Data Protection

The Hadef & Partners’ UAE Data Privacy & Protection Practice specialises in providing advice on the multiple data protection and privacy regimes in effect in the UAE, and the impact of those regimes on both domestic and international clients.

Our data protection lawyers have extensive expertise in advising on the UAE Federal Data Protection Law, the Abu Dhabi Global Markets (ADGM) Data Protection Law and the Dubai International Financial Center (DIFC) Data Protection Law. In addition, our lawyers regularly advise on the UAE’s wider privacy-related laws including industry-specific data laws (such as those relating to financial and health data).

We assist our clients at all stages of their data protection compliance journey and through all aspects of the data cycle. With capabilities beyond just legal analysis, our lawyers have experience in the practical aspects of implementing data privacy, which means we have the ability to bring first-hand experience of the practicalities involved in implementing each relevant UAE data privacy regime.

Firm-wide, our lawyers have experience in almost every sector, including hospitality, F&B, media, broadcast and streaming, energy, utilities, construction, transportation, real estate, tourism, manufacturing, technology, and advertising. This allows us to tailor our advice on an industry-by-industry basis, catering to the fact that personal data uses are often nuanced by industry-specific factors.

In addition, our lawyers have specific expertise in the personal data-heavy areas of education, retail, subscription based products and services, and hospitality and have both legal and practical experience in advising clients in these consumer-facing sectors. Our lawyers also have experience with the privacy aspects of technology applications and can advise on the regulatory and legal ramifications of utilising technology tools and systems, including systems employing generative AI, profiling, and automation to process personal data.

Working closely with the Government and Regulatory team, our lawyers can also provide tailored advice to clients who are working with UAE government entities.

Many of our clients have a global presence, and Hadef & Partners specialises in data transfer compliance on a global scale. Whilst our practice specialises in UAE law, our dual-qualified lawyers can take a holistic view and assist clients, working alongside internal in-house lawyers or preferred in-country law firms, in implementing data transfer documentation that caters to the fact that data typically knows no borders.

We offer internal training sessions tailored to our client’s industry sectors. If you would like to know more about our ‘Introduction to Data Privacy and Protection’ training, please contact us.

• Advising a provider of an online platform that connects patients, medical providers, and medical insurance companies with regard to the application of the UAE Federal Data Protection Law, the Abu Dhabi Global Markets (ADGM) Data Protection law, the UAE’s ICT health data law and other relevant legislation applying to the processing of sensitive health data. Advice included the drafting of a data protection schedule for a software license agreement to be entered into by a US reinsurance conglomerate and preparing a multi-jurisdictional data transfer agreement covering the client’s intragroup data flows to and from Europe, the UAE, the ADGM free zone and a number of African countries.
• Advising an oncology diagnostic and research platform with regard to the relevant regulatory requirements applicable to the transfer of medical tissue samples from the UAE to countries on the sub-continent and the collection and processing of medical oncology-related data pertaining to direct platform users and UAE employees provided with the platform as an employment benefit.
• Advising an EU-based client on the data privacy aspects of transferring candidate data to a group company located in the UAE for the processing of such candidate data for the purposes of vetting such candidates. Advice focused in particular on the application of the General Data Protection Regime to such transfer.
• Advising a leading luxury jewellery provider on the data privacy ramifications of a virtual ‘try it on’ software. Analysis covered the collection and hosting of data, including user photographs, as well as methods in which the data collection could either be minimized or localized to the user’s device.
• Advising a luxury vehicle manufacturer on the legal and regulatory aspects of collecting vehicle tracking data and driver data using SIM technology. Advice included methods to minimize the personal data collected and the application of the UAE consumer protection regime to the subscription based services offered using such collected data.
• Advising a leading brand franchise conglomerate on the adoption of shoe sizing software to assist users in finding the correct shoe sizes in stock.
• Advising a payment platform provider on the data protection regimes applicable to the provision of its payment platform and related payment processing services to a leading provider of business-to-business travel payment solutions and services located in the EU, who intended to use the licensed software to provide corporate payment solutions aimed at managing corporate travel payments, including the issuance of Virtual Credit Cards on the UATP network to customers based in the UAE.
• Advising on the impact of the UAE data privacy regimes on a multi-national restaurant chain’s in-restaurant ordering application and related loyalty scheme.
• Advising a cloud communications ‘platform as a service’ company based in the United States on the risks posed by its third-party data processors and cloud infrastructure providers' non-compliance with applicable UAE data protection regimes.
• Advising a shared e-scooter service company on the data protection regulations applicable to the launch of its shared e-scooter service to users in the UAE.