Overview Jurisdiction Authorities Initiatives ADGM Academy Dispute Resolution

A platform that offers limitless opportunities and paves the way for a brighter future

Abu Dhabi boasts first-class infrastructure and unparalleled global connectivity, making it a premier international destination. Its exceptional qualities make it an ideal location to live, work, and conduct business.

Read about Abu Dhabi's life style

Latest Initiatives

ADGM’s 2024 Performance With 245% Growth in AUMs Highlights Global Influence

ADGM Completes Al Reem Island Integration, Adding Over 1,100 Entities to its Jurisdiction

Overview Business Areas Setting up Operating in Public Registers Legal Framework

Providing an environment that empowers the future

A financial centre that provides transparency, efficiency, and integrity, through its progressive frameworks, future focused infrastructure, all within a familiar independent legal jurisdiction – ADGM is the perfect platform for success.

Find out how to set up in ADGM

Guidance

Operating in ADGM

Office of Data Protection

Guidance

Navigate Data Protection in ADGM

From guidance on data protection regulations to standard contractual clauses for transfers, templates, assessment requirements and more, ADGM’s Office of Data Protection provides comprehensive guidance to support ADGM registered companies in complying with regulatory requirements.

Data Protection Guidance 2021

Part 1. This guide provides an overview of the Data Protection Regulations 2021 including key concepts, terms, scope, principles of processing and the lawful bases for processing personal data.

Guidance on the Data Protection Regulations 2021 (part 1)

Part 2. This guide provides information on data subject rights and the data controller’s obligations with regards to individual rights requests.

Guidance on the Data Protection Regulations 2021 (part 2)

Part 3. This guide provides information on data protection by design and default, the fees, the record of processing activity, the requirement of data protection officers and processor obligations.

Guidance on the Data Protection Regulations 2021 (part 3)

Part 4. This guide provides information on Data Protection Impact Assessments (“DPIA”). In particular, what is the DPIA, what must a DPIA contain, how to conduct a DPIA and some FAQs.

Guidance on the Data Protection Regulations 2021 (part 4)

Part 5. This guide provides information regarding the security of processing, the cessation of processing and managing personal data breaches, which includes notification requirements.

Guidance on the Data Protection Regulations 2021 (part 5)

Part 6. This guide provides information on international transfers. In particular, the definition of ‘transfer’ and the mechanism and conditions required under the Regulations to transfer personal data from the ADGM.

Guidance on the Data Protection Regulations 2021 (part 6)

Part 7. This guide provides information regarding the newly introduced code of conduct mechanism. Also, the role of the Commissioner of Data Protection and the Office of Data Protection.

Guidance on the Data Protection Regulations 2021 (part 7)

Part 8. This Guide focuses on individual rights and remedies. In particular, how individuals can raise concerns, exercise their right and seek redress.

Guidance on the Data Protection Regulations 2021 (part 8)

Standard Contractual Clauses for Transfers

The ADGM Standard Contractual Clauses (“SCCs”) is an appropriate safeguard under Article 42(2) of the Regulations to transfer personal data from the ADGM to a third party located in a third country or jurisdiction that does not provide an adequate level of protection. You can find here the list of adequate jurisdictions. SCCs are used by two or more parties and includes a new modular approach catering to different transfer scenarios. The use of SCCs are optional but if used, parties cannot amend the clauses.

Data Transfer - Standard Contractual Clauses

Addendum to the EU Standard Contractual Clauses

The ADGM Addendum to the European Commission’s Standard Contractual Clauses (“EU SCCs”) is an approved appropriate mechanism and safeguard under Article 42(2) of the Regulations. The Addendum can only be used by ADGM entities that have already applied the EU SCCs to their personal data processing activities. Further information can be below Guidance Note.

ADGM Addendum to the EU SCCs

Guidance Note to the ADGM Addendum to the EU SCCs

Templates

This DPO Competency Statement Template can be used when appointing a statutory Data Protection Officer (DPO) on the Registry Platform. The Competency statement is required to ensure accountability under the ADGM Data Protection Regulations 2021.

DPO Competency Statement Template

The Appropriate Policy Document (“APD”) is required where a Controller relies on certain conditions for processing special category of personal data. The purpose of the APD is to imbed transparency and governance around the processing activity.

Appropriate Policy Document

The Data Protection Agreement is required by Controllers when appointing Processors to conduct activities on their behalf. As is, the template below meets the requirement of Article 26(3).

Article 26 - Standard Contractual Clauses

A Data Protection Impact Assessment (DPIA) is required by Controllers proposing a new project, product or initiative that is likely to result in a high risk to the rights of individuals. Prior to the activity, the Controller must conduct the DPIA to assess and mitigate risks from the envisaged processing of personal data.

Data Protection Impact Assessment

A Record of Processing Activity (ROPA) is required by all ADGM entities that process personal data. The ROPA must contain key information from all the processing activities undertaken by the Data Controller.

Record of Processing Activity

Assessments

Data Protection Officer Requirement

This assessment was developed to help you understand whether you are required to appoint a Data Protection Officer (“DPO”) under the Data Protection Regulations 2021. The assessment should only be used as a Guide and does not constitute legal advice. To access the tool, please click here.

Data Breach Notification Requirement

This assessment was developed to help you understand your notification requirements for a personal data breach under the Data Protection Regulations 2021. The assessment should only be used as a Guide and does not constitute legal advice. To access the tool, please click here.

COVID-19 Implications for Data Protection

Guidance on completing Data Protection Registration in ADGM Registry Solution 2.0.

Guidance on Data Protection Registration in Registry 2.0

About

Overview Jurisdiction Authorities Initiatives ADGM Academy Dispute Resolution Careers

Business

Overview Business areas Setting up Operating in Public registers Legal framework

Discover

Media News Events Spotlight Podcasts Publications Documents

Contact & Support

Support Make an enquiry Speaking Up

Resources

FAQs Document Repository

Sitemap Terms and conditions Privacy policy Cookies policy