Civil Law and UAE — Protective Orders for Sensitive Data

1. Introduction

Protective orders for sensitive data are judicial or procedural measures designed to prevent unnecessary disclosure, misuse, publication, copying, or dissemination of confidential or sensitive information during litigation, arbitration, investigations, or enforcement proceedings.

In the UAE, protection of sensitive data operates through several overlapping legal regimes:

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL);

UAE civil-law principles concerning privacy, confidentiality, good faith and abuse of rights;

procedural rules concerning documentary evidence and disclosure;

sector-specific confidentiality rules, particularly healthcare and financial services;

DIFC Data Protection Law No. 5 of 2020 for DIFC entities;

ADGM Data Protection Regulations 2021 for ADGM entities;

judicial powers to control disclosure, restrict access, order redaction, seal documents and impose confidentiality conditions.

The federal PDPL specifically recognises that personal-data processing may be necessary for bringing or defending legal claims and for judicial or security proceedings. Thus, data protection does not create an absolute privilege against court-ordered disclosure. Instead, courts must reconcile legitimate disclosure with privacy and confidentiality interests. (UAE Legislation)

2. Meaning of Sensitive Data

The protection of sensitive information becomes particularly important where documents contain information concerning matters such as:

health and medical records;

biometric information;

financial information;

identification information;

family and personal information;

employment records;

confidential business information;

banking information;

customer databases;

commercially sensitive information;

information concerning children;

information capable of causing serious harm if disclosed.

Under the federal PDPL framework, processing involving a large volume of Sensitive Personal Data, or systematic and comprehensive assessment of such data, can trigger enhanced compliance considerations, including data-protection impact assessment requirements. (UAE Legislation)

3. What Is a Protective Order?

A protective order is a court-directed mechanism controlling how sensitive material may be handled.

Depending on the circumstances, the court may order:

production only to specified persons;

redaction of irrelevant sensitive information;

inspection rather than unrestricted copying;

documents to be placed under seal;

confidentiality undertakings;

disclosure only to lawyers or experts;

restrictions on onward disclosure;

use of information only for the proceedings;

anonymisation or pseudonymisation;

controlled electronic access;

return or destruction of copies after proceedings;

restrictions on publication.

The basic idea is:

Relevant evidence may be disclosed, but disclosure should be no broader than reasonably necessary.

4. Federal PDPL Framework

The UAE's Federal Decree-Law No. 45 of 2021 is central to the modern data-protection framework.

The law generally prohibits processing personal data without consent, subject to statutory exceptions.

One important exception exists where processing is necessary for:

establishing legal claims;

defending legal claims;

judicial proceedings;

security procedures.

Therefore, litigation can constitute a lawful basis for processing personal information. (UAE Legislation)

However:

Lawful processing for litigation does not mean unrestricted disclosure.

The information should still be handled consistently with applicable privacy, confidentiality, security and procedural requirements.

5. Proportionality

Proportionality is one of the most important principles in protective orders.

The court generally asks:

Question 1

Is the information relevant?

Question 2

Is it material to an issue that must be determined?

Question 3

Is disclosure necessary?

Question 4

Can the same evidential purpose be achieved through a less intrusive method?

Question 5

What harm could disclosure cause?

Question 6

Can redaction or restricted access sufficiently reduce the risk?

The recent DIFC jurisprudence illustrates this approach. In Jonathan Lau v Qashio Holding Company Ltd [2026] DIFC CFI 058, the Court considered proportionality, confidentiality, burden and the risk of overbroad disclosure and accepted targeted production with redaction of irrelevant commercially confidential information. (DIFC Courts)

6. Sensitive Data Does Not Automatically Become Non-Disclosable

This distinction is essential.

A party cannot simply say:

“This document contains personal information, therefore I do not have to disclose it.”

The court may conclude that disclosure is necessary for determining the dispute.

In Ahmed Seddiq Mohamed Samea Almutawa v Mohamed Seddiq Mohamed Samea Al Mutawa [2023] DIFC CFI 095, the Court stated that confidentiality or commercial sensitivity alone generally does not justify refusing production. The court may balance the need for disclosure against the harm from disclosure and may impose protective measures such as confidentiality agreements or restricted access. (DIFC Courts)

Thus:

Sensitive ≠ automatically privileged

and

Confidential ≠ automatically immune from disclosure.

7. Redaction as a Protective Measure

Redaction is often the least intrusive solution.

For example, a bank statement may contain:

transactions relevant to the dispute;

unrelated medical payments;

family transactions;

third-party names;

account numbers.

The court may order:

Relevant transaction information → disclosed

while:

Irrelevant personal information → redacted.

This preserves the evidentiary value while reducing privacy intrusion.

The 2026 Jonathan Lau decision specifically illustrates the use of targeted requests and redaction for commercially confidential material unrelated to the proceedings. (DIFC Courts)

8. Confidentiality Club

A confidentiality club is a particularly useful mechanism in commercial litigation.

Access to sensitive documents may be restricted to:

specified lawyers;

named experts;

a limited number of representatives;

the court;

persons specifically authorised by the court.

The information cannot then be freely circulated throughout the organisation.

This is particularly useful for:

trade secrets;

customer databases;

financial records;

pricing information;

proprietary algorithms;

medical records.

9. Sealing of Documents

A court may also order sensitive material to be:

filed under seal

rather than becoming generally accessible.

This is particularly appropriate for information involving:

patient identities;

confidential banking information;

commercially sensitive customer lists;

national-security material;

highly private personal information.

In Ahli United Bank B.S.C. v N/A [2018] DIFC CFI 068, the DIFC Court ordered sensitive client and counterparty identities to be treated as confidential information, held under seal by the Court Registry, with publication restricted. (DIFC Courts)

This demonstrates how a court can protect sensitive information without preventing its use in proceedings.

10. Healthcare Data

Healthcare information requires particularly careful protection.

Medical records may include:

diagnoses;

treatment;

medical history;

patient identity;

financial information;

insurance information.

In Health Bay Investment in Healthcare Enterprises & Development LLC v Dr Kamal Akkach [2019] DIFC CFI 087, the DIFC Court adopted a detailed confidentiality protocol for documents containing patient information, including medical records, names, email addresses and financial information. Access to unredacted documents was restricted to authorised persons, who were required to maintain strict confidentiality and use the information solely for the proceedings. (DIFC Courts)

This is one of the most useful UAE-related authorities for examination purposes.

11. Financial and Banking Data

Bank statements and financial records can contain extensive sensitive information.

They may reveal:

income;

expenditure;

investments;

family relationships;

account numbers;

third-party transactions;

commercial relationships.

The court must therefore balance:

right to relevant evidence

against

privacy and confidentiality.

In Thamer Abdulaziz Albulaihid & Moustafa El Sayed Abdulghani El Shafaei v Nasser Shehata & Health Insights FZ-LLC [2026] DIFC CFI 079/2023, the Court considered objections concerning sensitive personal information in bank statements. The Court recognised that the statements were central to testing the account and that a confidentiality protocol could not be used to prevent necessary examination of relevant evidence. (DIFC Courts)

12. Personal Data Access and Litigation

An important authority is:

Dubai Financial Services Authority v Commissioner of Data Protection & Anna Waterhouse

DIFC CFI 051/2018 and CFI 085/2018

This litigation concerned access to personal data under the DIFC Data Protection Law.

The Court considered the scope of a data subject's right to access personal data and the relationship between data-access rights and regulatory investigations.

The Court recognised that personal-data rights are not simply a mechanism for obtaining every document connected with a person or every document potentially useful in litigation. (DIFC Courts)

Principle

A request for personal data must be distinguished from a general request for disclosure of documents.

This distinction is highly important:

Data-subject access right ≠ unrestricted litigation discovery right.

13. Six Important Case Laws

Case 1 — DFSA v Commissioner of Data Protection & Anna Waterhouse

DIFC CFI 051/2018 & CFI 085/2018

Principle

Personal-data access rights must be distinguished from general discovery.

The case also demonstrates the need to consider confidentiality and information obtained from third parties when determining whether disclosure should be ordered. (DIFC Courts)

Importance

It is a leading UAE/DIFC authority for understanding the interaction between:

data protection + disclosure + regulatory confidentiality.

Case 2 — Health Bay Investment in Healthcare Enterprises & Development LLC v Dr Kamal Akkach

[2019] DIFC CFI 087

Principle

The Court created detailed safeguards for sensitive healthcare information.

Protective measures included:

identifying confidential information;

redacting sensitive portions;

limiting access to authorised persons;

confidentiality obligations;

restricting use to the litigation.

(DIFC Courts)

Importance

This is especially relevant to medical-data protective orders.

Case 3 — Ahli United Bank B.S.C. v N/A

[2018] DIFC CFI 068

Principle

Sensitive client and counterparty identities could be treated as confidential and maintained under seal.

Publication was restricted and access was controlled through the Court Registry. (DIFC Courts)

Importance

The case demonstrates:

confidentiality + sealing + restricted court access.

Case 4 — Ahmed Seddiq Mohamed Samea Almutawa v Mohamed Seddiq Mohamed Samea Al Mutawa

[2023] DIFC CFI 095

Principle

Confidentiality or commercial sensitivity alone does not automatically justify refusing disclosure.

The Court recognised that protective mechanisms can be used where disclosure is necessary, including:

confidentiality agreements;

restricted access;

controlled disclosure.

(DIFC Courts)

Importance

This case establishes the central balancing approach:

Disclosure where necessary + protection where possible.

Case 5 — Jonathan Lau v Qashio Holding Company Ltd & Anor

[2026] DIFC CFI 058

Principle

The Court considered proportionality, burden, confidentiality and the danger of unnecessarily broad document requests.

It accepted targeted production and permitted redaction of commercially confidential information that was unrelated to the dispute. (DIFC Courts)

Importance

This is a particularly useful current authority for proportionality in protective disclosure orders.

Case 6 — Thamer Abdulaziz Albulaihid & Moustafa El Sayed Abdulghani El Shafaei v Nasser Shehata & Health Insights FZ-LLC

[2026] DIFC CFI 079/2023

Principle

The case concerned sensitive personal information contained in bank statements.

The Court treated the financial records as important evidence where they were central to testing an account and did not permit confidentiality concerns to eliminate necessary evidential examination. (DIFC Courts)

Importance

The case illustrates the balance between:

financial privacy ↔ evidential necessity.

Case 7 — Nevon v Nader

[2024] DIFC SCT 158

The case involved allegations concerning confidentiality and mishandling of sensitive information relating to an introducing-broker account, together with deletion of company data.

The case illustrates that mishandling sensitive information can have consequences within an employment and contractual relationship. (DIFC Courts)

Importance

It is useful for demonstrating that sensitive-data protection is not confined to court disclosure; contractual and employment duties may also protect confidential information.

14. Protective Orders and Legal Privilege

Protective orders must be distinguished from legal professional privilege.

Privilege can prevent disclosure because the law protects the communication itself.

Confidentiality, by contrast, does not necessarily prevent disclosure.

In Ahmed Seddiq Almutawa, the DIFC Court emphasised that a party claiming legal professional privilege must properly establish the basis for the claim rather than assuming all communications with legal advisers are privileged. (DIFC Courts)

Therefore:

15. Protective Orders and Electronic Evidence

Modern disputes increasingly involve:

WhatsApp messages;

emails;

cloud records;

CCTV;

mobile-phone data;

databases;

metadata;

social-media records;

biometric information;

AI-generated material.

The risk of uncontrolled copying is much greater with electronic information.

Therefore, a protective order can specify:

who receives the data;

permitted purposes;

permitted storage;

copying restrictions;

redaction;

encryption;

destruction/return;

expert access;

prohibition on onward disclosure.

16. Protective Orders and AI

AI creates a new dimension.

Sensitive litigation material should not automatically be uploaded to:

public AI systems;

external generative-AI tools;

third-party cloud systems;

uncontrolled document-processing platforms.

The DIFC Courts' guidance on generative AI specifically instructs practitioners to protect client confidentiality and comply with applicable data-protection law when using generative AI in proceedings. (DIFC Courts)

This is increasingly important where court files contain:

medical records;

banking information;

trade secrets;

personal identifiers;

privileged communications.

17. Protective Orders and Third-Party Data

A document may contain information belonging to someone who is not a party.

For example:

A company produces its employee database.

The database contains information concerning 5,000 employees.

The court may determine that the relevant employee information should be produced, but may require:

anonymisation;

redaction;

restricted access;

confidentiality undertakings.

This prevents the litigation process from becoming a mechanism for unnecessary disclosure of unrelated individuals' information.

18. Public Interest and Sensitive Information

Some information may also raise public-interest immunity concerns.

In Ahmed Seddiq Almutawa, the DIFC Court considered public-interest immunity arguments relating to government-sensitive material and explained that the party asserting the immunity must establish why disclosure would harm the public interest. (DIFC Courts)

Thus, the protective-order analysis can involve three competing interests:

private confidentiality

versus

litigation necessity

versus

public interest.

19. Proportionality Test for UAE Courts

A useful legal test is:

1. Relevance

Does the data relate to an issue in dispute?

2. Materiality

Could it affect the determination of the case?

3. Necessity

Is production actually necessary?

4. Privacy

What privacy interest does the information contain?

5. Harm

What harm could disclosure cause?

6. Alternatives

Can redaction, anonymisation or restricted access solve the problem?

7. Scope

Can the request be narrowed?

8. Access

Who actually needs to see the unredacted material?

9. Purpose

Will the information be used only for the proceedings?

10. Duration

How long should the protective restriction continue?

20. Types of Protective Orders

21. Civil-Law Principles Supporting Protection

Protective orders fit within broader UAE civil-law principles.

A. Good Faith

Parties should exercise contractual and procedural rights consistently with good faith.

B. No Abuse of Rights

A legitimate procedural right should not be exercised merely to cause unnecessary harm.

C. Protection of Privacy

Personal information deserves protection against unnecessary dissemination.

D. Proportionality

Disclosure should correspond to the legitimate evidential requirement.

E. Compensation for Wrongful Disclosure

Where unlawful processing or disclosure causes legally recognised damage, applicable civil and data-protection remedies may become relevant.

22. Practical Example

Suppose an employee brings a UAE employment claim alleging unlawful termination.

The employer has:

salary records;

medical records;

WhatsApp messages;

bank details;

performance reviews.

The employee requests all documents.

The court may determine:

Salary records

Relevant → disclose.

Performance reviews

Potentially relevant → disclose.

Medical records

Sensitive → disclose only if necessary, potentially under restricted access/redaction.

Personal bank transactions unrelated to salary

Usually unnecessary → potentially redact or exclude.

Private WhatsApp messages unrelated to employment

Potentially irrelevant → should not automatically be disclosed.

This demonstrates:

Relevance + necessity + proportionality + protective mechanism.

23. Relationship Between PDPL and Civil Procedure

The correct approach is not:

“PDPL always prevents disclosure.”

Nor is it:

“Court proceedings eliminate data protection.”

Instead:

The judicial process provides a lawful context for necessary processing, while data-protection and confidentiality principles continue to influence how the information is collected, disclosed, secured and used.

The federal PDPL expressly recognises processing necessary for legal claims and judicial/security proceedings. (UAE Legislation)

24. Important Exam Distinctions

Sensitive Data vs Confidential Data

Sensitive data concerns the nature of the information.

Confidential data concerns the obligation or circumstances restricting disclosure.

They can overlap but are not identical.

Confidentiality vs Privilege

Confidentiality does not automatically create privilege.

Privacy vs Relevance

Private information may still have to be disclosed if legally relevant and necessary.

Disclosure vs Publication

A court may permit disclosure to parties while prohibiting publication to the general public.

Production vs Unrestricted Access

A document can be produced subject to strict access restrictions.

25. Current UAE Legal Position

As of 2026, UAE sensitive-data protection is best understood as a multi-layered system:

Federal PDPL

↓

Civil and privacy principles

↓

Procedural disclosure rules

↓

Sector-specific confidentiality

↓

DIFC/ADGM special data regimes where applicable

↓

Court-specific protective orders

This means the appropriate protection depends on:

where the dispute is heard;

where the data controller operates;

the nature of the data;

the sector;

whether the data is required as evidence;

whether third-party information is involved;

whether disclosure creates disproportionate harm.

26. Case-Law Revision Table

27. Exam-Ready Principles

For an examination, remember these 10 principles:

Sensitive data receives heightened protection.

PDPL does not create absolute immunity from judicial disclosure.

Legal proceedings can provide a lawful basis for necessary processing.

Relevance and necessity are central to disclosure.

Confidentiality alone does not always defeat production.

Courts can use redaction to minimise privacy intrusion.

Courts can restrict access to authorised persons.

Sensitive documents can be sealed.

Healthcare and financial data receive particularly careful treatment.

The governing principle is controlled disclosure rather than automatic non-disclosure.

Short Formula

Sensitive Data → Relevance → Necessity → Proportionality → Least Intrusive Disclosure → Redaction/Anonymisation → Restricted Access → Confidentiality → Secure Use

Conclusion

UAE law increasingly treats protection of sensitive data as a matter of controlled and proportionate information governance rather than absolute secrecy. The federal PDPL provides the overarching personal-data framework, while UAE courts—particularly the DIFC Courts in the reported authorities—have developed practical mechanisms such as sealed documents, redaction, confidentiality undertakings, restricted-access protocols and targeted disclosure orders. The central objective is to allow courts access to evidence necessary to decide disputes while minimising unnecessary intrusion into privacy, commercial confidentiality and third-party interests. (UAE Legislation)