🇦🇪 Dubai International Financial Center

Informations

Extracts :

Extract :

(e) Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices; (f) Processing is necessary for Archiving and Research Purposes in accordance with Applicable Law; (g) Processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not -for-profit body including religious, cultural, educational, social or fraternal purposes or for other charitable purposes and on condition that the Processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the Personal Data is not disclosed outside that body without the Consent of the Data Subjects; (h) Processing relates to Personal Data which is intentionally made public by the Data Subject; (i) Processing is required for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract; (j) Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity; or (k) Processing is necessary for reasons of substantial public interest, provided that (unless specified otherwise) the Controller has, when the Processing is carried out, an appropriate policy document in place in accordance with section 7(3), where it is necessary for: (i) the exercise of a function or requirement conferred on a person by Applicable Law; (ii) the exercise of a function of the Board, Abu Dhabi or United Arab Emirate government; (iii) the administration of justice; (iv) equality of opportunity or treatment provided that the Processing does not, or is not likely to, cause substantial damage or substantial distress to an individual; and it does not relate to an individual who has given written notice to the Controller not to Process their Personal Data; (v) diversity at senior levels of organisations, where the Controller cannot reasonably be expected to obtain the Consent of the Data Subject and is not aware of the Data Subject withholding Consent provided that the Processing does not, or is not likely to, cause substantial damage or substantial distress to an individual; (vi) the prevention or detection of an unlawful act or omission where the Processing must be carried out without the Consent of the Data Subject so as not to prejudice this purpose; and if the Processing relates to the disclosure of Personal Data to a relevant public authority an appropriate policy document in accordance with section 7(3) need not be in place for the Processing to be lawful under these Regulations; (vii) the protection of the members of the public against dishonesty, malpractice or other seriously improper conduct, unfitness or incompetence, mismanagement in the administration of a company, body or association, or failures in services provided by a company, body or association where the Processing must be carried out without the Consent of the Data Subject so as not to prejudice this purpose; (viii) compliance with, or assisting other persons to comply with, a regulatory requirement which involves a person taking steps to establish whether another person has committed an unlawful act or omission, or been involved in dishonesty, malpractice or other seriously improper conduct where the Controller cannot reasonably be expected to obtain the Consent of the Data Subject to the Processing; (ix) the prevention of fraud in connection with Processing of Personal Data as a member of, or in accordance with arrangements made by, an anti- fraud organisation; (x) the disclosure in good faith to an appropriate public authority regarding suspected terrorist financing, to identify terrorist property or in relation to suspected money laundering, in accordance with Applicable Law; or (xi) the publication of a judgment or other decision of a court or tribunal or if the Processing is necessary for the purposes of publishing such a judgment or decision.

Reference :

DATA PROTECTION REGULATIONS 2021

Official text of ARE Data Protection Law in 2021

Extracts :

Extract :

34. Data Protection Impact Assessment (1) The Controller must, prior to Processing that is likely to result in a high risk to the rights of natural persons, carry out an assessment of the impact of the envisaged Processing operations on the protection of Personal Data (a ‘Data Protection Impact Assessment’). (2) A single Data Protection Impact Assessment may address a set of similar Processing operations that present similar high risks. The outcome of the Data Protection Impact Assessment should be taken into account when determining the appropriate measures to be taken in order to demonstrate that the Processing of Personal Data complies with these Regulations. (3) The Controller must seek the advice of the Data Protection Officer, where designated, when carrying out a Data Protection Impact Assessment. (4) The Commissioner of Data Protection must publish a list of the kind of Processing operations which are subject to the requirement for a Data Protection Impact Assessment pursuant to section 34(1) and may review this list from time to time. (5) The Data Protection Impact Assessment must: (a) describe the nature, scope, context and purpose of the Processing; (b) assess necessity, proportionality and compliance measures; (c) identify and assess risks to individuals; and (d) identify any additional measures to mitigate the risks identified . (6) Where necessary, the Controller must carry out a review to assess if Processing is performed in accordance with the Data Protection Impact Assessment including when there is a change of the risk represented by Processing operations. (7) The Controller must notify the Commissioner of Data Protection prior to carrying out any Processing where a Data Protection Impact Assessment indicates that the Processing would be likely to result in a high risk to the rights of natural persons. The notification must contain information in section 34(5).

Reference :

DATA PROTECTION REGULATIONS 2021

Official text of ARE Data Protection Law in 2021

Extracts :

Extract :

33. Communication of a Personal Data Breach to the Data Subject (1) When the Personal Data Breach is likely to result in a high risk to the rights of natural persons, the Controller must communicate the Personal Data Breach to the Data Subject without undue delay. (2) The communication to the Data Subject referred to in section 33(1) must describe in clear and plain language the nature of the Personal Data Breach and contain at least the information and measures referred to in sections 32(3)(b), 32(3)(c) and 32(3)(d). The communication must where practical make recommendations for the natural person concerned to mitigate potential adverse effects and contain sufficient detail to allow him or her to take the necessary precautions. (3) The communication to the Data Subject referred to in section 33(1) is not required if any of the following conditions are met: (a) the Controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the Personal Data affected by the Personal Data Breach, in particular those that render the Personal Data unintelligible to any person who is not authorised to access it, such as encryption; (b) the Controller has taken subsequent measures which ensure that the high risk to the rights of Data Subjects referred to in section 33(1) is no longer likely to materialise; or (c) it would involve disproportionate effort (having regard to the number of Data Subjects, the age of the data and any appropriate safeguards adopted) . In such a case, there must instead be a public communication or similar measure whereby the Data Subjects are informed in an equally effective manner. (4) If the Controller has not already communicated the Personal Data Breach to the Data Subject, the Commissioner of Data Protection, having considered the likelihood of the Personal Data Breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to in section 33(3) are met.

Reference :

DATA PROTECTION REGULATIONS 2021

Official text of ARE Data Protection Law in 2021

Extracts :

Extract :

13. Right of access by the Data Subject (1) A Data Subject has the right to obtain from the Controller confirmation as to whether or not Personal Data concerning him or her is being Processed, and, where that is the case, access to the Personal Data and the following information: (a) the purposes of the Processing; (b) the categories of Personal Data concerned; (c) the Recipients or categories of Recipient to whom the Personal Data has been or will be disclosed, in particular Recipients outside of ADGM or International Organisations; (d) where possible, the envisaged period for which the Personal Data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the Controller rectification or erasure of Personal Data or restriction of Processing of Personal Data concerning the Data Subject or to object to such Processing; (f) the right to lodge a complaint with the Commissioner of Data Protection; (g) where the Personal Data is not collected from the Data Subject, any available information as to its source; and (h) the existence of automated decision-making, including Profiling, referred to in sections 20(1) and 20(4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such Processing for the Data Subject. (2) Where Personal Data is transferred outside of ADGM or to an International Organisation, the Data Subject has the right to be informed of the appropriate safeguards pursuant to section 41 relating to the transfer. (3) The Controller must provide a copy of the Personal Data undergoing Processing. For any further copies requested by the Data Subject, the Controller may charge a reasonable fee based on administrative costs. Where the Data Subject makes the request by electronic means, and unless otherwise requested by the Data Subject, the information must be provided in a commonly used electronic form. (4) The right to obtain a copy referred to in section 13(3) must not adversely affect the rights of others. (5) Where the Controller Processes a large quantity of information concerning the Data Subject, the Controller may request that, before the information is delivered, the Data Subject specify the information or Processing activities to which the request relates.

Reference :

DATA PROTECTION REGULATIONS 2021

Official text of ARE Data Protection Law in 2021

Extracts :

Extract :

15. Right to erasure (1) The Data Subject has the right to obtain from the Controller the erasure of Personal Data concerning him or her without undue delay and the Controller has the obligation to erase Personal Data without undue delay where one of the following applies: (a) the Personal Data is no longer necessary in relation to the purposes for which it was collected or otherwise Processed; (b) the Data Subject withdraws Consent on which the Processing is based according to section 5(1)(a) or 7(2)(a), and where there is no other legal ground for the Processing; (c) the Data Subject objects to the Processing pursuant to section 19(1) and there are no overriding legitimate grounds for the Processing, or the Data Subject objects to the Processing pursuant to section 19(3); (d) the Personal Data has been unlawfully Processed; or (e) the Personal Data has to be erased for compliance with a legal obligation in Applicable Law to which the Controller is subject. (2) Where the Controller has made the Personal Data public and is obliged pursuant to section 15(1) to erase the Personal Data, the Controller, taking account of available technology and the cost of implementation, must take reasonable steps, including technical measures, to inform Controllers which are Processing the Personal Data that the Data Subject has requested the erasure by such Controllers of any links to, or copy or replication of, that Personal Data. (3) Sections 15(1) and 15(2) will not apply to the extent that Processing is necessary: (a) for compliance with a legal obligation which requires Processing under Applicable Law to which the Controller is subject or for the performance of a task carried out by a public authority in the interests of ADGM, or in the exercise of (i) ADGM’s; (ii) the Financial Services Regulatory Authority’s; (iii) the ADGM Court’s; and (iv) the Registration Authority’s functions or in the exercise of official authority vested in the Controller; (b) for reasons of public interest in the area of public health in accordance with sections 7(2)(d) and 7(2)(e); (c) for Archiving and Research Purposes to the extent that the right referred to in section 15(1) is likely to render impossible or seriously impair the achievement of the objectives of that Processing, or (d) for the establishment, exercise or defence of legal claims. (4) Where erasure of Personal Data is not feasible for technical reasons, then the Controller is not in violation of these Regulations for failing to comply with a request for erasure of the Personal Data under section 15(1), if: (a) the Controller collected the Personal Data from the Data Subject; and (b) the information provided to the Data Subject under section 11(2)(h) was explicit, clear and prominent with respect to the manner of Processing the Personal Data and expressly stated that erasure of the Personal Data at the request of the Data Subject would not be feasible.

Reference :

DATA PROTECTION REGULATIONS 2021

Official text of ARE Data Protection Law in 2021

Extracts :

Extract :

40. General principle for transfers (1) All provisions in this Part must be applied to ensure that the high level of protection of Personal Data guaranteed by these Regulations is not undermined. (2) Any transfer of Personal Data that is undergoing Processing or is intended for Processing after transfer to a jurisdiction outside of ADGM or to an International Organisation can only take place if, subject to the other provisions of these Regulations, the conditions in this Part are complied with by the Controller and Processor, including for further onward transfers of Personal Data. 41. Transfers on the basis of an adequacy decision (1) A transfer of Personal Data outside of ADGM or to an International Organisation may take place where the Commissioner of Data Protection has decided that the receiving jurisdiction, one or more specified sectors within that jurisdiction, or the International OrganisationinquestionensuresanadequatelevelofprotectionofPersonalData.Such a transfer will not require any specific authorisation. (2) When assessing the adequacy of the level of protection of Personal Data, the Commissioner of Data Protection must, in particular, take account of the following elements: (a) the rule of law, respect for individuals’ rights, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to Personal Data, as well as the implementation of such legislation, data protection rules, professional rulesandsecuritymeasures,includingrulesfortheonwardtransferof Personal Data to another jurisdiction, sector or International Organisation which are complied with in that jurisdiction, sector or International Organisation, case-law, as well as effective and enforceable Data Subject rights and effective administrative and judicial redress for the Data Subjects whose Personal Data is being transferred; (b) the existence and effective functioning of one or more independent supervisory authorities in the receiving jurisdiction or sector or to which an International Organisation is subject, with responsibility for ensuring and enforcing compliance with adequate data protection rules described in section 41(2)(a), including adequate enforcement powers, for assisting and advising the Data Subjects in exercising their rights and for cooperation with the Commissioner of Data Protection; and (c) the international commitments the receiving jurisdiction, sector or International Organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of Personal Data. 3) The Commissioner of Data Protection, after assessing the adequacy of the level of protection, may decide that a jurisdiction outside of ADGM, or one or more specified sectors within a jurisdiction outside of ADGM, or an International Organisation ensures an adequate level of protection: (a) within the meaning of section 41(2); or (b) on the basis that the jurisdiction, sector or International Organisation has received an adequacy decision by the European Commission in accordance with Article 45(3) of the GDPR. In each case the Commissioner of Data Protection must provide for a review of the decision within four years, which must take into account all relevant developments in the jurisdiction outside of ADGM or International Organisation. (4) The Commissioner of Data Protection must, on an ongoing basis, monitor developments in jurisdictions outside of ADGM and International Organisations that could affect the functioning of decisions adopted pursuant to section 41(3). (5) The Commissioner of Data Protection must, where available information reveals, in particular following the review referred to in section 41(3), that a jurisdiction outside of ADGM or one or more specified sectors within a jurisdiction outside of ADGM, or an International Organisation no longer ensures an adequate level of protection within the meaning of section 41(2), to the extent necessary, repeal, amend or suspend the decision referred to in section 41(3) without retroactive effect. (6) The Commissioner of Data Protection must publish a list of the jurisdictions outside of ADGM and specified sectors within jurisdictions outside of ADGM and International Organisations for which it has decided that an adequate level of protection is or is no longer ensured. (7) Jurisdictions designated as providing an adequate level of protection for Personal Data under section 4 of the ADGM Data Protection Regulations 2015 will remain valid until amended, replaced or repealed by the Commissioner of Data Protection.

Reference :

DATA PROTECTION REGULATIONS 2021

Official text of ARE Data Protection Law in 2021

Extracts :

Extract :

Binding Corporate Rules (1) The Commissioner of Data Protection may approve Binding Corporate Rules, provided that they: (a) have the following features: (i) are legally binding and apply to and are enforced by every member concerned of the Group, including their employees; (ii) expressly confer enforceable rights on Data Subjects with regard to the Processing of their Personal Data; and (iii) fulfil the requirements in section 43(2), or (b) have already been approved by a Supervisory Authority for the same purpose. (2) TheBindingCorporateRulesreferredtoinsection43(1)mustspecifyatleast: (a) the structure and contact details of the Group and of each of its members; (b) the details of the data transfers, including the categories of Personal Data, the type of Processing and its purposes, the type of Data Subjects affected and the identification of the relevant jurisdiction(s) outside of ADGM; (c) their legally binding nature, both internally and externally; (d) the application of the general data protection principles, including purpose limitation, data minimisation, limited storage periods, data quality, data protection by design and by default, legal basis for Processing, Processing of Special Categories of Personal Data, measures to ensure data security, and the requirements in respect of onward transfers to bodies not bound by the Binding Corporate Rules; (e) the rights of Data Subjects and the means to exercise those rights, including the right to obtain redress and, where appropriate, compensation for a breach of the Binding Corporate Rules; (f) how the information on the Binding Corporate Rules, in particular on the provisionsreferredtoinsections43(2)(d)and43(2)(e)areprovidedtotheData Subjects in addition to sections 11 and 12; (g) the tasks of any Data Protection Officer designated in accordance with section 35 or any other person or entity in charge of monitoring compliance with the Binding Corporate Rules within the Group; (h) the complaint procedures; (i) the mechanisms within the Group for monitoring compliance with the Binding Corporate Rules and cooperating with the Commissioner of Data Protection to ensure compliance. Such mechanisms must include data protection audits and methods for ensuring corrective actions to protect the rights of Data Subjects. Results of such monitoring activities should be communicated to the board of the parent company of a Group, and should be made available to the Commissioner of Data Protection upon request; (j) the procedures for reporting and recording changes to the rules and reporting those changes to the Commissioner of Data Protection; (k) the reporting mechanisms for notifying the Commissioner of Data Protection of any legal requirements to which a member of the Group, is subject outside of ADGM and which are likely to have a substantial adverse effect on the protections provided by the Binding Corporate Rules; and (l) the data protection training provided to personnel with permanent or regular access to Personal Data.

Reference :

DATA PROTECTION REGULATIONS 2021

Official text of ARE Data Protection Law in 2021

Extracts :

Extract :

Designation of the Data Protection Officer (1) The Controller and the Processor must appoint a person to perform the tasks listed in section 37 (a ‘Data Protection Officer’) where: (a) the Processing is carried out by a public authority, except for courts acting in their judicial capacity; (b) the core activities of the Controller or the Processor consist of Processing operations which, by virtue of their nature, scope and purposes, require regular and systematic monitoring of Data Subjects on a large scale; or (c) the core activities of the Controller or the Processor consist of Processing on a large scale of Special Categories of Personal Data. (2) A Data Protection Officer: (a) may be appointed in respect of a single entity, a Group or multiple, independent entities; (b) may perform additional roles in respect of a Controller or Processor in addition to performing the role of Data Protection Officer; (c) does not need to be an employee of the relevant Controller or Processor provided it enters into an agreement in writing with the Controller, or Processor, as the case may be; and (d) does not need to be resident within ADGM, in each case, provided that the Data Protection Officer is easily accessible by each entity it acts for, and no other role held by the Data Protection Officer conflicts or is likely to conflict with the Data Protection Officer’s obligations under these Regulations. (3) The Data Protection Officer must be appointed on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in section 37. (4) The Controller or the Processor must notify the Commissioner of Data Protection within one month following the appointment or resignation of any Data Protection Officer. The notification must include the contact details of the new Data Protection Officer and, in the case of a resignation, reasons for the resignation.

Reference :

DATA PROTECTION REGULATIONS 2021

Official text of ARE Data Protection Law in 2021

Extracts :

Extract :

(f) where applicable, the fact that the Controller intends to transfer Personal Data to a Recipient outside of ADGM or to an International Organisation and: (i) the existence or absence of an adequacy decision by the Commissioner of Data Protection; or (ii) inthecaseoftransfersreferredtoinsections42,43,orsection44(1)(b), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available. (2) In addition to the information referred to in section 11(1), the Controller must, at the time when Personal Data is obtained, provide the Data Subject with the following further information necessary to ensure fair and transparent Processing: (a) the period for which the Personal Data will be stored, or if that is not possible, the criteria used to determine that period; (b) the existence of the rights set out in sections 13 to 16, 18 and 19; (c) where the Processing is based on either of sections 5(1)(a) or 7(2)(a): (i) the existence of the right to withdraw Consent at any time; and (ii) that the lawfulness of any Processing based on Consent prior to that withdrawal will not be affected by the subsequent withdrawal of Consent; (d) the right to lodge a complaint with the Commissioner of Data Protection; (e) whether the provision of Personal Data is a requirement under Applicable Law, a contractual requirement, or a requirement necessary to enter into a contract; (f) whether the Data Subject is obliged to provide the Personal Data and the possible consequences of failure to provide such data; (g) the existence of automated decision-making, including Profiling, referred to in sections 20(1) and 20(4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such Processing for the Data Subject; and (h) if the Controller intends to Process Personal Data in a manner that will restrict or prevent the Data Subject from exercising their rights to request rectification or erasure of Personal Data in accordance with sections 14(1) or 15(1), or to object to the Processing of the Personal Data in accordance with section 19. In such cases, the Controller must: (i) include a clear and explicit explanation of the expected impact on such rights; and (ii) satisfy itself that the Data Subject understands and acknowledges the extent of any such restrictions.

Reference :

DATA PROTECTION REGULATIONS 2021

Official text of ARE Data Protection Law in 2021

Actors
Name	Short name	Classification	Jurisdiction	Year of creation

Texts
Legal text name	Original text name	Legislation type	Year signed	Regulation status	In effect since	Latest update initiated	Latest update areas	Latest update signed year

🇦🇪 Dubai International Financial Center

Data subject classification

Citizens outside their jurisdiction are considered as data subjects : Yes

Persons within their jurisdiction are considered as data subjects : Yes

Legal entities are considered as data subjects : No

Data controller definition and responsibilities

Organizations located outside the jurisdiction processing regulated subjects data are considered as data controllers within the personal data legislation : Yes

Organizations with economic activities within the jurisdiction are considered as data controllers within the personal data legislation : Yes

Organizations located outside the jurisdiction monitoring regulated subjects data are considered as data controllers within the personal data legislation : Yes

Differentiation between how data controller and data processor are defined : Yes

Special/sensitive personal data definition

Definition of personal data that are "special" or "sensitive": financial data : No

Definition of personal data that are "special" or "sensitive": biometric data : Yes

Definition of personal data that are "special" or "sensitive": genetic data : Yes

Definition of personal data that are "special" or "sensitive": medical/health data : Yes

Definition of personal data that are "special" or "sensitive": criminal records data : Yes

Definition of personal data that are "special" or "sensitive": racial/ethnic origin : Yes

Definition of personal data that are "special" or "sensitive": political opinions : Yes

Definition of personal data that are "special" or "sensitive": religious/philosophical beliefs : Yes

Definition of personal data that are "special" or "sensitive": trade union membership : No

Definition of personal data that are "special" or "sensitive": geo-location data : No

Legal bases for data processing

Potential legal bases for processing personal data: appropriate notice has been provided to or made available to the data subject : No

Potential legal bases for processing personal data: the data subject has provided consent to the processing for the identified purposes : Yes

Potential legal bases for processing personal data: the personal data is necessary to perform a contract with the data subject : Yes

Potential legal bases for processing personal data: the personal data is necessary to comply with a legal obligation : Yes

Potential legal bases for processing personal data: the personal data is necessary to protect the vital interests of a natural person : Yes

Potential legal bases for processing personal data: the personal data is necessary for a public interest : Yes

Potential legal bases for processing personal data: the personal data is necessary to fulfil a legitimate interest of the controller or third party : Yes

Enforcement and penalties

Provision of criminal penalties - imprisonment : No

Provision of administrative penalties by laws : Yes

Consideration of turnover rates for penalties? : No

Provision of criminal penalties - fines : No

Subject private remedies - presence of individual personal actions? : Yes

Subject private remedies - representative actions? : Yes

Subject private remedies - class actions? : Yes

Subject private remedies - file complaints with Data Protection Authorities? : Yes

Data processing and security controls

Requirement of a DPIA : Yes

Ensuring encryption/pseudonymisation as a security control : Yes

Requirement for Controller to notify subjects of a data breach : Yes

Requirement for Controller to notify DPA of a data breach : Yes

Requirement for Processor to notify controller of data breach : Yes

Requirement for Processor to notify DPA of data breach : Yes

Requirement for Processor to notify subjects of data breach : Yes

Obligation to maintain information security control to protect personal data from unauthorized access or processing: general technical/physical/organizational security controls : Yes

Rights of data subjects

Right to object data use or/opt out : Yes

Right to data portability : Yes

Right against automated decision making : Yes

Right to be informed : Yes

Consent required for processing children's data : No

Right to access information : Yes

Right to rectification : Yes

Right to erase : Yes

Right to withdraw consent : Yes

Right to restrict data processing : Yes

International data transfer and data localization

Legal basis for international data transfer: approved jurisdictions : Yes

Legal basis for international data transfer: approved standard contractual clauses : Yes

Legal basis for international data transfer: derogations, such as consent, contract performance, necessity to establish, exercise or defend legal claims : Yes

Legal basis for international data transfer: binding corporate rules : Yes

Data localisation requirements: retention of personal data in local jurisdiction : No

Data localisation requirements: tax or financial record laws : No

Legal basis for international data transfer: EU/EEA adequacy : No

Legal basis for international data transfer: Convention 108 : No

Data localisation requirements: national security laws : No

Legal basis for international data transfer: APEC CBPRs : No

Data localisation requirements (such data is part of another type of record or dataset): retention or storage of personal data in the local jurisdiction or otherwise prohibit the transfer or disclosure of the personal data outside of the local jurisdiction : No

Data localisation requirements: anti-investigatory/blocking statutes that restrict any activity on local territory that aids a foreign government investigation : No

Data localisation requirements: other data localization regulations (export control laws/medical laws/employment laws etc.) : No

Data protection officer (DPO) requirements

Mandatory appointment of a DPO : Yes

Requirement of professional/legal qualification/expert knowledge for DPO : Yes

Clear DPO role specification : Yes

Group appointments: a group of undertakings to appoint a single DPO : Yes

Privacy notice requirements

To inform subjects via privacy notice: the existence of subject rights : Yes

To inform subjects via privacy notice: Controller/controller's representative contact details : Yes