Applicability of Data Protection Law in UAE Mainland: Location of Individual Who Processes Data

The "Location of Individual Who Processes Data" factor examines whether data protection laws apply to individuals who process personal data while physically present in the UAE Mainland, irrespective of their usual residence or the data subject's location.

Text of Relevant Provisions

Referenced Provision(s):

"The provisions of this Decree Law shall apply to the Processing of Personal Data, whether totally or partially, through automatically operated electronic systems or other means, by: (a) any Data Subject who resides or has a place of business in the State." Original (Language):"تسري أحكام هذا المرسوم بقانون على معالجة البيانات الشخصية سواء كلها أو جزء منها عن طريق وسائل الأنظمة الإلكترونية التي تعمل بشكل تلقائي وآلي، أو غيرها من الوسائل الأخرى، وذلك من قبل: (أ) كل صاحب بيانات يقيم في الدولة أو له مقر عمل فيها"

Analysis of Provisions

The Location of Individual Who Processes Data factor is not explicitly addressed in the UAE Federal PDPL as presented. The provisions outlined in Article 2(1)(a) of the UAE Federal PDPL primarily focus on the residency or business presence of the data subject, rather than the physical location of the data processor.

Key points of the provision include:

• Applicability to Data Subjects: Article 2(1)(a) states that the Decree Law applies to any data subject who resides or has a place of business in the State. This implies that the scope of the law is oriented towards data subjects who are located within the UAE rather than specifying the application based on the location of the data processor.

Given the current provision:

• There is no direct mention of the applicability of the law to individuals who process data while temporarily present in the UAE if they are not ordinarily resident there. The law seems to apply to data subjects within the UAE and does not explicitly cover data processors who are physically present but not ordinarily resident in the UAE.

Implications

For businesses and individuals:

• Limited Applicability: As it stands, the Federal PDPL does not explicitly extend to data processors based on their physical presence in the UAE if they are not ordinarily resident. This might limit the law's applicability to scenarios where the data processing activities are performed by entities or individuals with established residency or business presence in the UAE.
• Compliance Considerations: Businesses should be aware that the lack of explicit provisions related to the location of data processors may necessitate additional measures to ensure compliance if their operations involve data processors who are temporarily present in the UAE.

Examples:

• Applicable: A UAE-based company processing data of UAE residents will be covered under the PDPL.
• Not Applicable: An international data processor working temporarily in the UAE without any business presence or residency may not fall under the current scope of the PDPL based on the provisions provided.

This factor's absence in the specific provisions suggests a narrower scope of applicability, focusing on data subjects' location within the UAE rather than the data processors' physical presence alone.