree-Law No. 45 of 2021, Arts. 1, 4 · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in the onshore UAE must establish a lawful basis under PDPL Art. 4, ordinarily consent, and must obtain the Data Subject's explicit consent before processing a faceprint, voiceprint, or other identity-linked biometric identifier, including one derived from a photo, video, or audio recording, since biometric data is a category of Sensitive Personal Data.

Federal Decree-Law No. 45 of 2021, Arts. 22-23 · Read the law's page

• An app transferring the personal data of an individual in the onshore UAE to a recipient outside the UAE must rely on a Bureau adequacy determination for the destination, or on a PDPL-equivalent contractual safeguard, or on the Data Subject's explicit consent where the transfer does not contradict UAE public or security interest.

Federal Decree-Law No. 45 of 2021, Arts. 25-26 · Read the law's page

• An app processing the personal data of an individual in the onshore UAE must be prepared to answer to the Bureau's supervisory powers; administrative penalty amounts are set by a separate Council of Ministers decision rather than the Decree-Law itself.