The ADGM Data Protection Regulations 2021 are the data protection law of Abu Dhabi Global Market, a financial free zone. They follow the GDPR model: principles, individual rights, controller and processor duties, restrictions on transfers and fines of up to USD 28 million. The ADGM Office of Data Protection, headed by the Commissioner of Data Protection, supervises them.
Free account needed to download. You come straight back to the file.
Who it is for. Controllers and processors that are ADGM establishments, wherever the processing happens. A processor in ADGM working for a controller outside it must follow the Regulations as far as possible.
What this list covers. Data Protection Regulations 2021, Consolidated Version August 2025 (enacted 11 February 2021; amendments noted in the text up to 9 September 2025), as published on the ADGM Legal Framework site, en.adgm.thomsonreuters.com, and read on 7 November 2026. Check ADGM for later amendments and for the Board's rules on fees: 135 provisions. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| Reg. 2 | What the Regulations cover | They apply to personal data handled by automated means, and to paper records held in a structured filing system. Purely personal or household use is outside them, as is criminal-justice and national-security work by public authorities. |
| Reg. 3(1) and (3) | Who is caught | If you are an ADGM establishment, the Regulations apply to processing done in the context of its activities, wherever the processing physically happens. They protect individuals of any nationality or residence. |
| Reg. 3(2) | Processors working for controllers abroad | A processor in ADGM that handles data for a controller outside ADGM must follow the Regulations as far as it can, considering whether that controller already faces similar rules under the law of its own country. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. 4(1)(a) | Lawful, fair and transparent | Handle personal data lawfully, fairly and openly, so that the individual can understand what is being done with their data. |
| Reg. 4(1)(b) | Purpose limitation | Collect data for specific, explicit and legitimate purposes, and do not use it later in a way that clashes with them. |
| Reg. 4(1)(c) | Data minimisation | Hold only data that is adequate and relevant, and no more than each purpose needs. |
| Reg. 4(1)(d) | Accuracy | Keep data accurate and, where it matters, up to date. Take every reasonable step to correct or erase inaccurate data without delay. |
| Reg. 4(1)(e) | Storage limitation | Keep data in a form that identifies people for no longer than the purposes need. |
| Reg. 4(1)(f) | Integrity and confidentiality | Protect data with suitable technical and organisational measures against unauthorised or unlawful use, and against accidental loss, destruction or damage. |
| Reg. 4(2) | Accountability | The controller is answerable for these principles and must be able to show that it meets them, so keep records of the choices and controls behind each one. |
| Reg. 4(3) | Archiving and research | Archiving and research use counts as compatible with the original purpose, and data may be kept longer for it, but only with measures that protect the individuals concerned. |
| Reg. 5(1) | Lawful bases | Before processing, identify one lawful basis: consent, a contract, a legal duty, vital interests, a public-authority task, or legitimate interests that do not override the individual's rights, especially a Child's (anyone under 18). |
| Reg. 5(1)(e) and (2) | Public-authority task and legitimate interests | The public-authority basis covers tasks of ADGM, the FSRA, the ADGM Court or the Registration Authority. Where it applies, you cannot also rely on legitimate interests for that processing. |
| Reg. 5(3) | Is a new purpose compatible | Before using data for a new purpose, weigh the link to the original one, the context, the type of data, the effect on people and the safeguards such as encryption or pseudonymisation. |
| Reg. 6(1)-(3) | What valid consent looks like | Consent must be a free, specific, informed and unambiguous act. Silence, pre-ticked boxes and inaction do not count. The person must at least know who the controller is and what the data will be used for. |
| Reg. 6(4) | Prove consent | Where consent is your basis, be able to demonstrate that the person agreed, so keep a record of who consented, when, and to what. |
| Reg. 6(5)-(6) | Consent bundled with other text | When consent sits in a document covering other matters, present the request separately, in plain, easy-to-find language. Any part of the document that breaks the Regulations does not bind the person. |
| Reg. 6(7)-(8) | Withdrawing consent | Tell people before they consent that they can withdraw at any time, and make withdrawal as easy as giving consent. Earlier processing stays lawful. |
| Reg. 6(9) | Consent must be a real choice | When judging whether consent was free, check whether the person could refuse or withdraw without harm, and whether you tied a contract to data it does not need. |
| Reg. 7(1) | Special categories are barred by default | Do not process data revealing race, ethnicity, political or religious views, genetic or biometric ID data, health, sex life or orientation, or criminal records, unless one of the Reg. 7(2) conditions applies. |
| Reg. 7(2)(a) | Explicit consent | One route to processing special-category data is the person's explicit consent for specified purposes. |
| Reg. 7(2)(b) | Employment law | Special-category data may be processed to meet duties or exercise rights under employment law, but only if you have an appropriate policy document in place (see Reg. 7(3)). |
| Reg. 7(2)(c)-(j) | Other conditions | Other conditions cover vital interests, health care, public health, archiving and research, not-for-profit bodies, data the person made public, contracts and legal claims. Each applies only for what it covers. |
| Reg. 7(2)(k) | Substantial public interest | A list of substantial public interest grounds is available, such as legal functions, justice, equal opportunity, preventing fraud or unlawful acts, and money-laundering reports. Most need an appropriate policy document in place. |
| Reg. 7(3) | The appropriate policy document | Write a policy that explains how you will meet the principles and your retention and erasure rules for that data. Keep and review it from when you start until 6 months after you stop, and give it to the Commissioner on request. |
| Reg. 8(1)-(3) | Data you cannot link to a person | You need not collect extra data just to identify someone for the Regulations. If you cannot identify them, say so where possible. Rights in Regs. 13 to 18 then apply only if they supply information that lets you identify them. |
| Reg. 9 | Archiving and research safeguards | Put technical and organisational measures in place, such as pseudonymisation. Do not cause people substantial damage or distress, and do not use the data for decisions about an individual, apart from approved medical research. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. 10(1)-(2) | Clear communication and facilitating rights | Give information and replies in concise, plain language, in writing or electronically (orally on request once identity is proven). Make it easy for people to use their rights in Regs. 13 to 20. |
| Reg. 10(3)-(5) | Deadlines for requests | Answer a rights request without undue delay and within two months. The period can be extended by one month if you explain why within the first two months. If you refuse, give reasons and say they can complain to the Commissioner or go to court. |
| Reg. 10(6) | No charge, unless excessive | Handle information and requests free of charge. For clearly excessive or repetitive requests you may charge a reasonable fee or refuse, but you must be able to show why the request was excessive. |
| Reg. 10(7) | Checking who is asking | If you reasonably doubt who made a request under Regs. 13 to 19, you may ask for more proof, and the clock only starts once you have enough to identify the person. |
| Reg. 11(1) | Notice when you collect data from the person | At collection, tell people who you are, your DPO's contact details if any, why you use the data and on what legal basis, any legitimate interests, who receives it, and any transfer outside ADGM with its safeguards. |
| Reg. 11(2) | Further information at collection | Also give the retention period or its criteria, the rights available, the right to withdraw consent and to complain to the Commissioner, whether providing data is required, and any automated decision-making logic. |
| Reg. 11(2)(h) | Warn when rights will be limited | If your processing will restrict rectification, erasure or objection, say so clearly beforehand, explain the effect, and make sure the person understands and acknowledges the limit. |
| Reg. 11(3)-(4) | New purposes and what people already know | Before using data for another purpose, tell the person about it and any other relevant information. You need not repeat what they already have. |
| Reg. 12(1)-(2) | Notice when data comes from elsewhere | If you got data from someone else, tell the person who you are, why you use it, the categories of data, recipients, transfers, retention, their rights, the complaint right, the source and any automated decisions. |
| Reg. 12(3) | When to give that notice | Give it within a reasonable time and at most two months, or at the first contact with the person if you will write to them, or when the data is first disclosed, whichever is earliest. |
| Reg. 12(4)-(5) | Further use and exceptions | Tell the person before any new use of the data. The notice can be skipped where they already know, it would take disproportionate effort, the law requires the collection, or professional secrecy applies. |
| Reg. 13(1) | Right of access | On request, confirm whether you hold a person's data and, if so, give them access plus details of purposes, categories, recipients, retention, their other rights, source and automated decisions. |
| Reg. 13(2) | Information on transfer safeguards | If the data goes outside ADGM or to an international organisation, the person can be told what safeguards apply to the transfer. |
| Reg. 13(3) | Copy of the data | Provide a copy of the data, in a common electronic form if they asked electronically. You may charge a reasonable administrative fee for further copies. |
| Reg. 13(4)-(5) | Protect others and narrow big requests | A copy must not harm other people's rights. Where you hold a large amount of data about the person, you may ask them to say which data or activities the request covers. |
| Reg. 14 | Right to rectification | Correct inaccurate data without undue delay and complete incomplete data, for example with a supplementary statement. If correction is technically impossible you are excused only if you said so clearly and prominently when you collected the data. |
| Reg. 15(1) | Right to erasure | Erase data without undue delay when it is no longer needed, consent is withdrawn and there is no other basis, the person objects successfully, it was processed unlawfully, or the law requires erasure. |
| Reg. 15(2) | Data you made public | Where you published data and must now erase it, take reasonable steps, considering technology and cost, to tell other controllers handling it that the person wants copies and links removed. |
| Reg. 15(3)-(4) | Limits on erasure | Erasure does not apply where processing is needed for a legal duty, a public task, public health, archiving and research, or legal claims. Technical impossibility excuses you only if you warned the person clearly when collecting. |
| Reg. 16(1) | Right to restrict processing | Pause processing when the person contests accuracy, when processing is unlawful but they want it kept rather than erased, when they need data for legal claims, or while an objection is being assessed. |
| Reg. 16(2)-(3) | What restriction means | While restricted, store the data but use it only with consent, for legal claims, to protect others, or for important public interest. Tell the person before you lift the restriction. |
| Reg. 17 | Tell recipients of changes | Pass any correction, erasure or restriction on to each recipient of the data, unless that is impossible or disproportionate, and tell the person who those recipients are if they ask. |
| Reg. 18(1)-(2) | Right to data portability | Give people data they provided, in a structured, common, machine-readable format, and let them send it to another controller, where processing runs on consent or contract and is automated. Send it direct where technically feasible. |
| Reg. 18(3)-(4) | Limits on portability | Portability does not cover processing based on a public-authority task and must not harm the rights of others. |
| Reg. 19(1)-(2) | Right to object | People may object, on grounds of their situation, to processing based on a public task or on legitimate interests. Stop unless you can reasonably show overriding legitimate grounds, or need the data for legal claims. |
| Reg. 19(3)-(4) | Direct marketing objection | People may object at any time to processing for direct marketing, including profiling for it, and once they do you must stop using their data for that purpose. |
| Reg. 19(5) | Objection to archiving and research | People may object to processing for archiving and research, unless it is needed for a task in the public interest. |
| Reg. 19(6) | Draw attention to the right to object | No later than your first communication, point out the Reg. 19(1) and 19(3) rights to object, clearly and apart from any other information. |
| Reg. 20(1) | No solely automated decisions with major effects | People have the right not to be subject to a decision made only by automated processing, including profiling, that has legal or similarly significant effects on them. |
| Reg. 20(2) | When automated decisions are allowed | They are allowed where necessary for a contract, based on explicit consent, or required or authorised by law. In the law-based case, notify the person in writing and let them ask within one month for reconsideration. |
| Reg. 20(3) | Safeguards for automated decisions | For contract and consent cases, put safeguards in place, at least a person to review the decision on request, a way for the individual to give their view, and a way to contest it. |
| Reg. 20(4) | Special categories in automated decisions | Automated decisions must not use special-category data unless the person gave explicit consent or the substantial public interest condition applies, and suitable safeguards are in place. |
| Reg. 21 | When rights and duties do not apply | Exemptions cover national security, crime and tax, legal proceedings and privilege, regulatory functions, third-party data in access requests, negotiations, forecasting and archiving. Use them only to the extent the text allows. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. 22(1) | Controller responsibility | Put appropriate technical and organisational measures in place, judged against the risk of the processing, to make sure and show it complies. Review and update them when needed. |
| Reg. 22(2) | Data protection policies | Where proportionate to your processing, include written data protection policies among those measures. |
| Reg. 23 | Data protection by design and by default | Design systems, processes and practices with the Regulations in mind, and by default process only the data necessary for each specific purpose. |
| Reg. 24(1) | Pay the Data Protection Fee and register | Before or soon after you start processing, pay the Data Protection Fee for the first twelve months and tell the Commissioner your name, address and the date processing began. |
| Reg. 24(2) | Renewal Fee each year | Each year, within one month of the anniversary of starting to process, pay the Renewal Fee. The amount is set by Board rules, which should be checked on the ADGM site. |
| Reg. 25(1) | Joint controllers | If you decide purposes and means jointly with another controller, agree between you who does what, especially for individuals' rights and the notice duties, unless the law already allocates it. A contact point may be named. |
| Reg. 25(2)-(3) | Joint controller arrangement is shared and does not limit rights | The arrangement must set out each controller's role towards individuals, and its essence must be made available to them. Individuals can still exercise their rights against any of the controllers. |
| Reg. 26(1) | Choose processors with care | Use only processors that give sufficient guarantees, through suitable technical and organisational measures, that processing will meet the Regulations and protect individuals' rights. |
| Reg. 26(2) | Sub-processors need approval | A processor must not bring in another processor without the controller's written authorisation. Under a general authorisation, it must tell the controller of changes so the controller can object. |
| Reg. 26(3) | Contract with the processor | Govern processing by a binding contract setting out the subject matter, duration, nature, purpose, data types, data subjects and the controller's rights and duties, and include the terms in Reg. 26(3)(a) to (h). |
| Reg. 26(3)(a)-(b) | Instructions and confidentiality | The contract must require the processor to act only on the controller's documented instructions, including on transfers, and to ensure staff handling data are bound by confidentiality. |
| Reg. 26(3)(c)-(d) | Security and sub-processing | The contract must require the processor to meet the security duty in Reg. 30 and to respect the conditions on engaging other processors. |
| Reg. 26(3)(e)-(f) | Assistance | The contract must require the processor to help the controller answer rights requests, and to help with security, breach, impact assessment and consultation duties in Regs. 30 to 34. |
| Reg. 26(3)(g) | Return or deletion at the end | The contract must require the processor, at the controller's choice, to delete or return all data after the service ends, and delete copies unless the law requires storage. |
| Reg. 26(3)(h) | Information and audits | The contract must require the processor to give the controller what it needs to show compliance and to allow and contribute to audits and inspections. |
| Reg. 26(4) | Flag unlawful instructions | A processor must tell the controller straight away if it thinks an instruction breaks the Regulations or other data protection law. |
| Reg. 26(5) | Pass obligations down | When a processor uses a sub-processor, it must impose the same data protection obligations by contract. The first processor stays fully liable to the controller for the sub-processor's performance. |
| Reg. 26(6)-(7) | Standard contractual clauses | The Commissioner may adopt standard clauses, including the current EU ones, and processor contracts can rely on them in whole or part, including via an approved certification. |
| Reg. 26(8) | Processor contracts in writing | The processor contract or legal act, and sub-processor ones, must be written down. |
| Reg. 26(9) | Processor deciding purposes becomes a controller | A processor that breaks the Regulations by deciding why and how data is processed is treated as a controller for that processing. |
| Reg. 27 | Acting only on instructions | A processor, and anyone working under the authority of the controller or processor, must not process personal data except on the controller's instructions, unless the law requires it. |
| Reg. 28(1) | Controller's record of processing | Keep a record of your processing activities covering names and contacts, purposes, categories of people and data, recipients, transfers and safeguards, retention periods and a general description of security measures. |
| Reg. 28(2) | Processor's record of processing | A processor keeps its own record covering names and contacts of processors, controllers and the DPO, categories of processing for each controller, transfers and safeguards, and a general description of security. |
| Reg. 28(3)-(4) | Format and access | Keep the records in writing, which can be electronic, and make them available to the Commissioner of Data Protection on request. |
| Reg. 29 | Cooperate with the Commissioner | Controllers and processors must cooperate on request with the Commissioner of Data Protection in carrying out the duties and functions of the Office of Data Protection. |
| Reg. 30(1) | Security measures | Apply technical and organisational measures proportionate to the risk, weighing the state of the art and cost. Consider pseudonymisation, encryption, resilience, timely restoration after an incident, and regular testing of the measures. |
| Reg. 30(2) | Assess the risks | When choosing security, take into account the risks of accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to data being sent, kept or handled. |
| Reg. 30(3) | People under your authority | Make sure anyone acting under your authority who has access to personal data handles it only on your instructions, unless the law requires otherwise. |
| Reg. 31(1) | When processing stops | When the basis for processing ends or changes, or erasure rights require you to stop, make sure all data, including data held by processors, is deleted securely and permanently, anonymised, pseudonymised or securely encrypted. |
| Reg. 31(2)-(3) | If you cannot delete: put it beyond further use | If none of the options is achievable, archive the data so that it cannot influence decisions, only you and the processor can see it, it has live-data security, and you follow a strategy for eventual removal. |
| Reg. 31(4) | Allowed to keep for some reasons | You need not delete or put data beyond use where it is needed for legal claims or the law, for public-interest scientific research, or in a dataset used lawfully to train or refine an AI system without risk to people's rights. |
| Reg. 31(5) | Impact assessment before research or AI reliance | Before relying on the research or AI-training exception, carry out a data protection impact assessment. Limit the processing to what those purposes need. |
| Reg. 31(6) | Policy for retained data | Have a policy and process for data kept under Reg. 31(4), and delete, anonymise, pseudonymise, encrypt or put it beyond further use once the grounds for keeping it end. |
| Reg. 32(1) | Report breaches to the Commissioner | Tell the Commissioner of Data Protection of a breach without undue delay and, where feasible, within 72 hours of becoming aware, unless it is unlikely to risk individuals' rights. If later than 72 hours, give reasons. |
| Reg. 32(2) | Processor tells the controller | A processor must tell the controller without undue delay after it becomes aware of a personal data breach. |
| Reg. 32(3)-(4) | What the report contains | Describe the breach and approximate numbers of people and records, give the DPO or other contact, the likely consequences and the steps taken or planned. Information can follow in phases if not all is ready. |
| Reg. 32(5) | Log every breach | Document every breach, its facts, effects and remedial action, so that the Commissioner can check your compliance, including breaches you did not report. |
| Reg. 33(1)-(2) | Tell the individuals if the risk is high | If a breach is likely to pose high risk to individuals, tell them without undue delay, in plain language, with the contact, consequences and measures, plus advice on protecting themselves where practical. |
| Reg. 33(3)-(4) | When individual notice is not needed | It is not needed if the data was protected, for example encrypted, if later measures have removed the high risk, or if it would take disproportionate effort, in which case make a public announcement. The Commissioner can overrule your view. |
| Reg. 34(1)-(2) | Impact assessment for high-risk processing | Before processing likely to pose a high risk to individuals, assess its impact on personal data protection. One assessment can cover similar operations, and its result should shape your measures. |
| Reg. 34(3) and (5) | Content, and DPO advice | Ask the DPO for advice if you have one. The assessment must describe the processing, test necessity and proportionality, identify risks to people and set out measures to reduce them. |
| Reg. 34(4) | Commissioner's list of high-risk processing | The Commissioner must publish a list of processing operations that require an impact assessment, so check it when planning new processing. |
| Reg. 34(6) | Review the assessment | Where needed, review whether the processing still matches the assessment, including when the risk changes. |
| Reg. 34(7) | Notify the Commissioner before high-risk processing | If an assessment shows the processing would be likely to pose high risk, notify the Commissioner of Data Protection before carrying it out, including the Reg. 34(5) information. |
| Reg. 35(1) | When a DPO is required | Appoint a Data Protection Officer if you are a public authority, or if your core activities involve regular, systematic, large-scale monitoring of people or large-scale use of special-category data. The duty applies to processors too. |
| Reg. 35(2)-(3) | Who can be the DPO | One DPO can serve a group or several independent entities, may hold other roles, may be external under a written agreement, and need not live in ADGM, if easily reachable and free of conflicts. Choose on expertise. |
| Reg. 35(4) | Tell the Commissioner about DPO changes | Within one month of appointing or losing a DPO, notify the Commissioner with the new DPO's contact details or, for a resignation, the reasons. |
| Reg. 36(1) | Support the DPO | Involve the DPO properly and promptly in data protection issues, give resources and access, do not dismiss or penalise them for doing the job, and let them report to the highest level of management. |
| Reg. 36(2)-(3) | Contact and confidentiality | Individuals can contact the DPO about their data and their rights. The DPO must keep confidential what they learn in the role. |
| Reg. 37 | Tasks of the DPO | The DPO advises staff and the organisation, monitors compliance, training and audits, advises on impact assessments, cooperates with the Commissioner and is the contact point for the Office of Data Protection, with attention to risk. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. 40 | Transfers need a Part V route | Send personal data outside ADGM, or to an international organisation, only if you meet the conditions in this Part. Onward transfers by the recipient must keep the same level of protection. |
| Reg. 41 | Transfers to adequate jurisdictions | A transfer may go ahead without special authorisation to a place the Commissioner has found adequate, which can include places with an EU adequacy decision, and under earlier 2015 designations. Check the Commissioner's published list. |
| Reg. 42(1) | Appropriate safeguards | With no adequacy decision, transfer only with appropriate safeguards and where enforceable rights and effective remedies exist for the individuals concerned. |
| Reg. 42(2)-(3) | Safeguards that need no authorisation | Options include a binding instrument between public authorities, Binding Corporate Rules, the standard clauses the Commissioner adopts (including approved EU ones), or an approved code or certification with binding commitments. |
| Reg. 42(4) | Safeguards that need authorisation | Bespoke contract clauses, or administrative arrangements between public bodies, can serve as safeguards, but only with the Commissioner's authorisation. |
| Reg. 43 | Binding Corporate Rules | Group-wide rules approved by the Commissioner (or already approved by a recognised authority) can support transfers within a group. They must bind every member, give individuals enforceable rights and cover the matters listed in Reg. 43(2). |
| Reg. 44(1) | Derogations | With neither adequacy nor safeguards, a transfer may go ahead only if the person explicitly consented after being told the risks, or it is needed for a contract, public interest, UAE law enforcement, legal claims or vital interests. |
| Reg. 44(2)-(3) | Limits on derogations | Consent and contract derogations do not apply to public authorities acting in their public powers. A public interest ground must be recognised in the Applicable Law that binds the controller. |
| Reg. 45(1) | Requests from foreign public authorities | On a data request from a public authority outside ADGM that has jurisdiction over you or your group, check it is valid and proportionate, assess the risk to individuals and minimise it, and seek assurances about safeguards where practical. |
| Reg. 45(2) | Consulting the Commissioner on such requests | You may consult the Commissioner of Data Protection about any matter connected with a request from a public authority outside ADGM. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. 50(1) | Investigations by the Office of Data Protection | Expect the Commissioner to demand information by written notice, open investigations and audits, notify you of alleged contraventions, access personal data and, with a court warrant, enter premises and seize documents. |
| Reg. 50(5) | Corrective powers | The Commissioner can warn and reprimand you, order you to comply with a person's rights request or bring processing into line, order breach notices, ban or limit processing, order erasure, suspend data flows and impose fines. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. 54(1)-(3) | Directions | After investigating, the Commissioner can issue a Direction ordering you to take specified corrective steps. It must state the contravention and say you may take the decision to the Court, and the Court can enforce it by injunction. |
| Reg. 54(4)-(5) | Ask for a review | You may ask the Commissioner to review a Direction within 21 days of receiving it. If the Direction is changed or dropped, you must be given reasons. |
| Reg. 55(1) and (6) | Administrative fines | Breaking the Regulations, board rules or a Direction can draw a fine by Penalty Notice. For one contravention, or linked processing, the total must not exceed USD 28 million. |
| Reg. 55(3) | What affects the fine | Factors include the gravity and duration, intent or negligence, mitigation, your technical and organisational measures, past breaches, cooperation, the data involved, how it came to light, and adherence to codes or certification. |
| Reg. 55(4)-(5) | Notice of Intent first | Before a Penalty Notice, you receive a Notice of Intent giving reasons, an indication of the amount and at least 21 days to make written representations, and say whether oral ones are allowed. |
| Reg. 55(7) | Paying, not paying or appealing | Paying the fine within the stated period ends action over that contravention, though not a continuing one. Unpaid fines are recoverable as a debt, with interest and costs. You can instead appeal to the Court. |
| Reg. 56 | Late Data Protection Fee | If you do not pay the Data Protection Fee or Renewal Fee, the Commissioner can add a penalty of up to 150 per cent of that fee. The fixed amount for an unpaid first fee is set by Board rules. |
| Reg. 57 | Right to complain to the Commissioner | Any individual who thinks processing breaks the Regulations may complain to the Commissioner of Data Protection, alone or collectively, and the Office must assess it and keep the complainant informed of progress and outcome. |
| Reg. 58 | Court review | A controller or processor may refer a Penalty Notice or Direction to the Court within three months. Controllers, processors and individuals may also refer a mishandled complaint within three months of making it. |
| Reg. 59(1) | Right to compensation | Anyone who suffers material or non-material damage from a breach of the Regulations can claim compensation from the controller or processor, on top of any fine. |
| Reg. 59(2)-(5) | Who is liable | A controller is liable for damage from non-compliant processing. A processor is liable only for breaching duties aimed at processors or acting against lawful instructions. Proof of no responsibility, or of reasonable care, is a defence. |
| Reg. 59(6)-(7) | Joint liability and recovery | Where several controllers or processors are involved, each is liable for the whole damage, and one who pays in full can recover the others' share. |
| Reg. 59(8)-(9) | Claims go to Court | Compensation claims are brought before the Court. An individual may also ask the Court for an order requiring a controller or processor to do, or stop doing, something to comply. |
Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.
The Commissioner of Data Protection, who heads the Office of Data Protection, monitors and enforces the Regulations (Reg. 47). It handles complaints, issues Directions and can impose fines.
Reg. 55 caps an administrative fine at USD 28 million, and the same cap applies in total where one set of processing breaks several provisions. Separate penalties apply to unpaid Data Protection Fees.
Reg. 32 requires notifying the Commissioner of Data Protection without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to risk individuals. Later reports need reasons. Individuals are told if the risk is high (Reg. 33).
Yes. A controller pays a Data Protection Fee when it starts processing and a Renewal Fee each year (Reg. 24). The amounts are set by Board rules, so check the current figures on the ADGM site.
It follows the same structure but adds ADGM-specific features, including the annual fee, a duty to delete, anonymise or lock down data when processing ends (Reg. 31), and the 'appropriate policy document' for some special-category processing.
No. It is a plain-English summary written by SecureXcel to help you plan and track compliance. The Regulations as published by ADGM are the authority, so read them and take advice before relying on a requirement.