CIVIL LAW AND UAE: SIMPLE DATA PROTECTION IDEAS

1. Meaning of Data Protection

Data protection means protecting information relating to an identifiable person from:

unlawful collection;

unnecessary use;

unauthorised disclosure;

loss;

destruction;

alteration;

misuse; and

unauthorised access.

Examples of personal data include:

name;

Emirates ID information;

passport details;

telephone number;

email address;

location information;

photographs;

financial information;

employment information;

online identifiers;

biometric information;

health information.

In the UAE, data protection is not simply an IT issue. It can create civil, contractual, regulatory and potentially other legal consequences.

2. Main UAE Data Protection Law

The principal mainland UAE framework is the:

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

The law establishes a general framework for protecting personal data and regulating its processing.

However, certain sectors and free zones have separate or additional rules.

Therefore, the first question should be:

Which data-protection regime applies?

3. Simple Data Protection Formula

Remember:

COLLECT → PURPOSE → USE → PROTECT → RETAIN → DELETE

A business should generally know:

What data it collects.

Why it collects it.

How it will use it.

Who can access it.

How it will protect it.

How long it should retain it.

When it should delete or anonymise it.

4. Idea 1: Personal Data Should Have a Lawful Basis

A business should not simply collect personal information because it might be useful later.

There should be a legally recognised basis for processing.

Depending on the applicable framework, processing may be connected to matters such as:

consent;

contractual necessity;

legal obligations;

legitimate interests where recognised;

protection of vital interests;

public-interest functions; or

other statutory grounds.

Example

An employer needs an employee's bank information to process salary payments.

The employer has a legitimate business and legal reason for processing that information.

But collecting the employee's private family photographs for an unrelated marketing campaign would require a different legal analysis.

5. Idea 2: Purpose Limitation

Personal data should be collected for a legitimate and identified purpose.

Example

A hotel collects:

passport information;

contact information;

booking information.

The information is collected for legitimate operational and legal purposes.

The hotel should not automatically assume that it can sell the customer's information to unrelated businesses.

The principle can be remembered as:

Collect for Purpose A ≠ Automatically Use for Purpose B.

6. Idea 3: Data Minimisation

A business should avoid collecting excessive information.

Example

Suppose an online shop needs:

name;

delivery address;

telephone number.

It may not need to collect:

complete medical history;

unrelated employment records;

private family information.

The basic principle is:

Collect what is reasonably necessary for the lawful purpose.

7. Idea 4: Accuracy

Personal data should be accurate and, where necessary, updated.

Incorrect information can cause real harm.

Example

A bank's system incorrectly records that a customer has committed fraud.

If that information is shared internally or with another institution, the customer could suffer:

account restrictions;

reputational damage;

financial loss;

difficulty obtaining services.

Therefore, accuracy is an important part of responsible data processing.

8. Idea 5: Security

Businesses must protect personal data against unauthorised access and other security risks.

Security measures can include:

passwords;

encryption;

access controls;

multi-factor authentication;

network security;

employee training;

secure backups;

logging;

incident-response procedures.

Security should not be understood as merely buying cybersecurity software.

It also involves:

People + Processes + Technology.

9. Idea 6: Access Control

Not every employee should have access to every database.

Example

An HR employee may need:

salary information;

employment records;

contact information.

The same employee may not need unrestricted access to:

customer credit-card information;

medical records of unrelated employees;

executive correspondence.

Therefore:

Need-to-know access is a practical data-protection principle.

10. Idea 7: Transparency

People should generally understand:

who is collecting their information;

what is being collected;

why it is being collected;

how it will be used;

whether it will be shared;

relevant retention arrangements; and

applicable rights.

This is commonly achieved through:

privacy notices;

consent forms where appropriate;

contractual notices;

website privacy policies.

11. Idea 8: Data Subject Rights

Data-protection laws generally give individuals rights concerning their personal information.

Depending on the applicable UAE regime and circumstances, these can include rights relating to:

information;

access;

correction;

deletion;

restriction;

objection;

portability or similar rights where applicable.

The exact right and procedure must be checked under the particular regime.

A particularly clear example appears in DIFC case law.

In Dubai Financial Services Authority v Commissioner of Data Protection & Anna Waterhouse [2018] DIFC CFI 051/085, the Court considered a data subject's request for access to personal data held by a data controller. The DIFC framework then in force gave a data subject rights to obtain information about processing and, in appropriate circumstances, rectification, erasure or blocking. (DIFC Courts)

12. Idea 9: Data Protection Is Different From General Confidentiality

The concepts overlap but are not identical.

Data protection

Concerned with lawful processing of personal data.

Confidentiality

Concerned with preventing information from being improperly disclosed or used.

Example

A company's confidential business strategy may not necessarily be personal data.

A customer's name and medical information may be personal data and also confidential information.

Therefore:

Personal data can be confidential, but not every confidential document is personal data.

13. Idea 10: Sensitive Personal Data Requires Greater Care

Certain information can create significantly greater risks to individuals.

Examples can include:

health information;

biometric information;

genetic information;

financial information;

identification information.

Organisations should therefore apply stronger safeguards where the nature of the data creates greater risk.

14. Idea 11: Employee Data Protection

Employers process large quantities of personal data.

Examples:

recruitment information;

CVs;

Emirates ID/passport information;

salary data;

attendance records;

performance information;

disciplinary records;

medical information.

The employer should establish:

lawful purposes;

access controls;

retention policies;

employee privacy notices;

secure storage;

procedures for responding to data requests.

A useful principle is:

Employment does not eliminate privacy and data-protection obligations.

15. Idea 12: Customer Data Protection

Businesses commonly hold:

customer names;

phone numbers;

addresses;

purchase history;

payment information;

preferences;

online activity.

Customer databases should not be treated as completely unrestricted corporate property.

The business must consider:

purpose;

lawful processing;

security;

disclosure;

retention;

data-subject rights.

16. Idea 13: Data Breach

A data breach may occur when personal information is:

stolen;

accidentally disclosed;

sent to the wrong person;

hacked;

lost;

accessed without authorisation;

improperly copied.

Example

An employee accidentally emails a spreadsheet containing 10,000 customers' personal information to the wrong external recipient.

The organisation should immediately consider:

What information was disclosed?

How many individuals are affected?

How serious is the risk?

Can the disclosure be contained?

Is notification required?

What remedial measures are necessary?

How can recurrence be prevented?

17. Idea 14: Privacy by Design

A modern data-protection system should consider privacy before a system is launched.

Example

A company develops an AI recruitment platform.

Instead of collecting everything and worrying about privacy later, it should ask at the design stage:

What information does the AI actually need?

Can unnecessary information be removed?

Who can access applicant data?

How long will data be retained?

How are automated decisions explained?

How are errors corrected?

Can applicants exercise their rights?

Thus:

Privacy should be designed into the system, not added after the problem occurs.

18. Idea 15: AI and Data Protection

AI systems can create special data-protection problems.

Examples include:

automated profiling;

facial recognition;

employee monitoring;

predictive recruitment;

customer scoring;

behavioural analysis;

generative AI systems;

biometric identification.

The organisation should ask:

What data is being used?

Why is it being used?

Is the processing lawful?

Is the information accurate?

Can the decision be challenged?

Is unnecessary personal information being retained?

19. Idea 16: Data Transfers

Modern companies often transfer information:

UAE → cloud provider → foreign data centre → international vendor

Cross-border transfers therefore require careful examination under the applicable UAE data-protection regime.

The organisation should determine:

whether the transfer is legally permitted;

whether adequate protection exists;

whether contractual safeguards are required;

whether consent or another lawful basis is relevant;

whether the recipient can protect the information.

20. Idea 17: Data Retention

Keeping data forever is not necessarily appropriate.

A company should establish retention periods based on:

legal obligations;

contractual requirements;

legitimate operational needs;

litigation requirements;

regulatory requirements;

the nature and sensitivity of the information.

The DIFC Courts' current privacy notice provides a practical illustration: it states that personal data may be retained for periods ranging from five years to indefinitely depending on factors including the nature of the data, the service, legal obligations and legitimate interests. (DIFC Courts)

21. Idea 18: Third-Party Processors

A business may outsource data processing to:

cloud providers;

payroll companies;

marketing agencies;

IT providers;

HR platforms;

AI vendors;

customer-service providers.

The business should not assume that outsourcing eliminates its responsibilities.

Contracts with service providers should address:

permitted processing;

confidentiality;

security;

access;

breach reporting;

deletion/return of data;

subcontractors;

cross-border transfers.

22. Idea 19: Data Protection and Civil Liability

A data-protection violation may create several kinds of legal consequences.

Depending on the facts and applicable law, a dispute may involve:

regulatory action;

contractual liability;

breach of confidentiality;

negligence;

privacy-related claims;

compensation;

injunctions;

employment consequences.

Therefore:

Data protection can become a civil-law issue.

23. Idea 20: Evidence and Personal Data

Data can become evidence in litigation.

Examples:

emails;

WhatsApp messages;

access logs;

CCTV;

customer records;

employee files;

cloud records.

But litigation does not automatically mean that every piece of personal information should be disclosed without safeguards.

Courts can deal with:

confidentiality;

redaction;

restricted access;

protective orders;

relevance;

proportionality.

24. Case Law

Case 1: Dubai Financial Services Authority v Commissioner of Data Protection & Anna Waterhouse [2018] DIFC CFI 051 and CFI 085

Facts

Anna Waterhouse made a Subject Access Request to the DFSA seeking access to personal data.

The Commissioner of Data Protection found that the DFSA had contravened the applicable DIFC Data Protection Law by refusing to comply with the request.

The DFSA appealed to the DIFC Court.

Principle

The case examined:

the meaning of personal data;

data-controller obligations;

subject-access rights;

the limits of access requests;

the Commissioner's regulatory powers.

The Court considered the distinction between personal data and broader information contained in documents. (DIFC Courts)

Importance

The case demonstrates:

Data-subject access right ≠ automatic right to every document mentioning the person.

It is the most directly relevant UAE/DIFC data-protection case for this topic.

25. Case 2: Health Bay Investment in Healthcare Enterprises & Development LLC v Dr Kamal Akkach [2021] DIFC CFI 087/2019

Facts

The dispute involved healthcare information disclosed during litigation.

The court had to manage sensitive information including:

patient names;

email addresses;

medical records;

financial information;

other healthcare information.

Principle

The court's disclosure arrangements treated patient information as confidential and required restrictions on access and use.

The case materials expressly identified personal healthcare information as confidential information for purposes of the proceedings. (DIFC Courts)

Importance

It demonstrates:

Medical data requires strong confidentiality and controlled litigation disclosure.

26. Case 3: AES Middle East Insurance Broker LLC & Others v GSB Capital Ltd [2023] DIFC CFI 060

Facts

The dispute concerned confidential commercial information, including client lists.

Principle

The DIFC Court explained that whether information is confidential depends upon its nature and the circumstances in which it is obtained and used.

The Court specifically recognised that client lists in financial services can be inherently confidential because of their sensitivity and commercial value. (DIFC Courts)

Importance

The case shows that:

Customer information can have independent confidentiality protection in addition to ordinary contractual protection.

27. Case 4: Anoop Kumar Lal & Paul Patrick Hennessy v Donna Benton [2021] DIFC CFI 005

Facts

The dispute involved confidential business information concerning a proposed management buyout and possible investors.

The claimants had access to confidential information relating to The Entertainer and its negotiations.

Principle

The Court found that confidential information had been disclosed and treated the information as commercially confidential.

The judgment illustrates the importance of controlling access to business information and respecting confidentiality obligations. (DIFC Courts)

Importance

It demonstrates:

Unauthorised disclosure of commercially sensitive information can create legal consequences.

28. Case 5: R.E. Lee International (Middle East) Limited v Imran Khan [2023] DIFC CFI 087

Facts

The claimant sought privacy protections concerning the proceedings.

An application was made to have parts of the proceedings made private.

Principle

The Court refused the particular privacy application.

The case illustrates that privacy in litigation is not automatic. A party must establish an appropriate legal basis for restricting the normal openness of court proceedings. (DIFC Courts)

Importance

The case is useful for distinguishing:

privacy rights

from

automatic confidentiality of court proceedings.

29. Case 6: Oakley v Oliver [2025] DIFC CFI 047

Facts

The dispute concerned employment termination following alleged disclosure of confidential information.

The information included salary and benefits information belonging to a client's employee.

Principle

The Court considered the employer's confidentiality rules and the disclosure of confidential salary information in assessing the alleged employment breach. (DIFC Courts)

Importance

The case illustrates that:

Employee and salary information can be treated as confidential information requiring controlled disclosure.

30. Case 7: Tysers Insurance Brokers Limited v Ardonagh Specialty (MENA) Limited & Jayees Ibrahim Velikkalagath [2025] DIFC CFI 082

Facts

The dispute involved a senior employee with access to sensitive insurance-business information.

The claimant sought protection for confidential information including:

pricing;

client information;

business-development information;

information stored in business systems.

Principle

The Court considered the protection of confidential information and the risks created by an employee retaining or using commercially sensitive information after termination. (DIFC Courts)

Importance

The case demonstrates the connection between:

employment + confidential information + information security + post-employment restrictions.

31. Case 8: Dubai Financial Services Authority v Commissioner of Data Protection & Anna Waterhouse – Meaning of Personal Data

A particularly important aspect of the Waterhouse litigation concerned the scope of the expression “personal data.”

The Court considered whether information merely connected with a person or retrievable using that person's name necessarily constituted that person's personal data.

The judgment relied on the distinction between information genuinely relating to the individual and information that merely mentions the individual in a broader document or investigation. (DIFC Courts)

Importance

For examinations, remember:

Mentioning a person's name ≠ automatically making the entire document that person's personal data.

32. Mainland UAE vs DIFC vs ADGM

This distinction is essential.

Mainland UAE

The principal general framework is:

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

DIFC

DIFC has its own:

DIFC Data Protection Law No. 5 of 2020, as amended.

The DIFC Courts themselves state that their processing of personal data is governed by the DIFC Data Protection Law. (DIFC Courts)

ADGM

ADGM has its own:

Data Protection Regulations 2021.

ADGM states that the 2021 Regulations replaced its earlier 2015 regime and were designed to provide a high level of personal-data protection. (ADGM)

Therefore:

Mainland PDPL ≠ DIFC DP Law ≠ ADGM Data Protection Regulations

33. Simple Data Protection Dispute Example

Suppose Company A operates an online shopping platform.

It holds information concerning 100,000 customers.

An employee downloads the customer database and sends it to an outside marketing company.

Legal questions

Question 1

Was the information personal data?

Likely yes, depending on its contents.

Question 2

Was there a lawful basis for disclosure?

Must be examined.

Question 3

Was the marketing use consistent with the original purpose?

Must be examined.

Question 4

Was the employee authorised?

Important.

Question 5

Was the third party authorised to receive the information?

Important.

Question 6

Was a data breach created?

Potentially.

Question 7

Are notification obligations triggered?

Must be assessed under the applicable data-protection regime.

Question 8

Did customers suffer loss?

Relevant to civil remedies.

34. Simple Data Protection Compliance Checklist

A UAE business can use this basic checklist:

A. Identify

What personal data do we hold?

B. Purpose

Why do we process it?

C. Legal basis

What permits the processing?

D. Minimise

Are we collecting unnecessary information?

E. Secure

Who can access it?

F. Inform

Have individuals received an appropriate privacy notice?

G. Correct

Can inaccurate information be corrected?

H. Retain

How long should information be kept?

I. Delete

When should it be securely deleted?

J. Transfer

Is information being transferred outside the UAE or to another jurisdiction?

K. Vendors

Are third-party processors properly controlled?

L. Breach

What happens if information is lost or stolen?

35. Data Protection and Contract Law

Data protection frequently appears inside contracts.

For example:

Customer contract

↓

Privacy notice

↓

Data-processing provisions

↓

Third-party processor

↓

Confidentiality obligation

↓

Security obligation

Therefore, a data-protection dispute may simultaneously involve:

contract law;

privacy law;

confidentiality;

tort principles;

employment law;

regulatory law.

36. Data Protection and Civil Damages

Suppose an organisation unlawfully discloses a person's information.

The claimant may potentially argue that the conduct caused:

financial loss;

reputational harm;

privacy harm;

business loss;

other legally recognised damage.

The exact availability and calculation of compensation depend upon:

the applicable data-protection regime;

the nature of the violation;

proof of damage;

causation;

contractual arrangements;

other applicable UAE laws.

Therefore:

Data breach does not automatically equal a fixed amount of compensation.

37. Data Protection and Evidence

Digital evidence can itself contain personal information.

For example:

emails;

WhatsApp messages;

CCTV;

employee monitoring records;

GPS records;

bank statements;

medical records;

cloud files.

A court may need to balance:

Relevant evidence

against

privacy and confidentiality concerns.

The Health Bay litigation provides a practical example of controlled treatment of confidential healthcare information in litigation. (DIFC Courts)

38. Five Easy Data Protection Principles

For examination purposes, remember:

1. Purpose

Know why the information is collected.

2. Permission

Have an appropriate legal basis.

3. Protection

Secure the information.

4. Privacy

Respect the individual's rights.

5. Proof

Maintain records showing compliance.

39. One-Line Revision Formula

DATA → PURPOSE → LAWFUL BASIS → MINIMISATION → SECURITY → RIGHTS → RETENTION → DELETION

40. Final Conclusion

UAE data protection law is based on the idea that personal information should not be treated as an unrestricted corporate asset.

The organisation handling personal data should consider:

why it collected the data;

whether processing is legally permitted;

what information is actually necessary;

who can access it;

how it is protected;

where it is transferred;

how long it is retained; and

what rights the individual has.

The most important case for direct UAE/DIFC data-protection analysis is DFSA v Commissioner of Data Protection & Anna Waterhouse, which examined subject-access rights and the meaning and scope of personal data. The other verified DIFC cases illustrate related principles of confidentiality, healthcare information, commercial information, employment data and privacy in litigation. (DIFC Courts)

Quick exam answer

UAE data protection law regulates the collection, processing, use, disclosure, storage and protection of personal data. Its central ideas are lawful processing, purpose limitation, data minimisation, accuracy, security, transparency, individual rights, controlled disclosure, retention and accountability. The applicable rules differ between mainland UAE, DIFC and ADGM, so jurisdiction must be identified before applying a particular provision or case.

Revision shortcut: “P-L-S-R” = Purpose → Lawful basis → Security → Rights. For a case-law answer, start with DFSA v Commissioner of Data Protection & Waterhouse, then use the verified DIFC confidentiality/privacy cases to explain how data protection operates in practice.