ADGM Data Protection Regulations 2021 — articles 1–64

The Regulations protect natural persons in relation to the processing of personal data and safeguard the free movement of personal data within ADGM, while requiring a high and consistent level of protection.

The Regulations apply to automated processing and to non-automated processing forming part of a filing system, subject to stated exclusions such as purely personal or household activity.

The territorial rules cover processing in the context of an ADGM establishment and specified processing connected with offering goods or services to, or monitoring, individuals in ADGM.

Personal data must be processed lawfully, fairly and transparently; collected for specified purposes; limited, accurate, retained no longer than necessary and secured. The Controller must demonstrate compliance.

Processing requires a lawful basis, including consent, contract, legal obligation, vital interests, public tasks or legitimate interests, subject to the conditions and balancing required by the Regulations.

The Controller must be able to prove consent. A consent request must be distinguishable, clear and accessible; consent must be freely given and may be withdrawn as easily as it was given.

Processing sensitive categories is prohibited unless an express condition applies, such as explicit consent, employment or social-protection law, vital interests, legal claims, substantial public interest, health or appr…

A Controller need not retain or obtain extra identifying information solely to comply where the processing purpose does not require identification, but must inform a Data Subject if it cannot identify them.

Archiving, scientific or historical research and statistical processing must use appropriate safeguards, including data minimisation and, where feasible, measures such as pseudonymisation.

Information and communications must be concise, transparent, intelligible and easily accessible. Controllers must facilitate rights requests and respond within the prescribed periods, generally without charge.

At collection, the Controller must provide prescribed information including identity, purposes, lawful bases, recipients, transfers, retention, rights, complaints and any automated decision-making.

Where data comes from another source, the Controller must give similar notice plus the categories and source of the data within the applicable period, unless a stated exemption applies.

A Data Subject may obtain confirmation of processing, access to personal data and prescribed contextual information, together with a copy subject to safeguards for the rights of others.

A Data Subject may require inaccurate personal data to be corrected without undue delay and incomplete data to be completed, including by supplementary statement.

Personal data must be erased where a listed ground applies, subject to exceptions for expression, law, public interest, health, archiving, research or legal claims.

A Data Subject may require processing to be restricted in specified cases concerning disputed accuracy, unlawful processing, legal claims or a pending objection. Restricted data may be used only on limited grounds.

The Controller must notify recipients of rectification, erasure or restriction unless impossible or disproportionate, and identify recipients to the Data Subject on request.

For qualifying consent- or contract-based automated processing, the Data Subject may receive supplied data in a structured, commonly used, machine-readable format and transmit it to another Controller.

A Data Subject may object to public-task or legitimate-interest processing, including profiling. Direct-marketing processing must stop on objection; research objections are subject to the public-interest exception.

Individuals are protected against solely automated decisions producing legal or similarly significant effects, subject to limited exceptions and safeguards including human intervention and the ability to contest the deci…

Certain obligations and rights may be restricted by proportionate legislative measures protecting specified public interests, investigations, courts, professional duties or the rights of others, with required safeguards.

Controllers must implement and review proportionate technical and organisational measures and policies that ensure and demonstrate compliance, taking account of risk, context, scope and purpose.

Controllers must embed data-protection principles and safeguards into systems and processing and ensure default settings limit data, extent, retention and accessibility to what each purpose requires.

Controllers must register, pay the prescribed Data Protection Fee and renewal fee, and maintain the required particulars with the Commissioner, subject to applicable rules and exemptions.

Joint Controllers must transparently allocate their responsibilities by arrangement, make its essence available to Data Subjects and designate a contact point without limiting individual rights against each Controller.

Controllers may use only Processors providing sufficient guarantees. Processing must be governed by a prescribed contract; sub-processing requires authorisation and equivalent obligations.

A Processor or person acting under authority may process personal data only on instructions from the Controller unless required by applicable law.

Controllers, Processors and representatives must maintain prescribed written records of processing and make them available to the Commissioner on request.

Controllers, Processors and their representatives must cooperate with the Commissioner in the performance of official tasks.

Appropriate risk-based security measures may include pseudonymisation, encryption, resilience, recovery and regular testing. Risk assessment must address accidental or unlawful loss, alteration, disclosure or access.

When an establishment ceases or relevant processing ends, the Controller must securely delete, anonymise or transfer personal data as required, while preserving evidence of compliance and lawful retention.

A Controller must notify a qualifying personal-data breach to the Commissioner without undue delay and, where feasible, within 72 hours. Processors must notify Controllers without undue delay and breaches must be documen…

Where a breach is likely to create high risk, affected Data Subjects must be informed without undue delay in clear language, unless effective protection, later risk removal or disproportionate effort justifies an alterna…

Before likely high-risk processing, the Controller must conduct a DPIA covering the proposed operations, necessity, proportionality, risks and safeguards, and consult the Commissioner where residual high risk remains.

A DPO is required for public-authority processing and specified large-scale regular monitoring or sensitive-data processing. Groups may share an accessible DPO and contact details must be published and notified.

The DPO must be involved promptly, supported with resources, act independently without conflicting tasks, report to the highest management level and remain bound by confidentiality.

The DPO advises on obligations, monitors compliance and training, advises on DPIAs, cooperates with the Commissioner and acts as the supervisory contact while taking a risk-based approach.

Associations and representative bodies may prepare or amend codes that specify practical application of the Regulations. Codes require approval and may use accredited monitoring bodies.

Voluntary certification mechanisms, seals and marks may demonstrate compliance under approved criteria, but certification does not reduce Controller or Processor responsibility or the Commissioner's powers.

A transfer outside ADGM or to an international organisation is permitted only under Part V and must not undermine the level of protection guaranteed by the Regulations, including for onward transfers.

Transfers may occur without specific authorisation where the Commissioner has recognised an adequate level of protection, following assessment and periodic review of the relevant jurisdiction, sector or organisation.

Absent adequacy, a transfer requires appropriate safeguards and enforceable rights, such as approved contractual clauses, binding instruments, codes or certification, with authorisation where prescribed.

The Commissioner may approve legally binding and enforceable group rules that confer rights on Data Subjects and contain the prescribed structure, safeguards, complaint, audit and cooperation provisions.

Where neither adequacy nor safeguards apply, limited transfers may rely on explicit informed consent, contract, important public interest, legal claims, vital interests, public registers or a narrowly controlled compelli…

Disclosure to a public authority outside ADGM must rest on applicable legal authority or recognised international cooperation and remain necessary, proportionate and subject to data-protection safeguards.

The Commissioner may develop international cooperation, mutual assistance, information exchange and common enforcement arrangements to protect personal data, subject to appropriate safeguards.

The Regulations establish the Commissioner and Office of Data Protection as the independent supervisory authority responsible for monitoring and enforcing the framework.

The Commissioner must act with complete independence, remain free from external influence and instructions, avoid incompatible activity and receive the resources necessary for effective performance.

Office staff support the Commissioner's functions and remain subject to professional secrecy, integrity, conflict and other statutory obligations during and after service.

The Commissioner has monitoring, investigative, corrective, authorisation and advisory powers, including requiring information, conducting audits, issuing warnings and directions and imposing administrative fines.

The Office must have a separate and adequate budget prepared, approved and administered under the statutory arrangements that preserve supervisory independence and accountability.

The Office must maintain proper accounts and records, prepare financial statements and arrange independent audit in accordance with prescribed requirements.

The Commissioner must publish an annual report on supervisory activities, which may include notified infringements, measures taken and other information required for transparency and accountability.

The Commissioner may issue enforceable directions requiring specified action, restriction, suspension or cessation to secure compliance, subject to notice, reasons and applicable review rights.

Administrative fines must be effective, proportionate and dissuasive. The Commissioner considers the nature, duration, gravity, intent, mitigation, cooperation, data categories, history and other prescribed factors, subj…

Failure to pay the Data Protection Fee or renewal fee may attract a fixed penalty under the prescribed procedure, without limiting recovery of the underlying fee or other enforcement.

A Data Subject may complain to the Commissioner about processing that allegedly infringes the Regulations. The Commissioner must handle and inform the complainant of progress and outcome, subject to review rights.

Persons affected by specified Commissioner decisions or inaction may apply to the ADGM Court for the remedies and review available under the Regulations and Court procedure.

A person suffering material or non-material damage from an infringement may seek compensation from the responsible Controller or Processor, subject to allocation of liability and rights of contribution.

The Board may make rules necessary or expedient for carrying out the Regulations, including detailed procedures, safeguards, fees, exemptions and related matters within the enabling power.

Existing agreements and arrangements involving personal data must be brought into and maintained in compliance with the Regulations under the applicable transitional treatment.

This section defines the framework's principal terms, including Controller, Processor, Data Subject, Personal Data, Processing, Profiling, consent, breach, special categories and international organisation.

The Data Protection Regulations 2015 are repealed subject to the commencement and transitional provisions preserving necessary legal effects and orderly migration to the 2021 framework.

The instrument is cited as the Data Protection Regulations 2021 and applies in ADGM. It used transition periods from publication, including six months for new establishments and twelve months for existing establishments.