Abu Dhabi Global Market. Comprehensive data protection. Regulations (free zone)
ADGM DPRADGM Data Protection Regulations 2021
In force
Partly verified
Medium confidence.USD 28m maximum fine not verified from a primary source this session; amendments since 2021 not checked.
§1Summary
- Synopsis
Closely modelled on the GDPR, these regulations govern personal data processing by ADGM-registered entities and within ADGM, with lawful bases, rights, DPIAs, DPO duties, breach notification and transfer controls.
- Key themes
- Unique features
Transfers to onshore UAE are treated as international transfers; 'transfer' includes making data accessible. Controllers must register/pay data protection fees.
- SaaS relevance
SaaS vendors acting as processors for ADGM entities must meet processor contract terms and support transfer safeguards for ADGM data.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Commissioner without undue delay, ≤72h where feasible; data subjects if high risk
- DPO
- Conditional
- Cross-border transfers
- Adequacy / standard clauses / BCRs / codes & certification / derogations; onshore UAE counts as a transfer
- Maximum penalty
- Administrative fines case by case (understood up to USD 28m)
§3Dates
- Key dates
- Adopted
- In force
- Issued 14 Feb 2021 with transition periods; guidance issued Aug 2021
§4Text and authority
- Text
- Authoritative text adgm.com
- Authority
- Commissioner of Data Protection, ADGM Office of Data Protection
§5Where it applies
- Domestic law of
- Abu Dhabi Global Market
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.USD 28m maximum fine not verified from a primary source this session; amendments since 2021 not checked.