WEBVTT
00:00:23.199 --> 00:00:29.039
Hello, everyone, and welcome back to our podcast series exploring international privacy and data protection laws.
00:00:29.280 --> 00:00:38.719
Before we get into today's episode, I just want to briefly recap where we left off in part one of our two-part focus on the United Arab Emirates.
00:00:38.960 --> 00:00:52.240
Last time we concentrated on the UAE federal personal data protection law, and we spent a lot of time unpacking why the UAE's data protection landscape is unusually complex compared to many other jurisdictions.
00:00:52.399 --> 00:01:13.680
We looked at how the federal PDPL sits alongside sector-specific rules and how it differs from the GDPR in terms of lawful basis, enforcement maturity, and international transfers, and why executive regulations play such a central role in how the law is actually applied in practice.
00:01:13.920 --> 00:01:17.599
But the key theme we kept coming back to was this.
00:01:18.000 --> 00:01:27.680
In the UAE, the real compliance question isn't just what does the law say, it's which law applies to me.
00:01:28.000 --> 00:01:42.000
Because the federal DPL doesn't operate in isolation, it exists alongside separate legal regimes in free zones, and those regimes can impose very different obligations on organisations.
00:01:42.560 --> 00:01:45.359
And that brings us directly to today's episode.
00:01:45.519 --> 00:01:53.680
So I'm going to hand over to Katie now, who's going to introduce our focus for part two of this podcast episode.
00:01:54.239 --> 00:01:55.359
Thanks, Maria.
00:01:55.599 --> 00:02:01.040
Yeah, I'm just going to give an overview of where we're going to focus on today as opposed to last week.
00:02:01.280 --> 00:02:08.879
So this is part two of our UAE series, and we're going to turn our attention to the free trade zones.
00:02:09.280 --> 00:02:30.159
There's over 40 free trade zones in the country of the UAE, but we're going to choose two in particular for the purpose of this podcast: the Dubai International Financial Center, the DIFC, and the Abu Dhabi Global Market, which is the ADGM.
00:02:30.319 --> 00:02:45.120
They're both situated in the two of the most populous Emirates in the UAE, and they have a really big role to play in increasing foreign trade in commodities that aren't oil, basically.
00:02:45.280 --> 00:02:59.120
So that was the reason that we wanted to zone in on these, because these two zones have their own courts and commercial laws, and they also have their own data protection frameworks.
00:02:59.360 --> 00:03:10.479
And those frameworks are a lot more detailed and closer in structure to the GDPR than the federal PDPL, as we discussed last time.
00:03:11.520 --> 00:03:37.759
So in this episode, we're going to look mainly at how the DIFC and ADGM regimes work in practice, how they differ from the federal law, and how organizations can navigate the regulatory landscape, and how that can translate into governance procedures, international transfers, enforcement, and day-to-day compliance.
00:03:38.080 --> 00:03:44.879
So just like last week, we've got 12 questions and we're going to take them in turns as per usual.
00:03:45.360 --> 00:03:47.439
So I'll ask the first question, Katie.
00:03:47.680 --> 00:04:00.879
For our listeners who are new to the idea of the UAE free zones, can you explain what the DIFC and the ADGM actually are and why they have their own data protection laws?
00:04:02.319 --> 00:04:03.520
Thanks, Maria.
00:04:03.840 --> 00:04:14.879
So the DIFC and ADGM are what the UAE has created as their financial and commercial free zones.
00:04:26.079 --> 00:04:39.680
The DIFC, the Dubai International Financial Center, is an onshore financial center with the aim of fulfilling the financial needs of the region as it grows its economy.
00:04:40.240 --> 00:04:51.199
It also has the purpose of strengthening the links between the financial markets of Europe, the Americas, and Southeast Asia.
00:04:52.000 --> 00:05:09.199
Whereas the ADGM, the Abu Dhabi Global Market, is an international financial center located in the capital of the UAE, but its main focus is growing financial financial connection between the Middle East, Africa, and Asia.
00:05:09.519 --> 00:05:14.240
So they both kind of have a separate, I suppose, cultural purpose.
00:05:14.480 --> 00:05:23.680
The DIFC is more, you know, the Western world and Southeast Asia, and then the ADGM is for the Middle East, Africa, and the rest of Asia.
00:05:23.920 --> 00:05:31.120
So they both have their own courts, they have their own commercial laws, and they also have their own regulators.
00:05:31.360 --> 00:05:36.800
So when it comes to data protection, it's a logical extension of that model.
00:05:37.279 --> 00:05:50.720
If you're trying to attract international banks, asset managers, cloud providers, and multinationals, you're gonna need a regulatory framework that is similar to what they've already complied to.
00:05:50.879 --> 00:06:02.879
So that's the idea behind why they have their own separate systems and why their data protection regimes are far more prescriptive than the PDPL.
00:06:03.439 --> 00:06:08.480
Yeah, I hope that gives a good background to why they're very clear.
00:06:08.560 --> 00:06:09.120
Yeah, sorry.
00:06:10.480 --> 00:06:20.319
I'll I'll go to your question now, Maria, which is why were these free zone data protection regimes created in the first place?
00:06:20.560 --> 00:06:24.399
And what problem are they trying to solve?
00:06:24.959 --> 00:06:28.399
So I think you kind of covered that as well, Katie, in the first question.
00:06:28.959 --> 00:06:34.480
The short answer is really international credibility and legal certainty, I think.
00:06:35.040 --> 00:06:49.680
The federal PDPL that we looked at last week was designed as kind of a national baseline framework, and it's clearly influenced by the GDPR, but it's relatively high level and very consent focused.
00:06:50.000 --> 00:06:58.000
Um, and it's heavily dependent on executive regulations to flesh it out, like we saw in the first podcast that we did.
00:06:58.639 --> 00:07:17.279
So it's perfect for like a domestic legal system, but for international financial services, like you described, and for digital businesses, uh, that kind of uncertainty and you know the need to flesh it out more in the future uh could become a real problem, a real commercial problem.
00:07:17.839 --> 00:07:30.319
So I think that's why the DIFC and the AGGM kind of went with more of an international uh approach to data protection.
00:07:30.959 --> 00:07:41.519
They wanted to mirror international standards, so they went with something very similar to the GDPR because the GDPR is often seen as the gold standard for data protection globally.
00:07:42.160 --> 00:07:57.279
Um, and they wanted to give businesses a very clear, operationally detailed rule book that you know is similar to you know what the what organizations would be used to by doing business in Europe.
00:07:58.000 --> 00:08:05.600
And they wanted to provide strong independent regulatory oversight through specialist free zone authorities.
00:08:05.759 --> 00:08:18.240
So, like you said, the the the DIFC and the ADGM have their own data protection authorities, um, so that gives certainty to international organizations as well, you know.
00:08:18.399 --> 00:08:34.240
So I think they essentially were created to kind of remove any kind of friction um that may exist uh between you know cross-border transfers and so on.
00:08:34.559 --> 00:08:51.600
By having regimes that are very similar to the GDPR, companies that are already working with Europe or who are based in Europe would have very little problems um transferring or or setting up in these free zones.
00:08:51.759 --> 00:09:00.879
So the transfer of personal data would be much easier for them because uh each of these free zones have adequacy with a DPR.
00:09:01.200 --> 00:09:06.159
So it's just basically streamlining um international business, I think.
00:09:07.840 --> 00:09:08.480
For sure.
00:09:09.200 --> 00:09:26.720
So then moving on to question three, um, and just to be crystal clear, Katie, does the federal PDPL um apply ever in these DIFC, in the DIFC and the ABGM?
00:09:26.960 --> 00:09:33.200
Or are these zones completely and utterly carved out in terms of their data protection frameworks?
00:09:34.799 --> 00:09:51.919
Um so the PDPL does not apply to companies and establishments located in the free zones as far as they have their own legislation governing personal data protection.
00:09:52.000 --> 00:10:11.840
So that was another reason, I suppose, that we chose to explore the DIFC and the ADGM because the scope of the PDPL says that it applies, except in the case that a free zone has its own data protection regime.
00:10:12.240 --> 00:10:17.840
So for the purposes of where we're exploring today, they they have their own regulations.
00:10:18.000 --> 00:10:20.000
The PDPL does not apply.
00:10:20.399 --> 00:10:32.960
And we've also chosen zones that happen to operate in the financial services sector, so they tend to have their own specific laws governing financial services as well.
00:10:33.279 --> 00:10:43.200
So yeah, the the PDPL does not apply to organizations within these two zones that we're talking about today.
00:10:43.600 --> 00:10:43.919
Okay.
00:10:44.480 --> 00:10:56.399
You mentioned other regulations that will probably um have some sort of uh impact on uh compliance and you know governance in general.
00:10:58.240 --> 00:11:12.000
Yeah, um like they have within the UAE, they tend to be like I think we touched on it last week too, that certain sectors also have their own specific laws governing it.
00:11:12.320 --> 00:11:20.240
So it's not just the zones to look out for, it's also what sector you're in.
00:11:20.879 --> 00:11:23.840
I think was more relevant to our discussion last week.
00:11:24.159 --> 00:11:30.960
That's another thing to consider what if you're you know, if you're if you're doing business with these two free zones, okay.
00:11:31.679 --> 00:11:52.639
Um yeah, I think that kind of frames our next question, which is for you, Maria, which is in practice, how will an organization figure out which law is going to apply to them and what happens when they have operations across multiple zones?
00:11:53.919 --> 00:11:54.799
Thanks, Katie.
00:11:55.039 --> 00:12:10.639
Well, I've looked at this question, I've looked at this issue quite a lot, um, and I've been back and forth about it, but I think if you approach it like from a three-step uh approach, I think is the most transparent way that we can kind of look at it.
00:12:10.799 --> 00:12:17.679
So the first thing you need to do is you need to understand where you are licensed to do business.
00:12:17.840 --> 00:12:20.159
So, where did you set up your organization?
00:12:20.559 --> 00:12:27.519
If you've set it up in the DIFC, then your main jurisdiction would be the DIFC.
00:12:27.679 --> 00:12:32.639
If you set it up in the ADGM, then the ADGM data protection law would apply.
00:12:32.879 --> 00:12:39.759
And you know, so that the federal PDPL law would step aside in that in that scenario.
00:12:40.559 --> 00:13:07.600
But then if you if it gets if you're thinking about a second jurisdiction, so if you're set up in one of the free zones, but you're kind of recruiting um staff from will say the federal from the jurisdiction where the federal PDP applies, um, like onshore in Dubai or Abu Dhabi, then you've you've created what we would call a federal nexus.
00:13:08.000 --> 00:13:13.200
So you'll likely need to follow like the stricter of the two laws.
00:13:13.679 --> 00:13:28.639
So the second jurisdiction in that case would be the federal PDPL, but the main jurisdiction would be like the more complex and the stricter law, so you'd apply that law.
00:13:28.799 --> 00:13:43.840
Um, but of course, you would have to be um observant as well of the PDPL, but you would always take the higher or more stricter uh law into account when you're when you're considering compliance.
00:13:44.240 --> 00:13:51.679
And then the third one we just touched on um in your previous question, Katie, is regardless of the zone that you're in.
00:13:51.759 --> 00:14:06.399
So, regardless of whether you're in the jurisdiction of the PDP, the federal PDPL or the DIFC or the ADGM, there are certain the sector of where you're working in is important.
00:14:06.799 --> 00:14:19.360
So let's say if you were processing health data in one of these regions, one of these free zones, then the 2019 health data law would take precedence over the data protection law.
00:14:19.600 --> 00:14:28.000
But that's another thing you need to consider when trying to decide regulatory obligations in terms of compliance.
00:14:28.399 --> 00:14:46.720
But another thing that we're seeing, a trend that we're starting to see now, is instead of like building separate uh data protection programs or separate frameworks, uh, organizations are starting to look at the highest standard framework and go from there.
00:14:46.799 --> 00:15:04.159
Um and in this case, it would be the DIFC framework, and then you would just add a kind of a federal addendum to handle specific local notifications when you're processing data in the federal PDPL jurisdiction.
00:15:05.039 --> 00:15:06.240
I hope that's clear.
00:15:07.679 --> 00:15:17.679
Yeah, I think that is the best the best approach just to satisfy the move the most strict regime first.
00:15:18.639 --> 00:15:34.720
Yeah, and then you know take note of the extra requirements that you need to put in place for the lesser uh of the jurisdictions, the less strict um jurisdiction, and in this case it would be the federal PDPL.
00:15:36.639 --> 00:15:40.720
Okay, so moving on to question five, then Katie.
00:15:41.440 --> 00:15:55.120
For a GDPR compliant organization that are that's listening to this podcast, what parts of these free zone uh regulations would feel familiar straight away?
00:15:55.360 --> 00:16:00.159
And what are the parts that might they need to consider and that might catch them out?
00:16:00.399 --> 00:16:54.639
Um so I'd say the overall, I mean, in comparison to the federal PDPL anyway, the overall structure of these two laws is going to feel a lot more similar to GDPR, and I think that that's where the comfort might creep in because at the end of the day, there are those slight nuances, and I think one of the main differences with how these are going to apply in practice is that they're younger than the GDPR, so the regulators' expectations are going to be different, and I think we're going to talk about this a bit more later on, but they're gonna have they're gonna obviously take a different approach to the DPC or the ICO.
00:16:55.519 --> 00:17:26.079
So, I mean the DIFC is actually based a lot more on the UK GDPR rather than the EU GDPR, and they do rely on the ICO guidance, whereas the ADGM, I would say, even though their zone is aimed less so at Europe, but the actual regulation is more modelled on the EU GDPR than the UK GDPR.
00:17:26.640 --> 00:17:47.359
So little things like that I'd say look out for, and something that we keep talking about, which is how it interacts with the other laws applicable in whatever zone or whatever sector the organization is operating in.
00:17:48.000 --> 00:17:48.319
Okay.
00:17:49.839 --> 00:18:01.039
Um and another thing I'd like to just add as well is you know, you've got the the the same kind of controller processor model and the same six lawful bases as you have with the GDPR.
00:18:01.200 --> 00:18:06.799
Um but where people might get caught is the is like their enforcement style.
00:18:06.960 --> 00:18:16.559
So in the EU, regulators like the Irish DPC or the French Canil often start with massive turnover-based fines.
00:18:16.720 --> 00:18:21.119
Like you know, they're always coming in the news for breaches and so on.
00:18:21.200 --> 00:18:26.240
And the first thing that the authorities would do is impose a massive fine.
00:18:26.559 --> 00:18:32.640
Whereas in the ADGM and the DIFC, we're see we see more of a kind of a prescriptive approach.
00:18:32.799 --> 00:18:48.720
So they do fine, but the fines are don't seem to be a fraction of what they would be in Europe, and they focus more on kind of directions on how the organization could comply with the regulations in the future.
00:18:49.039 --> 00:18:54.160
So that's kind of something as well that's slightly different in these free zones.
00:18:55.119 --> 00:18:57.839
Yeah, I would I would agree.
00:18:58.000 --> 00:19:09.920
Yeah, I suppose it is it is the regulators who are interpreting, applying, and enforcing the regulation at the end of the day.
00:19:10.079 --> 00:19:17.839
I mean, if they use the same terms, but you kind of, you know, that's your best source to go off.
00:19:18.240 --> 00:19:19.119
Absolutely, yeah.
00:19:19.200 --> 00:19:29.119
And if you look at the previous cases, um, and we'll get into that in more detail in the next few questions, but they take it quite seriously, they take data protection quite seriously.
00:19:38.079 --> 00:19:42.640
I'll move on to question six now for yourself, Maria.
00:19:43.759 --> 00:19:54.480
So, do the DIFC and ADGM take a more GDPR-like approach to lawful basis compared to the PDPL?
00:19:55.200 --> 00:19:58.960
And what is that going to mean for day-to-day compliance?
00:19:59.519 --> 00:20:19.039
Well, I would definitely say that those two free zones, the DIFC and the ADGM, are very much more of a GDPR type approach in terms of lawful basis, because they they both have the same six lawful bases as the GDPR.
00:20:19.200 --> 00:20:43.359
And this is a great kind of boost for international companies because it means that if the if the companies have been working in Europe before that and they have a kind of a data protection framework already in place, then it's going to be very easy for them to set up their data protection frameworks in these two free zones as well, with just minimal adjustments.
00:20:43.440 --> 00:20:51.839
You know, they should be able to uh kind of port that framework, uh, that legal basis framework from Europe into these three zones.
00:20:52.079 --> 00:20:54.880
And that's like massive for organizations.
00:20:55.279 --> 00:21:02.960
Um, and and you know, it can be quite costly if they're if they don't have the same kind of compliance or governance structure.
00:21:03.200 --> 00:21:21.839
And as well, we see that like the the the federal PDPL in terms of lawful basis is very kind of consent focused, whereas these free zones they have the familiar lawful basis, the six um lawful basis that we are used to with the GDPR in Article Six.
00:21:22.480 --> 00:21:33.599
Um, so in practice, uh GDPR compliant organizations can often just reuse their lawful basis framework um wholesale when they're setting up in these free zones.
00:21:33.759 --> 00:21:43.039
If you're processing data to provide a service to a client, you can use the lawful basis of contract uh like you can with the GDPR.
00:21:43.279 --> 00:21:49.519
And if you're doing something like internal broad monitoring, then you can actually use legitimate interests.
00:21:49.680 --> 00:21:59.599
Um, and as well, it's it's it's so similar to the GDPR in that they would expect you to carry out a legit legitimate interest assessment as well and have that available for.
00:22:00.240 --> 00:22:01.200
An audit.
00:22:01.519 --> 00:22:04.720
So you know it's very, very similar to the GDPR.
00:22:04.960 --> 00:22:26.799
And I think as well, another benefit of this is that when you have um kind of a high-level uh framework like the federal PDPL, organizations have to go back and get consent all the time from their customers, which can create kind of what they call consent fatigue.
00:22:26.880 --> 00:22:31.279
And people just get bored and they get tired of having to give consent the whole time.
00:22:31.519 --> 00:22:40.799
So you avoid that when you have a more complex framework like that's that that's in the free zones of DIFC and the ATGM.
00:22:41.519 --> 00:22:47.920
As well, another thing is that it's they're quite similar when it comes to special category data.
00:22:48.160 --> 00:22:58.000
So in the GDPR, we have Article 6 and then we have Article 9 as well, and we have to find a lawful basis for those two articles.
00:22:59.039 --> 00:23:12.720
So in the DIFC, you have similar a similar approach that you have to not only have a lawful basis to process uh special category data, but you also have to have an additional condition.
00:23:12.880 --> 00:23:29.200
And the conditions would be either explicit consent, employment or social protection reasons, vital interests, non-profit or membership bodies, and uh or data that's been made public by the data subject, and so on.
00:23:29.279 --> 00:23:33.839
So there's so that it's similar in approach to the GDPR as well.
00:23:33.920 --> 00:23:42.000
So you'd have to have two conditions in order to be able to process uh special category data, and it's similar in the ADGM as well.
00:23:42.319 --> 00:23:53.839
So you have to have the first one of you have to meet one of the six lawful bases, you have to meet a condition, a secondary condition to be able to process uh special category data.
00:23:54.000 --> 00:24:01.920
So it's similar to the to the GDPR in terms of um processing you know uh special category data as well.
00:24:02.319 --> 00:24:06.000
Moving on then, uh Katie, to question seven.
00:24:06.480 --> 00:24:13.599
What are the key governance and accountability requirements under the DIFC and the ADGM?
00:24:14.160 --> 00:24:15.680
Thanks, Maria.
00:24:16.079 --> 00:24:21.119
They are quite similar to GDPR accountability.
00:24:21.519 --> 00:24:34.480
I mean, for the ADGM, they need to implement the appropriate technical and organizational measures to demonstrate that the processing is performed in compliance with their law.
00:24:34.720 --> 00:24:46.799
They need to review and update those measures where necessary, so they're going to need to, you know, keep up with technological developments and um regulatory developments.
00:24:47.119 --> 00:24:53.200
They have a requirement for data protection by design and by default, which we're familiar with.
00:24:53.359 --> 00:25:03.759
They have to pay a data protection uh fee to the Commissioner of Data Protection, which is, if I understand, that's in practice in the UK.
00:25:04.319 --> 00:25:35.039
They also have their controller processor obligations, and their data subjects' rights obligations and everything, but I suppose those are the ones that stick out to me, especially a whole article for data protection by default and design, which I quite like because you I don't know, we haven't seen that in every law so far, even if it's you know an underlying principle or a nice to have, but this is you know a must-have for the ADGM.
00:25:36.000 --> 00:25:42.559
For the DIFC, they have accountability and notification requirements.
00:25:42.880 --> 00:25:50.400
You need to have your ROPA, you need to have your record of processing activities, all the same information, really.
00:25:50.720 --> 00:26:04.160
You can have it's not a requirement, but they do make a provision for having uh a DPO, and they have to be run through a DF DIFC body other than the court, so they kind of have to be vetted.
00:26:04.400 --> 00:26:10.640
A few of a few of the Gulf regions have that, have uh requirements like that for their DPO, actually.
00:26:11.119 --> 00:26:15.839
They've got to do their DPIAs again with the ADGM.
00:26:15.920 --> 00:26:17.119
We've seen that also.
00:26:17.680 --> 00:26:26.400
Yeah, they need to get in contact with the with the commissioner, where assessments are gonna be are gonna pose a high risk.
00:26:26.640 --> 00:26:28.480
So, I mean, we have that as well.
00:26:28.640 --> 00:26:31.279
Like it's it's it's very it's very similar.
00:26:31.599 --> 00:26:38.400
The main difference again is what their independent regulators are gonna be looking out for.
00:26:38.720 --> 00:26:44.799
Because they have they have the joint controllers, they have the processors, and so like they have nearly everything.
00:26:44.960 --> 00:26:52.079
I suppose it's just whatever the regulator, you know, whatever their decision development is gonna be.
00:26:52.240 --> 00:26:54.799
That yeah, it's gonna be their stickler points.
00:26:55.039 --> 00:26:55.359
Yeah.
00:26:55.599 --> 00:27:07.599
So it's gonna it's probably going to be different, like you say, because we've seen this in other in previous uh podcasts where um the culture kind of comes into the data protection regulations.
00:27:08.160 --> 00:27:26.640
So the interpretation of the regulations may be different based on you know the commissioner's interpretation um, you know, in terms of what's appropriate in their specific country, which you know will probably be different to Europe based on differences in the country.
00:27:26.880 --> 00:27:34.240
So move on to question eight here, which is about the data subjects' rights.
00:27:34.480 --> 00:27:43.359
So would you say the data subjects' rights are stronger or more operationalized in the free zones compared to the federal law?
00:27:43.519 --> 00:27:49.519
And I suppose also compared to what we're more comfortable with, the GDPR?
00:27:50.400 --> 00:27:52.240
Well, I would say definitely.
00:27:52.559 --> 00:27:58.960
They're broader, they're more detailed, and as a result of that, then they're more enforceable.
00:27:59.119 --> 00:28:08.240
They are significantly more operationalized in the federal law because the DIFC and the ADGM regulators are more mature.
00:28:08.559 --> 00:28:14.319
The organizations actually do see access requests, erasure requests, and complaints.
00:28:14.640 --> 00:28:23.440
A good example of this is in the 2024 ADGM ruling against OKDOC technologies.
00:28:23.839 --> 00:28:32.799
Uh they were issued a variable penalty notice specifically for failing to properly handle a data subject access request.
00:28:33.039 --> 00:28:50.799
So in the EU, a DSAR failure might be part of a larger investigation, but this case showed that in the ADGM, uh we see the commissioner issue specific penalties for procedural failure in rights handling.
00:28:51.200 --> 00:28:58.000
The if you read the case, you'll see that the individual rights isn't just a checkbox.
00:28:58.079 --> 00:29:12.319
They kind of made sure that even though at the end of the case, the data subject, she she kind of settled an employment issue she had with the organization, so she was happy not to receive her data.
00:29:12.799 --> 00:29:27.599
But the the you know, Ocadoc technologies were fined anyway because the ADGM regulator investigated whether they had procedures in place to be able to carry out these, and they didn't.
00:29:27.759 --> 00:29:31.920
And as a result of that failure, they were you know they were fined.
00:29:32.400 --> 00:29:34.240
So that's an interesting case.
00:29:34.480 --> 00:29:47.759
So we're seeing that the ADGM takes these uh data subject rights quite seriously, and fines and directions on how to become compliant can come from these complaints.
00:29:49.599 --> 00:29:56.799
Question nine, Katie, is how do the DAFC and the ADGM handle international transfers then?
00:29:58.319 --> 00:30:05.759
Um again, they're similar but different to uh the DG the GDPR.
00:30:06.079 --> 00:30:08.720
So I'll start with the ADGM.
00:30:09.359 --> 00:30:28.000
The commissioner of data protection within the ADGM is gonna have to have made the decision that whatever jurisdiction they're sending the data to, or international organization uh has an adequate level of protection.
00:30:28.160 --> 00:30:33.920
So again, the adequacy that's the adequacy decisions we're familiar with.
00:30:34.160 --> 00:30:57.359
Things they're going to take into consideration when deciding on adequacy decisions is rule of law, respect for rights, and the relevant legislation, including uh general legislation and specific sectoral uh legislation, data protection rules, and how enforceable the data subjects' rights are.
00:30:57.920 --> 00:30:59.599
A few other things there too.
00:30:59.839 --> 00:31:01.519
That's the main ones.
00:31:01.759 --> 00:31:11.839
Another thing they take into consideration is international commitments uh that the jurisdiction has entered into, so conventions and things like that.
00:31:12.079 --> 00:31:16.640
So I suppose you know, a council of Europe country, like that might be.
00:31:16.960 --> 00:31:17.680
That's interesting.
00:31:18.319 --> 00:31:18.960
Yeah.
00:31:19.519 --> 00:31:38.960
So yeah, they'll have a list of their adequacy decisions, and then otherwise they have appropriate safeguards where there's no adequacy, and again, it's a legally binding contract, binding corporate rules, standard data protection clauses, and codes of conduct and certification.
00:31:39.119 --> 00:31:42.319
So that's the ADGM, it's very, very similar.
00:31:42.559 --> 00:31:48.799
The DIFC again operates on the basis of an adequate level of protection.
00:31:49.359 --> 00:31:53.680
Again, it considers the rule of law, respect for individuals' rights.
00:31:53.920 --> 00:32:02.799
They consider the access, how much access the public authority has to personal data, which is interesting.
00:32:03.039 --> 00:32:05.920
Yeah, it's an interesting one to note.
00:32:06.400 --> 00:32:20.160
The existence of effective data protection laws, whether they have a competent data protection authority, and again, they also consider international commitments and conventions that they've entered into.
00:32:20.880 --> 00:32:25.440
So the ADGM was give a lot more guidance there.
00:32:25.599 --> 00:32:30.480
The DIFC was more succinct, but uh a lot of it was the same.
00:32:31.440 --> 00:32:46.640
But in the absence of adequate protections, they again they need to rely on appropriate safeguards, which is legally binding instruments, binding corporate rules, standard data protection clauses, codes of conduct, and certifications.
00:32:46.880 --> 00:33:07.200
So unless, again, the derogations, such as like where it's necessary for public interest, for um the actions of public bodies where the data subject has manifestly made something public or has explicitly consented.
00:33:07.440 --> 00:33:14.799
I mean, they're they're basically mirroring the international transfer mechanisms of the GDPR, in my opinion.
00:33:15.200 --> 00:33:19.440
Okay, that's good, yeah, because it makes it easy for people or for organizations, yeah.
00:33:19.839 --> 00:33:26.480
Yeah, we'll go into yourself now, Maria, um, and we'll talk about breach notifications.
00:33:26.640 --> 00:33:33.279
So, what are the breach notification expectations in the DIFC and the ADGM?
00:33:34.240 --> 00:33:34.960
Thanks, Katie.
00:33:35.200 --> 00:33:39.519
So they're much clearer than what we saw with the federal PDPL last week.
00:33:39.759 --> 00:33:55.759
You have defined reporting obligations, you have regular expectations around timelines, sorry, you have regulator expectations around timelines, and you have much more established supervisory posture in both the DIFC and the AGGM.
00:33:56.000 --> 00:34:04.400
Breach notification is a high-stakes legal requirement, but the two zones use different schedules, we'll say, time schedules.
00:34:04.559 --> 00:34:16.400
While they both align with the GDPR's philosophy that the regulator must know about a breach before the public does, the specific expectations for when and how are quite distinct.
00:34:16.719 --> 00:34:21.039
You don't have to report every single breach.
00:34:21.199 --> 00:34:29.039
It's only you only have to report the breach when it meets a specific harm threshold.
00:34:29.199 --> 00:34:37.119
So for the ADGM, you report any breach unless it is unlikely to result in a risk to the rights of the individual.
00:34:37.280 --> 00:34:47.519
With the DIFC, the report you report the breach if it compromises a data subject's confidentiality, security, or privacy.
00:34:47.760 --> 00:35:01.440
So if a breach involves special category data like health data or biometrics, the regulators in both zones effectively assume that it's high risk by default, and they would expect immediate notification.
00:35:01.920 --> 00:35:12.400
So the DIFC will say when in terms of notifying the regulator, they kind of say you have to notify them as soon as is practicable.
00:35:12.639 --> 00:35:21.360
With the ADGM, the terminology is without undue delay and where feasible within 72 hours.
00:35:21.679 --> 00:35:33.840
Then, if you in terms of notifying the data subject, under the DIFC, it's as soon as practicable again, if there is a high risk to the security or the rights of the data subject.
00:35:34.000 --> 00:35:43.119
And then with the ADGM, again they use that terminology without undue delay, if there's high risk to the rights of the data subject.
00:35:58.079 --> 00:36:15.360
So again, we're we're seeing here very similar to the GDPR, with the DIFC, they don't mention the 72-hour um time schedule, but with the ADGM, they do actually say, if possible, try and get try and report the breach within the first 72 hours.
00:36:15.519 --> 00:36:17.760
So yeah, very similar again.
00:36:18.079 --> 00:36:22.079
So moving on to the pen ultimate question, Katie.
00:36:22.559 --> 00:36:30.239
Are the DIFC and the ADGM regulators more active than we'll say the you know the federal PDPL?
00:36:30.480 --> 00:36:31.679
Thank you, Maria.
00:36:31.920 --> 00:36:34.159
Um I I don't know.
00:36:34.800 --> 00:36:59.840
Well, I would say compared to the federal PDPL, it seems to be that they are a bit more active in the sense that they have a lot more guidance out there and they have a lot more kind of literature out there to help understand the application of the legislation and a lot more additional resources.
00:37:00.559 --> 00:37:04.719
Um and they are engaged for sure.
00:37:04.800 --> 00:37:17.760
Like I might piggyb on your previous question a little bit and talk about um a decision from the ADGM Office of Data Protection.
00:37:17.920 --> 00:37:22.480
Um that's their regulator, the Office of Data Protection.
00:37:22.639 --> 00:37:33.599
Um and I'll talk about this decision from June 2023 regarding a breach reporting incident, um, which you were talking about previously.
00:37:33.840 --> 00:37:38.639
So they had a security incident and they had to report the breach.
00:37:38.880 --> 00:38:03.280
Um but the breach reporting procedure was not adequately followed by the organization from the perspective of the Office of Data Protection because they didn't give enough detail on what they had in place to potentially prevent the breach and what they had introduced as mid to mitigate the risk.
00:38:03.599 --> 00:38:24.000
So the authority kind of perked up its ears and you know delved more into this organization, and they discovered through investigation of that incident that the organization did not have policies or procedures in place for handling security incidents or mitigating any consequences.
00:38:24.320 --> 00:38:29.760
The only technical security measure they had in place was a free antivirus tool.
00:38:30.320 --> 00:38:31.119
That's crazy.
00:38:32.400 --> 00:38:33.039
Yeah.
00:38:34.480 --> 00:38:49.039
They also lacked, they also got a bit of guff, I suppose, from the fact that the authority considered them to lack any proper training or awareness within their organization, which was a key factor that led to the breach.
00:38:49.280 --> 00:39:00.320
So they were found to be in contravention of section 29 of the regulation, which requires meaningful cooperation with the authority in the performance of its duties.
00:39:00.719 --> 00:39:19.360
So although, yes, they reported the breach, but the breach exposed the fact that they didn't have uh they basically weren't compliant with the regulation at all, and that stopped them from meaningfully engaging with the authority.
00:39:19.599 --> 00:39:24.159
So yeah, they they basically they didn't let that fly past them.
00:39:24.400 --> 00:39:26.880
So that's interesting, isn't it?
00:39:27.119 --> 00:39:42.000
So they find them for not actually meaningfully engaging, yeah, and they couldn't they couldn't because they didn't have the framework, the framework or the training and awareness in place to understand their obligations.
00:39:42.480 --> 00:39:55.440
So, you know, you can I suppose you know they might have thought they were doing well reporting the breach, but it kind of exposed other deficiencies within that organization.
00:39:55.840 --> 00:40:23.519
Yeah, um, and the the DIFC is active too, they have a lot a lot more information online, and they also rely on ICO guidance where they might have gaps, but in 2023 they gave out 173 administrative fines, and in 2024 they give 64.
00:40:24.000 --> 00:40:32.239
So, I mean, that kind of shows people people are people are complying more active.
00:40:32.480 --> 00:40:33.119
Yeah, yeah.
00:40:33.360 --> 00:40:40.639
We know another thing as well that I came across is the DIFC's July 2025 amendments.
00:40:40.800 --> 00:40:42.000
Have you heard of that one?
00:40:42.159 --> 00:40:47.679
Um, they changed every which kind of changed everything under the new article, which is 64A.
00:40:48.239 --> 00:40:57.599
Individuals in the DIFC now can sue companies directly for any kind of damages or distress caused by a breach, personally.
00:40:57.679 --> 00:40:59.679
So that's similar to the GDPR.
00:40:59.920 --> 00:41:00.239
Yeah.
00:41:00.400 --> 00:41:04.639
Um so they can bring a class action against the organization.
00:41:05.039 --> 00:41:08.559
Uh that mirrors kind of article 82 of the GDPR.
00:41:08.719 --> 00:41:21.519
Uh so before 2025, the DIFC, you could with the DIFC, you could only, you know, the organizations only needed to be worried about the commissioner, you know, in terms of breach.
00:41:21.760 --> 00:41:32.719
But now, um, if there's a data breach in an organization in within the DIFC, you have that risk of a class action happening as well, just like in Europe.
00:41:33.440 --> 00:41:37.360
Yeah, so that yeah, I just came across that today, so it was interesting.
00:41:37.519 --> 00:41:40.480
I thought it might be worth bringing it up.
00:41:40.880 --> 00:41:56.559
Yeah, a lot of the Gulf regions have a private right of action in their legislation, so I'm actually surprised that that was an amendment that came out so soon.
00:41:57.840 --> 00:42:01.039
Actually, yeah, just the 20th of July last year.
00:42:01.199 --> 00:42:01.679
Yeah.
00:42:02.559 --> 00:42:04.480
That is that is very recent.
00:42:04.639 --> 00:42:09.360
We'll move on to our last question here for yourself, Maria.
00:42:09.519 --> 00:42:13.760
What are the top three things organizations should prioritize?
00:42:14.079 --> 00:42:14.800
Thanks, Katie.
00:42:15.039 --> 00:42:35.039
So if you're thinking about working or setting up, you know, processing data basically in these free zones, I think the first thing you need to do is you need to map which regime applies to which processing, especially if you're more if you're processing in more than one jurisdiction.
00:42:35.280 --> 00:42:56.400
And then another good thing that you could do is implement, you know, if you have already kind of GDPR grade governance, then you can roll that out if you're you know if you're processing data in the DIFC and the ADGM, because like like we've shown in this podcast, they're very similar frameworks.
00:42:56.559 --> 00:43:06.239
So if you start rolling out your GDPR, you'll probably come across a few differences, like we've highlighted in the podcast, but they're very similar to the GDPR.
00:43:06.400 --> 00:43:09.039
So you know that's a good action to take.
00:43:09.280 --> 00:43:22.639
And then the third action would be with the 2025 right, private right of action that we just mentioned with the DIC, it I think it's important to start looking at your contracts.
00:43:22.960 --> 00:43:28.320
So you have to understand where the liability will will lie if there is a data breach.
00:43:28.559 --> 00:43:36.719
So make sure that those data protection agreements with your processors and so on are ironclad, that you're protected.
00:43:36.880 --> 00:43:44.719
And as well, in terms of your cyber insurance, you know, get cyber insurance, make sure you're covered in terms of cybersecurity.
00:43:44.880 --> 00:43:52.639
You know, the example that you gave there, Katie, they had no cybersecurity more or less in place, you know, protections in place.
00:43:52.880 --> 00:43:59.840
So, again, very important now, after that um that private right of action that came in in 2020.
00:44:01.599 --> 00:44:10.800
So an interesting thing that I came across as well is the diff there is a difference in terms of GDPR compliance.
00:44:11.360 --> 00:44:24.320
So if you're in the DIFC, and you have a data protection officer, then they have to have they have to submit an annual uh assessment report, which is interesting.
00:44:24.480 --> 00:44:30.880
And then in the ADGM, there are other certain notification filings that you have to do on an annual basis as well.
00:44:31.039 --> 00:44:36.559
So you'll have to be in communication with the authorities in both free zones.
00:44:36.960 --> 00:44:38.480
So I thought that was interesting.
00:44:38.719 --> 00:44:47.119
So, you know, you have to submit the your assessment report in the DAFC, and then you have to be aware of certain notification filings.
00:44:47.199 --> 00:44:58.800
Like, for example, you have to annually renew your data protection um registration with the authority in the ADGM.
00:44:59.039 --> 00:45:05.599
If you're appointing or if you're changing your data protection officer, you have to let them know as well.
00:45:05.920 --> 00:45:13.360
Or if you're if you're taking on new data processors, that has to be notified to the or to the authority as well.
00:45:13.440 --> 00:45:21.920
So there's a few things that are different there that you you know must keep in mind if you're if you're thinking about uh processing data in these free zones.
00:45:22.880 --> 00:45:25.119
Thanks for that, Maria.
00:45:25.760 --> 00:45:35.280
So uh I think that brings us to the end of our second part of our two-part focus on the United Arab Emirates.
00:45:35.679 --> 00:45:48.719
Across the two episodes, we've tried to show how the UAE doesn't have a single uniform data protection regime in the way many European listeners might have instinctively expected.
00:45:49.519 --> 00:46:12.480
Um instead, it operates a Laird system with a federal framework, sector-specific rules, and then distinct GDPR-inspired regimes within the DIFC and ADGM, which again is just two out of, I think there's about 40 free zones in the UAE.
00:46:12.639 --> 00:46:37.920
So, you know, we we kind of just touch the surface there, but what should now be clear is that compliance in the UAE is not about memorizing one statute, it's about understanding where you're established, where your processing happens, what your sectoral specific regulations are, and what legal regime that combination triggers.
00:46:38.079 --> 00:47:01.360
For any organizations who are still operating under the GDPR, a lot of the concepts are going to be the same, like the RUPA, the DPIA, the processor uh requirements, the data subjects' rights, but you have to still be careful about the details and about the particular enforcement posture.
00:47:01.920 --> 00:47:05.519
The lawful basis frameworks, another one to look out for.
00:47:05.920 --> 00:47:21.039
The transfer mechanisms can differ, they're quite similar, but the the devil's in the details, really, when it comes to not being uh not being too comfortable with the fact that the structure feels familiar.
00:47:21.679 --> 00:47:36.079
So I would say the real takeaway from the two-part series is that you're going to need a jurisdiction-specific compliance strategy if you're operating in or targeting business in the UAE.
00:47:36.480 --> 00:47:43.920
And you're going to need to move away from having everything in the GDPR wording and the GDPR structure.
00:47:44.480 --> 00:47:49.039
So thank you, Maria, for working through this with me today.
00:47:49.440 --> 00:47:53.039
And thank you, everyone, for listening.
00:47:54.639 --> 00:47:55.519
Thank you.
00:47:55.920 --> 00:47:57.599
Thanks to all our listeners.
00:47:57.760 --> 00:48:01.199
We'll see you again in the next podcast.
00:00:23.199 --> 00:00:29.039
Hello, everyone, and welcome back to our podcast series exploring international privacy and data protection laws.
00:00:29.280 --> 00:00:38.719
Before we get into today's episode, I just want to briefly recap where we left off in part one of our two-part focus on the United Arab Emirates.
00:00:38.960 --> 00:00:52.240
Last time we concentrated on the UAE federal personal data protection law, and we spent a lot of time unpacking why the UAE's data protection landscape is unusually complex compared to many other jurisdictions.
00:00:52.399 --> 00:01:13.680
We looked at how the federal PDPL sits alongside sector-specific rules and how it differs from the GDPR in terms of lawful basis, enforcement maturity, and international transfers, and why executive regulations play such a central role in how the law is actually applied in practice.
00:01:13.920 --> 00:01:17.599
But the key theme we kept coming back to was this.
00:01:18.000 --> 00:01:27.680
In the UAE, the real compliance question isn't just what does the law say, it's which law applies to me.
00:01:28.000 --> 00:01:42.000
Because the federal DPL doesn't operate in isolation, it exists alongside separate legal regimes in free zones, and those regimes can impose very different obligations on organisations.
00:01:42.560 --> 00:01:45.359
And that brings us directly to today's episode.
00:01:45.519 --> 00:01:53.680
So I'm going to hand over to Katie now, who's going to introduce our focus for part two of this podcast episode.
00:01:54.239 --> 00:01:55.359
Thanks, Maria.
00:01:55.599 --> 00:02:01.040
Yeah, I'm just going to give an overview of where we're going to focus on today as opposed to last week.
00:02:01.280 --> 00:02:08.879
So this is part two of our UAE series, and we're going to turn our attention to the free trade zones.
00:02:09.280 --> 00:02:30.159
There's over 40 free trade zones in the country of the UAE, but we're going to choose two in particular for the purpose of this podcast: the Dubai International Financial Center, the DIFC, and the Abu Dhabi Global Market, which is the ADGM.
00:02:30.319 --> 00:02:45.120
They're both situated in the two of the most populous Emirates in the UAE, and they have a really big role to play in increasing foreign trade in commodities that aren't oil, basically.
00:02:45.280 --> 00:02:59.120
So that was the reason that we wanted to zone in on these, because these two zones have their own courts and commercial laws, and they also have their own data protection frameworks.
00:02:59.360 --> 00:03:10.479
And those frameworks are a lot more detailed and closer in structure to the GDPR than the federal PDPL, as we discussed last time.
00:03:11.520 --> 00:03:37.759
So in this episode, we're going to look mainly at how the DIFC and ADGM regimes work in practice, how they differ from the federal law, and how organizations can navigate the regulatory landscape, and how that can translate into governance procedures, international transfers, enforcement, and day-to-day compliance.
00:03:38.080 --> 00:03:44.879
So just like last week, we've got 12 questions and we're going to take them in turns as per usual.
00:03:45.360 --> 00:03:47.439
So I'll ask the first question, Katie.
00:03:47.680 --> 00:04:00.879
For our listeners who are new to the idea of the UAE free zones, can you explain what the DIFC and the ADGM actually are and why they have their own data protection laws?
00:04:02.319 --> 00:04:03.520
Thanks, Maria.
00:04:03.840 --> 00:04:14.879
So the DIFC and ADGM are what the UAE has created as their financial and commercial free zones.
00:04:26.079 --> 00:04:39.680
The DIFC, the Dubai International Financial Center, is an onshore financial center with the aim of fulfilling the financial needs of the region as it grows its economy.
00:04:40.240 --> 00:04:51.199
It also has the purpose of strengthening the links between the financial markets of Europe, the Americas, and Southeast Asia.
00:04:52.000 --> 00:05:09.199
Whereas the ADGM, the Abu Dhabi Global Market, is an international financial center located in the capital of the UAE, but its main focus is growing financial financial connection between the Middle East, Africa, and Asia.
00:05:09.519 --> 00:05:14.240
So they both kind of have a separate, I suppose, cultural purpose.
00:05:14.480 --> 00:05:23.680
The DIFC is more, you know, the Western world and Southeast Asia, and then the ADGM is for the Middle East, Africa, and the rest of Asia.
00:05:23.920 --> 00:05:31.120
So they both have their own courts, they have their own commercial laws, and they also have their own regulators.
00:05:31.360 --> 00:05:36.800
So when it comes to data protection, it's a logical extension of that model.
00:05:37.279 --> 00:05:50.720
If you're trying to attract international banks, asset managers, cloud providers, and multinationals, you're gonna need a regulatory framework that is similar to what they've already complied to.
00:05:50.879 --> 00:06:02.879
So that's the idea behind why they have their own separate systems and why their data protection regimes are far more prescriptive than the PDPL.
00:06:03.439 --> 00:06:08.480
Yeah, I hope that gives a good background to why they're very clear.
00:06:08.560 --> 00:06:09.120
Yeah, sorry.
00:06:10.480 --> 00:06:20.319
I'll I'll go to your question now, Maria, which is why were these free zone data protection regimes created in the first place?
00:06:20.560 --> 00:06:24.399
And what problem are they trying to solve?
00:06:24.959 --> 00:06:28.399
So I think you kind of covered that as well, Katie, in the first question.
00:06:28.959 --> 00:06:34.480
The short answer is really international credibility and legal certainty, I think.
00:06:35.040 --> 00:06:49.680
The federal PDPL that we looked at last week was designed as kind of a national baseline framework, and it's clearly influenced by the GDPR, but it's relatively high level and very consent focused.
00:06:50.000 --> 00:06:58.000
Um, and it's heavily dependent on executive regulations to flesh it out, like we saw in the first podcast that we did.
00:06:58.639 --> 00:07:17.279
So it's perfect for like a domestic legal system, but for international financial services, like you described, and for digital businesses, uh, that kind of uncertainty and you know the need to flesh it out more in the future uh could become a real problem, a real commercial problem.
00:07:17.839 --> 00:07:30.319
So I think that's why the DIFC and the AGGM kind of went with more of an international uh approach to data protection.
00:07:30.959 --> 00:07:41.519
They wanted to mirror international standards, so they went with something very similar to the GDPR because the GDPR is often seen as the gold standard for data protection globally.
00:07:42.160 --> 00:07:57.279
Um, and they wanted to give businesses a very clear, operationally detailed rule book that you know is similar to you know what the what organizations would be used to by doing business in Europe.
00:07:58.000 --> 00:08:05.600
And they wanted to provide strong independent regulatory oversight through specialist free zone authorities.
00:08:05.759 --> 00:08:18.240
So, like you said, the the the DIFC and the ADGM have their own data protection authorities, um, so that gives certainty to international organizations as well, you know.
00:08:18.399 --> 00:08:34.240
So I think they essentially were created to kind of remove any kind of friction um that may exist uh between you know cross-border transfers and so on.
00:08:34.559 --> 00:08:51.600
By having regimes that are very similar to the GDPR, companies that are already working with Europe or who are based in Europe would have very little problems um transferring or or setting up in these free zones.
00:08:51.759 --> 00:09:00.879
So the transfer of personal data would be much easier for them because uh each of these free zones have adequacy with a DPR.
00:09:01.200 --> 00:09:06.159
So it's just basically streamlining um international business, I think.
00:09:07.840 --> 00:09:08.480
For sure.
00:09:09.200 --> 00:09:26.720
So then moving on to question three, um, and just to be crystal clear, Katie, does the federal PDPL um apply ever in these DIFC, in the DIFC and the ABGM?
00:09:26.960 --> 00:09:33.200
Or are these zones completely and utterly carved out in terms of their data protection frameworks?
00:09:34.799 --> 00:09:51.919
Um so the PDPL does not apply to companies and establishments located in the free zones as far as they have their own legislation governing personal data protection.
00:09:52.000 --> 00:10:11.840
So that was another reason, I suppose, that we chose to explore the DIFC and the ADGM because the scope of the PDPL says that it applies, except in the case that a free zone has its own data protection regime.
00:10:12.240 --> 00:10:17.840
So for the purposes of where we're exploring today, they they have their own regulations.
00:10:18.000 --> 00:10:20.000
The PDPL does not apply.
00:10:20.399 --> 00:10:32.960
And we've also chosen zones that happen to operate in the financial services sector, so they tend to have their own specific laws governing financial services as well.
00:10:33.279 --> 00:10:43.200
So yeah, the the PDPL does not apply to organizations within these two zones that we're talking about today.
00:10:43.600 --> 00:10:43.919
Okay.
00:10:44.480 --> 00:10:56.399
You mentioned other regulations that will probably um have some sort of uh impact on uh compliance and you know governance in general.
00:10:58.240 --> 00:11:12.000
Yeah, um like they have within the UAE, they tend to be like I think we touched on it last week too, that certain sectors also have their own specific laws governing it.
00:11:12.320 --> 00:11:20.240
So it's not just the zones to look out for, it's also what sector you're in.
00:11:20.879 --> 00:11:23.840
I think was more relevant to our discussion last week.
00:11:24.159 --> 00:11:30.960
That's another thing to consider what if you're you know, if you're if you're doing business with these two free zones, okay.
00:11:31.679 --> 00:11:52.639
Um yeah, I think that kind of frames our next question, which is for you, Maria, which is in practice, how will an organization figure out which law is going to apply to them and what happens when they have operations across multiple zones?
00:11:53.919 --> 00:11:54.799
Thanks, Katie.
00:11:55.039 --> 00:12:10.639
Well, I've looked at this question, I've looked at this issue quite a lot, um, and I've been back and forth about it, but I think if you approach it like from a three-step uh approach, I think is the most transparent way that we can kind of look at it.
00:12:10.799 --> 00:12:17.679
So the first thing you need to do is you need to understand where you are licensed to do business.
00:12:17.840 --> 00:12:20.159
So, where did you set up your organization?
00:12:20.559 --> 00:12:27.519
If you've set it up in the DIFC, then your main jurisdiction would be the DIFC.
00:12:27.679 --> 00:12:32.639
If you set it up in the ADGM, then the ADGM data protection law would apply.
00:12:32.879 --> 00:12:39.759
And you know, so that the federal PDPL law would step aside in that in that scenario.
00:12:40.559 --> 00:13:07.600
But then if you if it gets if you're thinking about a second jurisdiction, so if you're set up in one of the free zones, but you're kind of recruiting um staff from will say the federal from the jurisdiction where the federal PDP applies, um, like onshore in Dubai or Abu Dhabi, then you've you've created what we would call a federal nexus.
00:13:08.000 --> 00:13:13.200
So you'll likely need to follow like the stricter of the two laws.
00:13:13.679 --> 00:13:28.639
So the second jurisdiction in that case would be the federal PDPL, but the main jurisdiction would be like the more complex and the stricter law, so you'd apply that law.
00:13:28.799 --> 00:13:43.840
Um, but of course, you would have to be um observant as well of the PDPL, but you would always take the higher or more stricter uh law into account when you're when you're considering compliance.
00:13:44.240 --> 00:13:51.679
And then the third one we just touched on um in your previous question, Katie, is regardless of the zone that you're in.
00:13:51.759 --> 00:14:06.399
So, regardless of whether you're in the jurisdiction of the PDP, the federal PDPL or the DIFC or the ADGM, there are certain the sector of where you're working in is important.
00:14:06.799 --> 00:14:19.360
So let's say if you were processing health data in one of these regions, one of these free zones, then the 2019 health data law would take precedence over the data protection law.
00:14:19.600 --> 00:14:28.000
But that's another thing you need to consider when trying to decide regulatory obligations in terms of compliance.
00:14:28.399 --> 00:14:46.720
But another thing that we're seeing, a trend that we're starting to see now, is instead of like building separate uh data protection programs or separate frameworks, uh, organizations are starting to look at the highest standard framework and go from there.
00:14:46.799 --> 00:15:04.159
Um and in this case, it would be the DIFC framework, and then you would just add a kind of a federal addendum to handle specific local notifications when you're processing data in the federal PDPL jurisdiction.
00:15:05.039 --> 00:15:06.240
I hope that's clear.
00:15:07.679 --> 00:15:17.679
Yeah, I think that is the best the best approach just to satisfy the move the most strict regime first.
00:15:18.639 --> 00:15:34.720
Yeah, and then you know take note of the extra requirements that you need to put in place for the lesser uh of the jurisdictions, the less strict um jurisdiction, and in this case it would be the federal PDPL.
00:15:36.639 --> 00:15:40.720
Okay, so moving on to question five, then Katie.
00:15:41.440 --> 00:15:55.120
For a GDPR compliant organization that are that's listening to this podcast, what parts of these free zone uh regulations would feel familiar straight away?
00:15:55.360 --> 00:16:00.159
And what are the parts that might they need to consider and that might catch them out?
00:16:00.399 --> 00:16:54.639
Um so I'd say the overall, I mean, in comparison to the federal PDPL anyway, the overall structure of these two laws is going to feel a lot more similar to GDPR, and I think that that's where the comfort might creep in because at the end of the day, there are those slight nuances, and I think one of the main differences with how these are going to apply in practice is that they're younger than the GDPR, so the regulators' expectations are going to be different, and I think we're going to talk about this a bit more later on, but they're gonna have they're gonna obviously take a different approach to the DPC or the ICO.
00:16:55.519 --> 00:17:26.079
So, I mean the DIFC is actually based a lot more on the UK GDPR rather than the EU GDPR, and they do rely on the ICO guidance, whereas the ADGM, I would say, even though their zone is aimed less so at Europe, but the actual regulation is more modelled on the EU GDPR than the UK GDPR.
00:17:26.640 --> 00:17:47.359
So little things like that I'd say look out for, and something that we keep talking about, which is how it interacts with the other laws applicable in whatever zone or whatever sector the organization is operating in.
00:17:48.000 --> 00:17:48.319
Okay.
00:17:49.839 --> 00:18:01.039
Um and another thing I'd like to just add as well is you know, you've got the the the same kind of controller processor model and the same six lawful bases as you have with the GDPR.
00:18:01.200 --> 00:18:06.799
Um but where people might get caught is the is like their enforcement style.
00:18:06.960 --> 00:18:16.559
So in the EU, regulators like the Irish DPC or the French Canil often start with massive turnover-based fines.
00:18:16.720 --> 00:18:21.119
Like you know, they're always coming in the news for breaches and so on.
00:18:21.200 --> 00:18:26.240
And the first thing that the authorities would do is impose a massive fine.
00:18:26.559 --> 00:18:32.640
Whereas in the ADGM and the DIFC, we're see we see more of a kind of a prescriptive approach.
00:18:32.799 --> 00:18:48.720
So they do fine, but the fines are don't seem to be a fraction of what they would be in Europe, and they focus more on kind of directions on how the organization could comply with the regulations in the future.
00:18:49.039 --> 00:18:54.160
So that's kind of something as well that's slightly different in these free zones.
00:18:55.119 --> 00:18:57.839
Yeah, I would I would agree.
00:18:58.000 --> 00:19:09.920
Yeah, I suppose it is it is the regulators who are interpreting, applying, and enforcing the regulation at the end of the day.
00:19:10.079 --> 00:19:17.839
I mean, if they use the same terms, but you kind of, you know, that's your best source to go off.
00:19:18.240 --> 00:19:19.119
Absolutely, yeah.
00:19:19.200 --> 00:19:29.119
And if you look at the previous cases, um, and we'll get into that in more detail in the next few questions, but they take it quite seriously, they take data protection quite seriously.
00:19:38.079 --> 00:19:42.640
I'll move on to question six now for yourself, Maria.
00:19:43.759 --> 00:19:54.480
So, do the DIFC and ADGM take a more GDPR-like approach to lawful basis compared to the PDPL?
00:19:55.200 --> 00:19:58.960
And what is that going to mean for day-to-day compliance?
00:19:59.519 --> 00:20:19.039
Well, I would definitely say that those two free zones, the DIFC and the ADGM, are very much more of a GDPR type approach in terms of lawful basis, because they they both have the same six lawful bases as the GDPR.
00:20:19.200 --> 00:20:43.359
And this is a great kind of boost for international companies because it means that if the if the companies have been working in Europe before that and they have a kind of a data protection framework already in place, then it's going to be very easy for them to set up their data protection frameworks in these two free zones as well, with just minimal adjustments.
00:20:43.440 --> 00:20:51.839
You know, they should be able to uh kind of port that framework, uh, that legal basis framework from Europe into these three zones.
00:20:52.079 --> 00:20:54.880
And that's like massive for organizations.
00:20:55.279 --> 00:21:02.960
Um, and and you know, it can be quite costly if they're if they don't have the same kind of compliance or governance structure.
00:21:03.200 --> 00:21:21.839
And as well, we see that like the the the federal PDPL in terms of lawful basis is very kind of consent focused, whereas these free zones they have the familiar lawful basis, the six um lawful basis that we are used to with the GDPR in Article Six.
00:21:22.480 --> 00:21:33.599
Um, so in practice, uh GDPR compliant organizations can often just reuse their lawful basis framework um wholesale when they're setting up in these free zones.
00:21:33.759 --> 00:21:43.039
If you're processing data to provide a service to a client, you can use the lawful basis of contract uh like you can with the GDPR.
00:21:43.279 --> 00:21:49.519
And if you're doing something like internal broad monitoring, then you can actually use legitimate interests.
00:21:49.680 --> 00:21:59.599
Um, and as well, it's it's it's so similar to the GDPR in that they would expect you to carry out a legit legitimate interest assessment as well and have that available for.
00:22:00.240 --> 00:22:01.200
An audit.
00:22:01.519 --> 00:22:04.720
So you know it's very, very similar to the GDPR.
00:22:04.960 --> 00:22:26.799
And I think as well, another benefit of this is that when you have um kind of a high-level uh framework like the federal PDPL, organizations have to go back and get consent all the time from their customers, which can create kind of what they call consent fatigue.
00:22:26.880 --> 00:22:31.279
And people just get bored and they get tired of having to give consent the whole time.
00:22:31.519 --> 00:22:40.799
So you avoid that when you have a more complex framework like that's that that's in the free zones of DIFC and the ATGM.
00:22:41.519 --> 00:22:47.920
As well, another thing is that it's they're quite similar when it comes to special category data.
00:22:48.160 --> 00:22:58.000
So in the GDPR, we have Article 6 and then we have Article 9 as well, and we have to find a lawful basis for those two articles.
00:22:59.039 --> 00:23:12.720
So in the DIFC, you have similar a similar approach that you have to not only have a lawful basis to process uh special category data, but you also have to have an additional condition.
00:23:12.880 --> 00:23:29.200
And the conditions would be either explicit consent, employment or social protection reasons, vital interests, non-profit or membership bodies, and uh or data that's been made public by the data subject, and so on.
00:23:29.279 --> 00:23:33.839
So there's so that it's similar in approach to the GDPR as well.
00:23:33.920 --> 00:23:42.000
So you'd have to have two conditions in order to be able to process uh special category data, and it's similar in the ADGM as well.
00:23:42.319 --> 00:23:53.839
So you have to have the first one of you have to meet one of the six lawful bases, you have to meet a condition, a secondary condition to be able to process uh special category data.
00:23:54.000 --> 00:24:01.920
So it's similar to the to the GDPR in terms of um processing you know uh special category data as well.
00:24:02.319 --> 00:24:06.000
Moving on then, uh Katie, to question seven.
00:24:06.480 --> 00:24:13.599
What are the key governance and accountability requirements under the DIFC and the ADGM?
00:24:14.160 --> 00:24:15.680
Thanks, Maria.
00:24:16.079 --> 00:24:21.119
They are quite similar to GDPR accountability.
00:24:21.519 --> 00:24:34.480
I mean, for the ADGM, they need to implement the appropriate technical and organizational measures to demonstrate that the processing is performed in compliance with their law.
00:24:34.720 --> 00:24:46.799
They need to review and update those measures where necessary, so they're going to need to, you know, keep up with technological developments and um regulatory developments.
00:24:47.119 --> 00:24:53.200
They have a requirement for data protection by design and by default, which we're familiar with.
00:24:53.359 --> 00:25:03.759
They have to pay a data protection uh fee to the Commissioner of Data Protection, which is, if I understand, that's in practice in the UK.
00:25:04.319 --> 00:25:35.039
They also have their controller processor obligations, and their data subjects' rights obligations and everything, but I suppose those are the ones that stick out to me, especially a whole article for data protection by default and design, which I quite like because you I don't know, we haven't seen that in every law so far, even if it's you know an underlying principle or a nice to have, but this is you know a must-have for the ADGM.
00:25:36.000 --> 00:25:42.559
For the DIFC, they have accountability and notification requirements.
00:25:42.880 --> 00:25:50.400
You need to have your ROPA, you need to have your record of processing activities, all the same information, really.
00:25:50.720 --> 00:26:04.160
You can have it's not a requirement, but they do make a provision for having uh a DPO, and they have to be run through a DF DIFC body other than the court, so they kind of have to be vetted.
00:26:04.400 --> 00:26:10.640
A few of a few of the Gulf regions have that, have uh requirements like that for their DPO, actually.
00:26:11.119 --> 00:26:15.839
They've got to do their DPIAs again with the ADGM.
00:26:15.920 --> 00:26:17.119
We've seen that also.
00:26:17.680 --> 00:26:26.400
Yeah, they need to get in contact with the with the commissioner, where assessments are gonna be are gonna pose a high risk.
00:26:26.640 --> 00:26:28.480
So, I mean, we have that as well.
00:26:28.640 --> 00:26:31.279
Like it's it's it's very it's very similar.
00:26:31.599 --> 00:26:38.400
The main difference again is what their independent regulators are gonna be looking out for.
00:26:38.720 --> 00:26:44.799
Because they have they have the joint controllers, they have the processors, and so like they have nearly everything.
00:26:44.960 --> 00:26:52.079
I suppose it's just whatever the regulator, you know, whatever their decision development is gonna be.
00:26:52.240 --> 00:26:54.799
That yeah, it's gonna be their stickler points.
00:26:55.039 --> 00:26:55.359
Yeah.
00:26:55.599 --> 00:27:07.599
So it's gonna it's probably going to be different, like you say, because we've seen this in other in previous uh podcasts where um the culture kind of comes into the data protection regulations.
00:27:08.160 --> 00:27:26.640
So the interpretation of the regulations may be different based on you know the commissioner's interpretation um, you know, in terms of what's appropriate in their specific country, which you know will probably be different to Europe based on differences in the country.
00:27:26.880 --> 00:27:34.240
So move on to question eight here, which is about the data subjects' rights.
00:27:34.480 --> 00:27:43.359
So would you say the data subjects' rights are stronger or more operationalized in the free zones compared to the federal law?
00:27:43.519 --> 00:27:49.519
And I suppose also compared to what we're more comfortable with, the GDPR?
00:27:50.400 --> 00:27:52.240
Well, I would say definitely.
00:27:52.559 --> 00:27:58.960
They're broader, they're more detailed, and as a result of that, then they're more enforceable.
00:27:59.119 --> 00:28:08.240
They are significantly more operationalized in the federal law because the DIFC and the ADGM regulators are more mature.
00:28:08.559 --> 00:28:14.319
The organizations actually do see access requests, erasure requests, and complaints.
00:28:14.640 --> 00:28:23.440
A good example of this is in the 2024 ADGM ruling against OKDOC technologies.
00:28:23.839 --> 00:28:32.799
Uh they were issued a variable penalty notice specifically for failing to properly handle a data subject access request.
00:28:33.039 --> 00:28:50.799
So in the EU, a DSAR failure might be part of a larger investigation, but this case showed that in the ADGM, uh we see the commissioner issue specific penalties for procedural failure in rights handling.
00:28:51.200 --> 00:28:58.000
The if you read the case, you'll see that the individual rights isn't just a checkbox.
00:28:58.079 --> 00:29:12.319
They kind of made sure that even though at the end of the case, the data subject, she she kind of settled an employment issue she had with the organization, so she was happy not to receive her data.
00:29:12.799 --> 00:29:27.599
But the the you know, Ocadoc technologies were fined anyway because the ADGM regulator investigated whether they had procedures in place to be able to carry out these, and they didn't.
00:29:27.759 --> 00:29:31.920
And as a result of that failure, they were you know they were fined.
00:29:32.400 --> 00:29:34.240
So that's an interesting case.
00:29:34.480 --> 00:29:47.759
So we're seeing that the ADGM takes these uh data subject rights quite seriously, and fines and directions on how to become compliant can come from these complaints.
00:29:49.599 --> 00:29:56.799
Question nine, Katie, is how do the DAFC and the ADGM handle international transfers then?
00:29:58.319 --> 00:30:05.759
Um again, they're similar but different to uh the DG the GDPR.
00:30:06.079 --> 00:30:08.720
So I'll start with the ADGM.
00:30:09.359 --> 00:30:28.000
The commissioner of data protection within the ADGM is gonna have to have made the decision that whatever jurisdiction they're sending the data to, or international organization uh has an adequate level of protection.
00:30:28.160 --> 00:30:33.920
So again, the adequacy that's the adequacy decisions we're familiar with.
00:30:34.160 --> 00:30:57.359
Things they're going to take into consideration when deciding on adequacy decisions is rule of law, respect for rights, and the relevant legislation, including uh general legislation and specific sectoral uh legislation, data protection rules, and how enforceable the data subjects' rights are.
00:30:57.920 --> 00:30:59.599
A few other things there too.
00:30:59.839 --> 00:31:01.519
That's the main ones.
00:31:01.759 --> 00:31:11.839
Another thing they take into consideration is international commitments uh that the jurisdiction has entered into, so conventions and things like that.
00:31:12.079 --> 00:31:16.640
So I suppose you know, a council of Europe country, like that might be.
00:31:16.960 --> 00:31:17.680
That's interesting.
00:31:18.319 --> 00:31:18.960
Yeah.
00:31:19.519 --> 00:31:38.960
So yeah, they'll have a list of their adequacy decisions, and then otherwise they have appropriate safeguards where there's no adequacy, and again, it's a legally binding contract, binding corporate rules, standard data protection clauses, and codes of conduct and certification.
00:31:39.119 --> 00:31:42.319
So that's the ADGM, it's very, very similar.
00:31:42.559 --> 00:31:48.799
The DIFC again operates on the basis of an adequate level of protection.
00:31:49.359 --> 00:31:53.680
Again, it considers the rule of law, respect for individuals' rights.
00:31:53.920 --> 00:32:02.799
They consider the access, how much access the public authority has to personal data, which is interesting.
00:32:03.039 --> 00:32:05.920
Yeah, it's an interesting one to note.
00:32:06.400 --> 00:32:20.160
The existence of effective data protection laws, whether they have a competent data protection authority, and again, they also consider international commitments and conventions that they've entered into.
00:32:20.880 --> 00:32:25.440
So the ADGM was give a lot more guidance there.
00:32:25.599 --> 00:32:30.480
The DIFC was more succinct, but uh a lot of it was the same.
00:32:31.440 --> 00:32:46.640
But in the absence of adequate protections, they again they need to rely on appropriate safeguards, which is legally binding instruments, binding corporate rules, standard data protection clauses, codes of conduct, and certifications.
00:32:46.880 --> 00:33:07.200
So unless, again, the derogations, such as like where it's necessary for public interest, for um the actions of public bodies where the data subject has manifestly made something public or has explicitly consented.
00:33:07.440 --> 00:33:14.799
I mean, they're they're basically mirroring the international transfer mechanisms of the GDPR, in my opinion.
00:33:15.200 --> 00:33:19.440
Okay, that's good, yeah, because it makes it easy for people or for organizations, yeah.
00:33:19.839 --> 00:33:26.480
Yeah, we'll go into yourself now, Maria, um, and we'll talk about breach notifications.
00:33:26.640 --> 00:33:33.279
So, what are the breach notification expectations in the DIFC and the ADGM?
00:33:34.240 --> 00:33:34.960
Thanks, Katie.
00:33:35.200 --> 00:33:39.519
So they're much clearer than what we saw with the federal PDPL last week.
00:33:39.759 --> 00:33:55.759
You have defined reporting obligations, you have regular expectations around timelines, sorry, you have regulator expectations around timelines, and you have much more established supervisory posture in both the DIFC and the AGGM.
00:33:56.000 --> 00:34:04.400
Breach notification is a high-stakes legal requirement, but the two zones use different schedules, we'll say, time schedules.
00:34:04.559 --> 00:34:16.400
While they both align with the GDPR's philosophy that the regulator must know about a breach before the public does, the specific expectations for when and how are quite distinct.
00:34:16.719 --> 00:34:21.039
You don't have to report every single breach.
00:34:21.199 --> 00:34:29.039
It's only you only have to report the breach when it meets a specific harm threshold.
00:34:29.199 --> 00:34:37.119
So for the ADGM, you report any breach unless it is unlikely to result in a risk to the rights of the individual.
00:34:37.280 --> 00:34:47.519
With the DIFC, the report you report the breach if it compromises a data subject's confidentiality, security, or privacy.
00:34:47.760 --> 00:35:01.440
So if a breach involves special category data like health data or biometrics, the regulators in both zones effectively assume that it's high risk by default, and they would expect immediate notification.
00:35:01.920 --> 00:35:12.400
So the DIFC will say when in terms of notifying the regulator, they kind of say you have to notify them as soon as is practicable.
00:35:12.639 --> 00:35:21.360
With the ADGM, the terminology is without undue delay and where feasible within 72 hours.
00:35:21.679 --> 00:35:33.840
Then, if you in terms of notifying the data subject, under the DIFC, it's as soon as practicable again, if there is a high risk to the security or the rights of the data subject.
00:35:34.000 --> 00:35:43.119
And then with the ADGM, again they use that terminology without undue delay, if there's high risk to the rights of the data subject.
00:35:58.079 --> 00:36:15.360
So again, we're we're seeing here very similar to the GDPR, with the DIFC, they don't mention the 72-hour um time schedule, but with the ADGM, they do actually say, if possible, try and get try and report the breach within the first 72 hours.
00:36:15.519 --> 00:36:17.760
So yeah, very similar again.
00:36:18.079 --> 00:36:22.079
So moving on to the pen ultimate question, Katie.
00:36:22.559 --> 00:36:30.239
Are the DIFC and the ADGM regulators more active than we'll say the you know the federal PDPL?
00:36:30.480 --> 00:36:31.679
Thank you, Maria.
00:36:31.920 --> 00:36:34.159
Um I I don't know.
00:36:34.800 --> 00:36:59.840
Well, I would say compared to the federal PDPL, it seems to be that they are a bit more active in the sense that they have a lot more guidance out there and they have a lot more kind of literature out there to help understand the application of the legislation and a lot more additional resources.
00:37:00.559 --> 00:37:04.719
Um and they are engaged for sure.
00:37:04.800 --> 00:37:17.760
Like I might piggyb on your previous question a little bit and talk about um a decision from the ADGM Office of Data Protection.
00:37:17.920 --> 00:37:22.480
Um that's their regulator, the Office of Data Protection.
00:37:22.639 --> 00:37:33.599
Um and I'll talk about this decision from June 2023 regarding a breach reporting incident, um, which you were talking about previously.
00:37:33.840 --> 00:37:38.639
So they had a security incident and they had to report the breach.
00:37:38.880 --> 00:38:03.280
Um but the breach reporting procedure was not adequately followed by the organization from the perspective of the Office of Data Protection because they didn't give enough detail on what they had in place to potentially prevent the breach and what they had introduced as mid to mitigate the risk.
00:38:03.599 --> 00:38:24.000
So the authority kind of perked up its ears and you know delved more into this organization, and they discovered through investigation of that incident that the organization did not have policies or procedures in place for handling security incidents or mitigating any consequences.
00:38:24.320 --> 00:38:29.760
The only technical security measure they had in place was a free antivirus tool.
00:38:30.320 --> 00:38:31.119
That's crazy.
00:38:32.400 --> 00:38:33.039
Yeah.
00:38:34.480 --> 00:38:49.039
They also lacked, they also got a bit of guff, I suppose, from the fact that the authority considered them to lack any proper training or awareness within their organization, which was a key factor that led to the breach.
00:38:49.280 --> 00:39:00.320
So they were found to be in contravention of section 29 of the regulation, which requires meaningful cooperation with the authority in the performance of its duties.
00:39:00.719 --> 00:39:19.360
So although, yes, they reported the breach, but the breach exposed the fact that they didn't have uh they basically weren't compliant with the regulation at all, and that stopped them from meaningfully engaging with the authority.
00:39:19.599 --> 00:39:24.159
So yeah, they they basically they didn't let that fly past them.
00:39:24.400 --> 00:39:26.880
So that's interesting, isn't it?
00:39:27.119 --> 00:39:42.000
So they find them for not actually meaningfully engaging, yeah, and they couldn't they couldn't because they didn't have the framework, the framework or the training and awareness in place to understand their obligations.
00:39:42.480 --> 00:39:55.440
So, you know, you can I suppose you know they might have thought they were doing well reporting the breach, but it kind of exposed other deficiencies within that organization.
00:39:55.840 --> 00:40:23.519
Yeah, um, and the the DIFC is active too, they have a lot a lot more information online, and they also rely on ICO guidance where they might have gaps, but in 2023 they gave out 173 administrative fines, and in 2024 they give 64.
00:40:24.000 --> 00:40:32.239
So, I mean, that kind of shows people people are people are complying more active.
00:40:32.480 --> 00:40:33.119
Yeah, yeah.
00:40:33.360 --> 00:40:40.639
We know another thing as well that I came across is the DIFC's July 2025 amendments.
00:40:40.800 --> 00:40:42.000
Have you heard of that one?
00:40:42.159 --> 00:40:47.679
Um, they changed every which kind of changed everything under the new article, which is 64A.
00:40:48.239 --> 00:40:57.599
Individuals in the DIFC now can sue companies directly for any kind of damages or distress caused by a breach, personally.
00:40:57.679 --> 00:40:59.679
So that's similar to the GDPR.
00:40:59.920 --> 00:41:00.239
Yeah.
00:41:00.400 --> 00:41:04.639
Um so they can bring a class action against the organization.
00:41:05.039 --> 00:41:08.559
Uh that mirrors kind of article 82 of the GDPR.
00:41:08.719 --> 00:41:21.519
Uh so before 2025, the DIFC, you could with the DIFC, you could only, you know, the organizations only needed to be worried about the commissioner, you know, in terms of breach.
00:41:21.760 --> 00:41:32.719
But now, um, if there's a data breach in an organization in within the DIFC, you have that risk of a class action happening as well, just like in Europe.
00:41:33.440 --> 00:41:37.360
Yeah, so that yeah, I just came across that today, so it was interesting.
00:41:37.519 --> 00:41:40.480
I thought it might be worth bringing it up.
00:41:40.880 --> 00:41:56.559
Yeah, a lot of the Gulf regions have a private right of action in their legislation, so I'm actually surprised that that was an amendment that came out so soon.
00:41:57.840 --> 00:42:01.039
Actually, yeah, just the 20th of July last year.
00:42:01.199 --> 00:42:01.679
Yeah.
00:42:02.559 --> 00:42:04.480
That is that is very recent.
00:42:04.639 --> 00:42:09.360
We'll move on to our last question here for yourself, Maria.
00:42:09.519 --> 00:42:13.760
What are the top three things organizations should prioritize?
00:42:14.079 --> 00:42:14.800
Thanks, Katie.
00:42:15.039 --> 00:42:35.039
So if you're thinking about working or setting up, you know, processing data basically in these free zones, I think the first thing you need to do is you need to map which regime applies to which processing, especially if you're more if you're processing in more than one jurisdiction.
00:42:35.280 --> 00:42:56.400
And then another good thing that you could do is implement, you know, if you have already kind of GDPR grade governance, then you can roll that out if you're you know if you're processing data in the DIFC and the ADGM, because like like we've shown in this podcast, they're very similar frameworks.
00:42:56.559 --> 00:43:06.239
So if you start rolling out your GDPR, you'll probably come across a few differences, like we've highlighted in the podcast, but they're very similar to the GDPR.
00:43:06.400 --> 00:43:09.039
So you know that's a good action to take.
00:43:09.280 --> 00:43:22.639
And then the third action would be with the 2025 right, private right of action that we just mentioned with the DIC, it I think it's important to start looking at your contracts.
00:43:22.960 --> 00:43:28.320
So you have to understand where the liability will will lie if there is a data breach.
00:43:28.559 --> 00:43:36.719
So make sure that those data protection agreements with your processors and so on are ironclad, that you're protected.
00:43:36.880 --> 00:43:44.719
And as well, in terms of your cyber insurance, you know, get cyber insurance, make sure you're covered in terms of cybersecurity.
00:43:44.880 --> 00:43:52.639
You know, the example that you gave there, Katie, they had no cybersecurity more or less in place, you know, protections in place.
00:43:52.880 --> 00:43:59.840
So, again, very important now, after that um that private right of action that came in in 2020.
00:44:01.599 --> 00:44:10.800
So an interesting thing that I came across as well is the diff there is a difference in terms of GDPR compliance.
00:44:11.360 --> 00:44:24.320
So if you're in the DIFC, and you have a data protection officer, then they have to have they have to submit an annual uh assessment report, which is interesting.
00:44:24.480 --> 00:44:30.880
And then in the ADGM, there are other certain notification filings that you have to do on an annual basis as well.
00:44:31.039 --> 00:44:36.559
So you'll have to be in communication with the authorities in both free zones.
00:44:36.960 --> 00:44:38.480
So I thought that was interesting.
00:44:38.719 --> 00:44:47.119
So, you know, you have to submit the your assessment report in the DAFC, and then you have to be aware of certain notification filings.
00:44:47.199 --> 00:44:58.800
Like, for example, you have to annually renew your data protection um registration with the authority in the ADGM.
00:44:59.039 --> 00:45:05.599
If you're appointing or if you're changing your data protection officer, you have to let them know as well.
00:45:05.920 --> 00:45:13.360
Or if you're if you're taking on new data processors, that has to be notified to the or to the authority as well.
00:45:13.440 --> 00:45:21.920
So there's a few things that are different there that you you know must keep in mind if you're if you're thinking about uh processing data in these free zones.
00:45:22.880 --> 00:45:25.119
Thanks for that, Maria.
00:45:25.760 --> 00:45:35.280
So uh I think that brings us to the end of our second part of our two-part focus on the United Arab Emirates.
00:45:35.679 --> 00:45:48.719
Across the two episodes, we've tried to show how the UAE doesn't have a single uniform data protection regime in the way many European listeners might have instinctively expected.
00:45:49.519 --> 00:46:12.480
Um instead, it operates a Laird system with a federal framework, sector-specific rules, and then distinct GDPR-inspired regimes within the DIFC and ADGM, which again is just two out of, I think there's about 40 free zones in the UAE.
00:46:12.639 --> 00:46:37.920
So, you know, we we kind of just touch the surface there, but what should now be clear is that compliance in the UAE is not about memorizing one statute, it's about understanding where you're established, where your processing happens, what your sectoral specific regulations are, and what legal regime that combination triggers.
00:46:38.079 --> 00:47:01.360
For any organizations who are still operating under the GDPR, a lot of the concepts are going to be the same, like the RUPA, the DPIA, the processor uh requirements, the data subjects' rights, but you have to still be careful about the details and about the particular enforcement posture.
00:47:01.920 --> 00:47:05.519
The lawful basis frameworks, another one to look out for.
00:47:05.920 --> 00:47:21.039
The transfer mechanisms can differ, they're quite similar, but the the devil's in the details, really, when it comes to not being uh not being too comfortable with the fact that the structure feels familiar.
00:47:21.679 --> 00:47:36.079
So I would say the real takeaway from the two-part series is that you're going to need a jurisdiction-specific compliance strategy if you're operating in or targeting business in the UAE.
00:47:36.480 --> 00:47:43.920
And you're going to need to move away from having everything in the GDPR wording and the GDPR structure.
00:47:44.480 --> 00:47:49.039
So thank you, Maria, for working through this with me today.
00:47:49.440 --> 00:47:53.039
And thank you, everyone, for listening.
00:47:54.639 --> 00:47:55.519
Thank you.
00:47:55.920 --> 00:47:57.599
Thanks to all our listeners.
00:47:57.760 --> 00:48:01.199
We'll see you again in the next podcast.
