The Dubai International Financial Centre Authority, in exercise of its powers under Article 27 of the Data Protection Law 2007, being DIFC Law No. 1 of 2007 issued by the Ruler, and of all other powers enabling it in that behalf, hereby makes the following Regulations:
1. Introduction
1.1. These Regulations may be cited as the “Data Protection Regulations“.
1.2. Application and interpretation
1.2.1. These Regulations apply to any Person to whom the Law applies.
1.2.2. In these Regulations a reference to the Law is a reference to the Data Protection Law.
1.2.3. Defined terms are identified throughout these Regulations by the capitalisation of the initial letter of a word or phrase. Where capitalisation of the initial letter is not used, an expression has its natural meaning.
1.2.4. Where reference is made in the Regulations to a statutory provision, it is a reference to the provision as amended, and includes a reference to that provision as extended or applied by or under any other provision, unless the contrary intention appears.
1.2.5. Unless the contrary intention appears:
(a) words in the Regulations importing the masculine gender include the feminine and words importing the feminine gender include the masculine;
(b) words in the Regulations in the singular include the plural and words in the plural include the singular; and
(c) references to Chapters, Sections and Schedules are to Chapters, Sections and Schedules of these Regulations.
1.2.6. All other defined terms have the same meaning they have under the Law.
1.3. References to writing
1.3.1. If a provision in these Regulations refers to a communication, notice, agreement of other document ‘in writing’ then, unless the contrary intention appears, it means in legible form and capable of being reproduced on paper, irrespective of the medium used. Expressions related to writing must be interpreted accordingly.
1.3.2. This does not affect any other legal requirements which may apply in relation to the form or manner of executing a document or agreement.
2. Permit for Processing Sensitive Personal Data
2.1. Application for permit
2.1.1. A Data Controller which seeks a permit from the Commissioner of Data Protection to Process Sensitive Personal Data pursuant to Article 10 (2) of the Law must apply in writing to the Commissioner of Data Protection setting out:
(a) the name of the Data Controller;
(b) the address of the Data Controller;
(c) the name, address, telephone number and e-mail address of the Person within the Data Controller responsible for making the application for the permit;
(d) a description of the Processing of Sensitive Personal Data for which the permit is being sought, including a description of the nature of the Sensitive Personal Data involved;
(e) the purpose of the Processing of the Sensitive Personal Data;
(f) the identity of the Data Subjects to whom the relevant Sensitive Personal Data relates, or in the event of classes of Data Subjects being affected, a description of the class of Data Subjects;
(g) the identity of any Person to whom the Data Controller intends disclosing the Sensitive Personal Data;
(h) to which jurisdictions, if known, such Sensitive Personal Data must be transferred outside of the DIFC; and
(i) a description of the safeguards put into place by the Data Controller, to ensure the security of the Sensitive Personal Data.
2.1.2. The Data Controller must provide the Commissioner of Data Protection with such further information as may be required by the Commissioner of Data Protection in order to determine whether to grant a permit in accordance with Article 10(2) of the Law.
3. Rejection of an application for a permit
3.1. The Commissioner of Data Protection may in its absolute discretion refuse to grant an application for a permit to Process Sensitive Personal Data.
3.2. Upon refusing to grant a permit, the Commissioner of Data Protection will without undue delay inform the Data Controller in writing of such refusal and provide the reasons for such refusal.
4. Granting a permit to process sensitive personal data
4.1. The Commissioner of Data Protection may grant an application for a permit to process Sensitive Personal Data with or without conditions it considers necessary.
4.2. Upon deciding to grant a permit, the Commissioner of Data Protection will without undue delay inform the Data Controller of such decision and any conditions.
5. Permit for Transfer out of the DIFC of Personal Data
5.1. Application for permit
5.1.1. A Data Controller who seeks a permit from the Commissioner of Data Protection pursuant to Article 12(1)(a) of the Law for transferring Personal Data to a Recipient which is not subject to laws and Regulations which ensure an adequate level of protection, must apply in writing to the Commissioner of Data Protection setting out:
(a) the name of the Data Controller;
(b) the address of the Data Controller;
(c) the name, address, telephone number, fax number and e-mail address of the Person within the Data Controller responsible for making the application for the permit;
(d) a description of the proposed transfer of Personal Data for which the permit is being sought, including a description of the nature of the Personal Data involved;
(e) the purpose of the proposed transfer of Personal Data;
(f) the identity of the Data Subjects to whom the relevant Personal Data relates, or in the event of classes of Data Subjects being affected, a description of the class of Data Subjects;
(g) the identity of the proposed Recipient of the Personal Data;
(h) the jurisdiction of the proposed Recipient and a description of the laws and Regulations which apply to the proposed Recipient in respect of Personal Data protection; and
(i) a description of the safeguards put into place by the Data Controller, to ensure the security of the Personal Data should the relevant transfer take place.
5.1.2. The Data Controller must provide the Commissioner of Data Protection with such further information as is required by the Commissioner of Data Protection in writing in order to determine whether to grant a permit in accordance with Article 12(1)(a) of the Law.
5.2. Rejection of an application for a permit
5.2.1. The Commissioner of Data Protection may in his absolute discretion refuse to grant an application for a permit to transfer Personal Data.
5.2.2. Upon refusing to grant a permit, the Commissioner of Data Protection will without undue delay inform the Data Controller in writing of such refusal and provide the reasons for such refusal.
5.3. Granting a permit to transfer personal data
5.3.1. The Commissioner of Data Protection may grant an application for a permit to transfer Personal Data with or without conditions it considers necessary.
5.3.2. Upon deciding to grant a permit, the Commissioner of Data Protection will without undue delay inform the Data Controller of such decision and any conditions.
6. Records and Notification
6.1. Records
6.1.1. For the purposes of Article 19(3)(a) of the Law, a Data Controller must record the following information in relation to its Personal Data Processing operations:
(a) description of the Personal Data Processing being carried out;
(b) an explanation of the purpose for the Personal Data Processing;
(c) the Data Subjects or class of Data Subjects whose Personal Data is being processed;
(d) a description of the class of Personal Data being processed; and
(e) a list of the jurisdictions to which Personal Data may be transferred by the Data Controller, along with an indication as to whether the particular jurisdiction has been assessed as having adequate levels of protection for the purposes of Articles 11 and 12 of the Law.
6.2. Guidance
6.2.1. With respect to Regulation 6.1.1(b) the purposes for which Personal Data may be processed will vary but will usually include one or more of the following:
(a) accounting and auditing;
(b) administration of justice;
(c) administration of membership records;
(d) advertising, marketing and public relations for the Data Controller itself;
(e) advertising, marketing and public relations for others;
(f) benefits, grants and loans administration;
(g) consultancy and advisory services;
(h) credit referencing;
(i) debt administration and factoring;
(j) education;
(k) information and data bank administration;
(l) insurance administration;
(m) legal services;
(n) licensing and registration;
(o) pastoral care;
(p) pensions administration;
(q) policing;
(r) private investigation;
(s) property management;
(t) provision of financial services;
(u) research; and
(v) staff administration.
6.2.2. With respect to Regulation 6.1.1(c), where Personal data of multiple Data Subjects is being processed, Data Controllers may instead of listing individual Data Subjects, record the class of Data Subject involved. In such a case, Data Controllers may use the following, or other similar, classes:
(a) staff, including agents, temporary and casual workers;
(b) clients and customers;
(c) suppliers;
(d) members;
(e) complainants, correspondents and enquirers;
(f) relatives and associates of the Data Subject; and
(g) advisors, consultants and other professional experts.
6.3. Notifications
6.3.1. For the purposes of Article 19(3)(b) of the Law, a Data Controller must notify the Commissioner of Data Protection of the following Personal Data Processing operations or set of such operations:
(a) any Personal Data Processing operation or set of operations involving the Processing of Sensitive Personal Data; and
(b) any Personal Data Processing operation or set of operations involving the transfer of Personal Data to a Recipient outside of the DIFC which is not subject to laws and Regulations which ensure an adequate level of protection.
6.3.2. When a Data Controller gives a notification to the Commissioner of Data Protection in accordance with Regulation 6.3.1, the notification must contain the following information:
(a) a general description of the Personal Data Processing being carried out;
(b) an explanation of the purpose for the Personal Data Processing;
(c) the Data Subjects or class of Data Subjects whose Personal Data is being processed;
(d) a description of the class of Personal Data being processed; and
(e) a statement of which jurisdictions to which Personal Data will be transferred by the Data Controller, along with an indication as to whether the particular jurisdiction has been assessed as having adequate level of protection for the purposes of Articles 11 and 12 of the Law.
6.3.3. The notification required by Regulation 6.3.1 must be provided to the Commissioner of Data Protection:
(a) immediately upon commencing of the Personal Data Processing referred to in Regulation 6.3.1;
(b) on every anniversary of the initial notification where the Personal Data Processing is to continue in the subsequent year; and
(c) immediately upon any Personal Data Processing being processed in a manner different to that described in the initial notification.
7. Mediation
7.1. Process of mediation
7.1.1. For the purposes of Article 33(1) of the Law, a Person may file a claim with the Commissioner of Data Protection by lodging a written notice providing the following information:
(a) full name and address of the Person making the claim;
(b) the Data Controller whom the Person believes has contravened the Law;
(c) a detailed statement of facts which the Person believes gives rise to contravention of the Law; and
(d) the relief sought by the Person making the claim.
7.1.2. Upon receiving a claim lodged under Article 33(1) of the Law, the Commissioner of Data Protection may follow such practices and procedures in the mediation of the claim that will, in the view of the Commissioner of Data Protection, lead to the most timely, fair and effective resolution of the claim.
7.1.3. At the conclusion of the mediation process, should the Commissioner of Data Protection determine to issue a direction requiring a Data Controller to do any act or thing in accordance with Article 33(3) of the Law, the Commissioner of Data Protection will do so by issuing a notice in writing setting out:
(a) the act or thing that the Data Controller is required to do; and
(b) the time within which, or before which, the Data Controller is required to do that act or thing.
