UAE PDPL Compliance: What It Means for Your IT Infrastructure

Personal data has emerged as an important technology and governance theme for companies in the United Arab Emirates․ Businesses typically collect‚ hold‚ process and transfer customer data‚ employee data‚ identification data‚ contact data‚ financial data‚ and other personal data as part of their business operations․

This means that data protection is not just a legal or administrative issue‚ but an IT issue․

UAE Federal Decree-Law No․ 45 of 2021 on the Protection of Personal Data (UAE Personal Data Protection Law or UAE PDPL) is the UAE federal law on personal data protection and the regulation of processing of personal data by organizations in the UAE․ Other requirements include lawful processing‚ security of processing‚ rights of data subjects‚ the appointment of data protection officers in certain cases‚ and personal data breaches․

For IT managers‚ compliance leads and business owners‚ the question is not whether the organisation has a privacy policy‚ but whether the underlying IT infrastructure can fulfill the obligations of the organisation․

What is UAE PDPL compliance?

The UAE PDPL requires implementing appropriate organizational‚ technical and operational measures that are designed to collect‚ process‚ store‚ secure and/or transfer personal data in accordance with applicable UAE data protection laws․

The PDPL governs the processing of personal data and provides certain obligations for organizations acting as data controllers and data processors․ There are also exceptions and certain situations where processing may be conducted without consent․

According to IT‚ compliance begins with knowledge of the locations and flow of personal data within the organization․

The organisation may have personal information within its email system‚ human resources system‚ customer relationship management system‚ cloud applications‚ databases‚ laptops‚ mobile equipment‚ back-up facilities․ If these systems are poorly managed and secured‚ there may be an important gap between the organisation's privacy policies and the technology environment in which the personal information is contained․

Why UAE PDPL Compliance Is an IT Issue

Data protection obligations cannot solely be satisfied by documentation․

For example‚ if an organization asserts personal information will only be accessed by authorized individuals‚ the IT environment must implement identity management‚ permissioning‚ authentication and access controls that match that organizational policy․

Organisations may have corporate policies on personal data protection‚ but this should be backed up by controls such as encryption‚ secure back-up‚ endpoint protection‚ network security‚ monitoring and incident management․

Consequently‚ compliance with the UAE PDPL requires collaboration between legal and technology experts․

The compliance team can help with the creation of the organisation's obligations and policies‚ and IT teams and technical partners can help with the implementation․

Access Control and Identity Management

One of the most critical parts of IT infrastructure in terms of data protection is access control․

Organizations must establish who has access to personal data‚ why‚ and if they have the appropriate level of access to fulfill their job functions․ Employees should not be granted unrestricted access to systems or data simply because they are employed by an organization․

Successful access control relies upon role-based access control‚ strong authentication‚ account lifecycle management and administrative controls․ Access should be updated or removed as appropriate when an employee joins‚ moves within‚ or leaves the organization․

Privileged accounts are especially notable because hacked administrative credentials can enable attackers to access business systems and private data․

As a result‚ for IT managers‚ performing regular access reviews can be a key part of a data protection programme․

Encrypting And Protecting Personal Data

Encrypting data may lower the risk of exposure from unauthorized access to personal information․

Companies should determine where they store sensitive or private data‚ and where it is being transmitted․ Once identified‚ companies can implement encryption for data stored in servers‚ databases‚ laptops‚ portable devices‚ backup devices‚ cloud environments‚ or even while it is being transferred․

It should also be noted that the goal is not just to procure encryption‚ but to implement and utilize it correctly‚ with appropriate key management‚ access control and systems administration․

Under the UAE PDPL‚ personal data must be protected by technical and organizational measures‚ with information security being part of operational compliance․

Data Residency and International Transfers

The phrase "data residency" is sometimes used in relation to UAE data protection legislation‚ but businesses should not view the PDPL as a general data residency requirement that all personal data must reside within the UAE․

The more relevant point of consideration is whether personal data has been transferred and/or made available outside of the UAE and whether the legal requirements and protections in this respect have been followed․

However‚ this distinction is critical because so many modern organizations use international cloud platforms‚ SaaS applications‚ global support teams and multinational service providers․

Businesses should know where the data will be stored‚ where it can be processed‚ who will be able to access it and also what contractual/technical measures are in place․

Data controllers and processors that are subject to the ADGM Data Protection Regulations 2021 (ADGPDR) are required to comply with requirements concerning international data transfers under ADGPDR‚ including ensuring there are adequate protection‚ safeguards or applicable derogations for international data transfers from the ADGM․

This means that you should not assume that data can be hosted in the given location by the organization․

Cloud Infrastructure and PDPL Compliance

The use of cloud computing does not by itself mean that an organization is non-compliant with the UAE data protection laws․

The problem is how the cloud is managed and configured․

Businesses must also know their cloud architecture‚ data locations‚ access and security controls‚ backup provisions, and their contractual agreements with the cloud service providers and other processors․

This IT partner could examine the cloud environment‚ identify misconfigured services‚ apply security controls‚ and assist in documenting the technology environment․

Therefore‚ data protection should be a central part of cloud migration planning rather than remedial compliance that is sorted out after the cloud migration․

Backup and Data Protection

Although backups are needed for business continuity‚ they can also create additional copies of personal data․

An organisation may have copies of personal information in its production environment but also in local or cloud-based backups and disaster recovery systems or archived datasets․

IT teams should also know what data is in their backups‚ how it is secured‚ who has access to it‚ and how long it is retained․

Backups should also be tested regularly‚ as a backup that cannot be restored when it is needed does not provide resilience․

A backup strategy that fits the business can be an integral part of a wider data protection strategy․

Cybersecurity Controls And Personal Information

Cybersecurity is relevant in light of the PDPL because the security of personal data could be compromised by unauthorized access‚ alteration‚ loss or disclosure․

Additional security measures businesses may implement as part of a data protection strategy include endpoint security‚ firewalls‚ email security‚ network segmentation‚ patch management‚ vulnerability management‚ authentication‚ monitoring and incident response․

No single security product provides complete protection․

Instead‚ organizations need to implement multiple layers of control based on their own risk profile and processing․

For SMEs without security expertise‚ an experienced IT partner or managed security service provider can help to identify the gaps and implement controls without SMEs needing to develop security capabilities in-house․

What Happens If a Data Breach Occurs?

A data breach should not spark merely a technical troubleshooting exercise․

Organisations should have processes to detect what has happened‚ identify what data may be involved‚ contain the incident‚ preserve evidence‚ assess the risk‚ notify the appropriate people‚ and carry out corrective actions․

The UAE PDPL requires controllers to notify the relevant Bureau in the cases prescribed by the applicable framework in case of a personal data breach and likewise allows for notifications to data subjects in the cases prescribed by the applicable framework․

That is why organizations need an incident response before an incident occurs․

IT should know who can declare an incident‚ who investigates it‚ who communicates with other groups such as management and legal/compliance teams‚ how systems can be isolated from the network‚ and how to recover․

Does the UAE PDPL require a data protection officer?

However‚ not every organisation has to assume that it automatically needs to have one․

The UAE PDPL requires that a Data Protection Officer be appointed where the controller or processor undertakes certain processing of personal data which is likely to result in a high risk‚ or where there is large scale processing of sensitive personal data‚ or a systematic or wide-ranging assessment of sensitive personal data․ The Data Protection Officer can be an employee of the controller or processor or someone authorized to carry out duties for and on behalf of the controller or processor in or outside the UAE․

If an organization needs a DPO‚ it is likely to be working closely with its own IT function․

Hence‚ the DPO could oversee compliance‚ review procedures and advise on requests and complaints with regards to data․

UAE PDPL Compliance Checklist for IT Departments

For an IT compliance review‚ the first step is to map where personal data is collected‚ processed‚ stored and transferred․

Review user access‚ privileged accounts‚ authentication‚ encryption‚ endpoint security‚ network security‚ cloud security‚ backup‚ logging and monitoring for effectiveness and suitability for purpose․

It should also consider the time taken to identify and patch security vulnerabilities‚ whether backups are tested‚ how third party providers access personal data and how ex-employees are removed from systems․

The organisation should review its incident response process to establish whether it is able to successfully identify‚ contain and escalate a personal data breach․

Management should ensure the IT documentation matches the IT infrastructure․ A policy that describes controls that do not exist‚ is no assurance that the controls are being followed․

Abu Dhabi and Dubai: Consider the Applicable Regulatory Environment

There is no universal set of requirements that applies to every business operating in the UAE․

In addition to the federal PDPL‚ each business may be subject to industry and free-zone specific laws and other cybersecurity related regulatory frameworks applicable in their relevant jurisdictions․

The ADGM Data Protection Regulations 2021 and the ADGM Data Protection Guidance 2021 apply to data controllers and data processors when they process personal data in the ADGM․ Data controllers in the ADGM must register with the ADGM Data Protection Commissioner‚ and the ADGM has published guidance on matters such as security‚ breaches and international transfers․

Applicable local laws and regulations in Dubai must also be taken into consideration․ The Dubai Cyber Security Strategy published by the Dubai Electronic Security Center (DESC) addresses cybersecurity‚ data privacy and cyber resilience․ Additionally‚ Desc also publishes standards and regulations regarding information and cloud security and other aspects․

The Telecommunications and Digital Government Regulatory Authority provides guidelines on privacy and protection of information and users' data such as security practices and encryption․

The rules businesses must comply with depend on the country‚ the industry they are in and what data they process․

How an IT Partner can Help with PDPL Compliance

An IT services provider cannot replace an organisation's legal or compliance function but it can play an important role in operationalising data protection requirements․

An experienced IT partner can help to assess the infrastructure‚ the cyber security risks‚ access management‚ endpoint and network protection‚ backups‚ cloud security protections‚ and incident detection and response․

If the business does not have a very large internal IT group‚ this can provide access to specialized skills without a large staff increase․

The best way to achieve this is for compliance teams to establish the requirements‚ management to establish risk appetite and business priorities‚ and IT teams or technology partners to deploy and manage the technical controls․

Building a More Secure and Compliant IT Environment

Compliance with the UAE PDPL requires active efforts and cannot be limited to a one-time event․

Technology changes‚ employees come and go‚ and more applications are added․ Cloud services change․ When businesses add a new location‚ supplier, or subcontractor, the ways personal data is processed may change in consequence․

This means that data protection must be considered as an active cycle of assessment‚ implementation‚ monitoring and review․

All of these technical and organizational measures rely on a solid understanding of the business's data․ When organizations understand what personal data they have‚ where that data is located‚ who has access to it‚ and how it moves across the organization‚ only then can controls be put in place․

Frequently Asked Questions

What is UAE PDPL compliance?

UAE PDPL compliance refers to following the requirements of the UAE Personal Data Protection Law when collecting, processing, storing, securing and transferring personal data. It involves both organisational policies and appropriate technical and security measures.

Does the UAE PDPL require all data to be stored in the UAE?

No. The PDPL should not be interpreted as a blanket requirement that all personal data must remain physically within the UAE. International transfers are subject to conditions and safeguards under the applicable framework. Organisations should assess their specific transfer arrangements and regulatory requirements. ADGM has its own rules governing international transfers of personal data.

What IT controls are important for PDPL compliance?

Important controls can include access management, authentication, encryption, endpoint security, network protection, vulnerability and patch management, secure backups, monitoring and incident response. The appropriate controls depend on the organisation's risks, systems and processing activities.

Does the UAE PDPL require a Data Protection Officer?

A DPO is required in specific circumstances, including certain high-risk processing activities and processing involving large volumes of sensitive personal data. Organisations should assess whether the statutory criteria apply to their activities.

What should a company do after a personal data breach?

The organisation should activate its incident response process, contain the incident, assess the affected data and risks, document the incident and coordinate any required regulatory or data-subject notifications. The applicable notification requirements depend on the circumstances and governing regulatory framework.

Does PDPL compliance apply to cloud services?

Cloud services can involve the processing and transfer of personal data, so organisations should assess their cloud architecture, access controls, data locations, security measures, processors and contractual arrangements as part of their compliance programme.

Is the UAE PDPL the only data protection requirement in the UAE?

Not necessarily. The applicable requirements depend on the organisation's location, industry, activities and regulatory environment. Businesses may also be subject to free-zone regimes, sector-specific requirements and local cybersecurity frameworks. For example, ADGM has its own Data Protection Regulations 2021.