Abu Dhabi Global Market (ADGM): what the rules require

The policy must identify the controller, the purposes and description of processing, recipients or disclosures, retention, and data subject rights, and be available before or at the time data is collected.

Basis: Saudi PDPL Article 12 (privacy policy before collection); DIFC Law Articles 29 and 30; Oman Executive Regulations (notice before processing, including DPO details); Qatar PDPPL (notice before processing); ADGM and UAE PDPL transparency duties.

How to meet it: Open the policy with the legal name and contact details of the controller, then list purposes, data categories, recipients, retention periods and rights. For Saudi users publish it in Arabic and English and make it available before any data is collected.

The policy must state the lawful basis relied on for each processing purpose, such as consent, contract, legal obligation or, where available, legitimate interests.

Basis: DIFC Law Article 29 requires notices to state the lawful basis; UAE PDPL Articles 4 to 6 set consent plus listed exceptions with no general legitimate interests basis; Saudi PDPL Article 5 makes consent the default basis unless an exception applies.

How to meet it: Add a table mapping each purpose to its lawful basis. Do not cite legitimate interests for onshore UAE, Saudi or Oman processing unless the law expressly allows that ground.

Where consent is used, the policy must tell people they can withdraw consent at any time, explain how, and state that withdrawal does not affect earlier lawful processing.

Basis: Saudi PDPL Article 5(2); DIFC Law Articles 12(5) and 32; UAE PDPL consent provisions; Bahrain Resolution No. 48 of 2022 (withdrawal at any time without cost); Qatar PDPPL (right to withdraw approval); Oman PDPL (right to revoke consent).

How to meet it: Add a sentence such as: You can withdraw your consent at any time, free of charge, by [method]; this does not affect processing carried out before withdrawal. Set up an internal procedure to act on requests.

The policy must explain that individuals can request access to, or a copy or summary of, their personal data and how it is processed, and how to submit that request.

Basis: DPDP Act Section 11; UAE PDPL Articles 13 to 18; DIFC Law Article 33(1) (free, within one month); Saudi PDPL Article 4; Qatar PDPPL (right to review); Oman PDPL (right to obtain a copy); ADGM and Bahrain PDPL access rights.

How to meet it: List access as a named right with the request channel, identity checks and expected response time, for example one month in DIFC and 30 days under Qatar guidelines.

The policy must explain how individuals can ask for inaccurate data to be corrected or updated and for data to be erased, and when erasure may be refused.

Basis: DPDP Act Section 12; DIFC Law Article 33(2); Saudi PDPL Article 4; UAE PDPL Articles 13 to 18; Qatar PDPPL (alter or delete); Oman PDPL (rectify, update, erase, block); ADGM rights to correction and deletion.

How to meet it: Add named sections for correction and erasure, the request method, and the legal grounds for refusing erasure (for example legal retention duties).

The policy must explain the right to object to certain processing and, where available, to restrict processing, and how to exercise it.

Basis: DIFC Law Articles 34 and 35; UAE PDPL Articles 13 to 18 (restriction and objection); ADGM rights to restrict and object; Qatar PDPPL (objection to unnecessary or discriminatory processing); Bahrain PDPL (right to object in certain circumstances).

How to meet it: Add a short section on objecting and restricting processing, including an unconditional right to object to direct marketing where applicable.

The policy must explain that individuals can receive data they provided in a structured, commonly used, machine-readable format, or have it transmitted to another controller where the law allows.

Basis: DIFC Law Article 37; UAE PDPL Articles 13 to 18; ADGM portability right; Saudi PDPL Article 4; Oman PDPL portability right.

How to meet it: Add a portability section that names the export format (for example CSV or JSON) and explains how to request direct transfer to another provider.

The policy must state how long each category of data is kept, or the criteria used, and that data is deleted or anonymised once no longer needed.

Basis: Saudi PDPL Article 18 (destroy data when no longer necessary); DIFC Law Article 22 (delete, anonymise or archive when the basis ends); Oman PDPL fines retention violations; UAE PDPL, ADGM, Qatar and Bahrain storage limitation duties.

How to meet it: Add a retention table by data category with periods or criteria, plus the method of secure deletion or anonymisation at the end of the period.

The policy must describe the technical and organisational measures used to protect personal data, such as encryption, access control, logging, backups and staff confidentiality.

Basis: DPDP Act Section 8(5) and Rule 6; Saudi PDPL Article 19; Qatar PDPPL Article 13 (cited by NCSA in Binding Decision No. 3 of 2025); DIFC, ADGM, UAE, Bahrain and Oman security obligations.

How to meet it: Add a security section naming the main controls (encryption in transit and at rest, role-based access, logging and monitoring, backups, staff training). Avoid absolute promises such as 100 percent secure.

The policy must commit to notifying the regulator within 72 hours of becoming aware of a qualifying breach (ADGM Commissioner, SDAIA, Qatar NCSA, Bahrain PDPA or Oman MTCIT) and to informing affected individuals.

Basis: ADGM Data Protection Regulations 2021; Saudi PDPL Article 20 and Implementing Regulations (via the National Data Governance Platform); Qatar regulator guidelines and PDPPL Article 14; Bahrain Resolution No. 43 of 2022; Oman Executive Regulations (individuals also within 72 hours where severe harm is likely).

How to meet it: Add a breach clause with a 72-hour regulator deadline, the named regulator for each country, reasons for any delay and notice to affected individuals. For Oman, also tell individuals within 72 hours when severe damage is likely.

The policy must disclose transfers outside the free zone and whether each relies on an adequacy decision, appropriate safeguards such as standard contractual clauses, or a specific derogation.

Basis: DIFC Law Articles 26 and 27; ADGM Data Protection Regulations 2021 (onshore UAE is not adequate for ADGM purposes).

How to meet it: Add a transfers section listing destination countries and the mechanism used (adequacy, safeguards or derogation), and note that transfers to onshore UAE from ADGM need safeguards.

The policy must state that processors and vendors handle personal data only under a binding written contract covering instructions, security, confidentiality, sub-processing and deletion or return.

Basis: DPDP Act Section 8(2) (processors only under a valid contract); UAE PDPL Article 8; DIFC Law Article 24 (written agreement, prior authorisation for sub-processors); ADGM written contract duty; Bahrain PDPL Article 8.

How to meet it: Add a vendors section describing the categories of processors used, the written data processing agreements in place, sub-processor approval and that vendors must notify you of breaches without undue delay.

The policy must give contact details for the data protection officer where one is required, and Oman requires every controller to appoint one.

Basis: UAE PDPL Articles 10 and 11 (high-risk or large-scale sensitive processing); DIFC Law Articles 16 to 18; ADGM Regulations (exemption for under five employees unless high risk); Saudi PDPL Article 30 and Implementing Regulations (public bodies, large-scale monitoring, sensitive data); Oman Executive Regulations (mandatory, contact details public).

How to meet it: Add a DPO contact block (name or role, email, address). In Oman appoint a DPO in all cases and preferably locate them in Oman.

The policy framework must commit to maintaining a written record of processing activities covering purposes, data categories, recipients, transfers and retention.

Basis: UAE PDPL Articles 7(4) and 8(7); DIFC Law Article 15; ADGM Regulations; Saudi PDPL Article 31 (records kept for five years after processing ends); Qatar regulator guidelines; Oman Executive Regulations.

How to meet it: Add an accountability statement that the company maintains a record of processing activities, reviews it regularly and, for Saudi operations, keeps records for five years after processing ends.

The policy framework must require a data protection impact assessment before high-risk processing, new technologies, large-scale sensitive data or data exports.

Basis: UAE PDPL Article 21; DIFC Law Article 20; ADGM Regulations; Saudi PDPL Article 22; Qatar regulator guidelines (failure reported to attract a QAR 1 million fine).

How to meet it: State when a DPIA is triggered (high risk, new technology, sensitive data at scale, transfers), who approves it, and that it is completed before processing starts.

The policy must explain which cookies and trackers are used, their purposes and providers, and how users accept, refuse or withdraw consent for non-essential ones.

Basis: No dedicated cookie law was verified in these jurisdictions (DLA Piper confirms none in Saudi Arabia), so general notice and consent rules apply; Bahrain Resolution No. 48 of 2022 says consent required as a condition of browsing is invalid, and DPDP Section 9(3) bans tracking of children.

How to meet it: Add a cookie section or separate cookie policy listing cookies by category, purpose, provider and duration, with a banner that lets users refuse non-essential cookies as easily as they accept them.

The policy must identify any sensitive data processed, such as health, biometric, genetic, religious, ethnic, criminal or (in Saudi Arabia) credit and location data, and the extra conditions and safeguards applied.

Basis: DIFC Law Article 11; UAE PDPL sensitive data rules; Saudi PDPL Articles 23 and 24 (health and credit data controls) and Article 26 (no marketing use of sensitive data); ADGM policy document duty; Bahrain PDPL Article 5; Qatar and Oman special data rules.

How to meet it: List each sensitive category processed with its purpose, legal condition (often explicit consent) and extra safeguards such as restricted access.

The policy must disclose any solely automated decisions with legal or similarly significant effects and explain the right to object and to request human review.

Basis: DIFC Law Article 38; UAE PDPL Articles 13 to 18 (objection to automated processing); ADGM right to object to certain automated decision-making.

How to meet it: Describe each automated decision or profiling activity, its logic and effects in plain terms, and how users can object and get a human review.

The compliance policy must confirm that processing has been registered or notified to the regulator (DIFC or ADGM Commissioner, or Bahrain PDPA) and that the filing is kept current or renewed annually with any fee paid.

Basis: DIFC Law Article 14(7) (register by filing a notification of processing operations and keep it current; failure to renew is the most common fine); ADGM Regulations (annual notification and data protection fee); Bahrain PDPL Article 14 (notify the Authority before processing).

How to meet it: Record the notification reference and renewal date, and assign an owner to renew it each year and update it when processing changes.