Obligations Placed on Controllers and Processors

Articles 7 and 8 of the UAE PDPL establish the general obligations of data controllers and processors, respectively, in handling personal data.

Under Article 7, a controller is required to implement technical and organizational measures to ensure the confidentiality, integrity, and security of personal data. These measures must align with the nature and scope of processing activities and the associated risks. The controller must adopt methods like pseudonymization and set technical defaults that ensure data processing is limited to its intended purpose. They are also tasked with maintaining detailed records of processing activities, covering information such as categories of personal data, processing timelines, and cross-border data transfers. Appointing processors with adequate safeguards to meet legal standards is another essential obligation. Controllers must also cooperate with the UAE Data Bureau when required and provide any necessary documentation related to their data processing activities.

Article 8 outlines the responsibilities of processors, emphasizing adherence to the controller’s instructions and contractual agreements. Processors must implement suitable safeguards for protecting personal data, considering costs and the nature of processing. They are required to process data only for the agreed purposes and duration, and notify controllers if an extension is needed. Upon completion of processing, processors must erase the data or transfer it back to the controller. To prevent unauthorized disclosures, processors must secure both the data and the systems used for its processing. They are also obligated to maintain a comprehensive record of their processing activities and provide evidence of compliance with legal requirements to controllers or the Bureau upon request. If multiple processors are involved, a written agreement must define their responsibilities to avoid joint liability.

These articles collectively aim to establish a robust framework for ensuring the protection of personal data in line with international standards, assigning clear roles and responsibilities to controllers and processors.

Conclusion

The UAE PDPL marks a significant milestone in the nation’s journey toward establishing a secure and progressive data governance framework.

The PDPL not only safeguards individuals’ privacy rights but also provides organizations with a clear and structured framework to manage personal data responsibly. Through its comprehensive provisions on data processing, cross-border transfers, and compliance requirements, the law empowers businesses to innovate, while also prioritizing data protection.