United Arab EmiratesADGM Data Protection Regulations, comprehensive regime
ADGM Data Protection Regulations 2021 (consolidated February 2024)
In force since .
A comprehensive regime rule binding private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- An app that is a controller or processor established in or targeting the ADGM free zone must establish a lawful basis for processing personal data, and must obtain explicit consent or another qualifying condition before processing a faceprint, voiceprint, or other biometric identifier, including one derived from a photo, video, or audio recording.
These lines are LexLint's reading of the law's text. Also read by: Office of Data Protection, Abu Dhabi Global Market (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://assets.adgm.com/download/assets/ADGM+DPR+2021+Guidance+Part+1.pdf/b65534b2595411ef82c5a27efcbde115
- Guidance body
- Office of Data Protection, Abu Dhabi Global Market
- Open questions
- How far must a Processor comply with the Regulations when it is Processing Personal Data for a Controller outside of ADGM, given that section 3(2) requires compliance 'to the extent possible, taking into account whether the Controller is subject to similar obligations under the laws of its home jurisdiction'?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Log retention
Section 7(3)(b) has the controller keep, review and update the appropriate policy document from the day it starts processing in reliance on a condition that needs one until six months after it stops that processing, so six months is a minimum counted from the end of the processing. It applies to the policy document only; section 28 sets no period for the processing record.
- Unit
- Months
- As of
- Basis
- Fixed
- Minimum value
- 6
Logging duty
Section 28 makes each controller keep a record of its processing activities, and each processor a record of the processing it does for a controller, in writing or electronic form, and section 28(4) has them make it available to the Commissioner on request. Section 6(4) makes a controller relying on consent able to demonstrate that the data subject consented. Section 7(3) requires an appropriate policy document, which the controller must keep, review and make available to the Commissioner on request, for the sensitive-data conditions that depend on one. The register's items are not log content values, so only the consent state is coded. The records section sets no period; the six-month tail in section 7(3)(b) belongs to the policy document and is coded as the retention.
- Kind
- Explicit
- As of
- Provision
- Section 28 (record of processing activities), with section 6(4) (demonstrating consent) and section 7(3) (appropriate policy document)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
The ADGM Data Protection Regulations are the equivalent statute of the Abu Dhabi Global Market free zone (Abu Dhabi's Al Maryah and Al Reem Island financial free zone), enforced by ADGM's own Commissioner of Data Protection under ADGM's separate court system, and apply only within that free-zone footprint, not to a UAE business operating outside it. The text relied on here is the consolidated version as amended through February 2024.
The exact original 2021 commencement date is not confirmed against primary text, so rests on the corpus's own record rather than on primary confirmation. Section 1's Biometric Data definition names facial images and dactyloscopic data as worked examples, with the same adequacy-plus-alternative-safeguards cross-border transfer structure as the federal PDPL and DIFC Law. No source-based exclusion for a recording-derived biometric identifier was found.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .