ADGM DPR

Abu Dhabi Global Market (UAE free zone) Privacy

Status

In force since 14 February 2021 (transition periods have ended).✓Sources: assets.adgm.com, taylorwessing.com

Who it applies to

Processing by controllers/processors established in or operating out of ADGM, wherever the processing takes place, including outside ADGM.✓Sources: assets.adgm.com, taylorwessing.com, tamimi.com

Size thresholds

Applies to all ADGM entities. Firms with fewer than 5 employees are exempt from DPO appointment unless they do high-risk processing.✓Sources: adgm.com, taylorwessing.com, tamimi.com

Regulator

Commissioner of Data Protection, ADGM Office of Data Protection✓Sources: adgm.com, taylorwessing.com

Breach or incident reporting

Notify the Commissioner within 72 hours of becoming aware, unless unlikely to risk individuals' rights; explain any delay. Tell affected people without undue delay if the breach is high risk.✓Sources: assets.adgm.com, taylorwessing.com, tamimi.com

Deadline to answer personal data requests

Two months from receipt, extendable by one further month (three months in total) for complex or numerous requests; the person must be told of the extension within the first two months.✓Sources: assets.adgm.com, assets.adgm.com, tamimi.com

Data protection officer

Required in certain cases (e.g., high-risk processing). Need not be ADGM-based or an employee, but must have expert data protection knowledge.✓Sources: assets.adgm.com, taylorwessing.com, tamimi.com

Local representative

No separate representative requirement found; entities are ADGM-registered.✓Sources: assets.adgm.com, taylorwessing.com

Sending data abroad

Allowed to jurisdictions the Commissioner deems adequate (e.g., EU, UK), or with safeguards such as ADGM Standard Contractual Clauses or approved Binding Corporate Rules, or under derogations such as explicit informed consent or contract necessity.✓Sources: assets.adgm.com, assets.adgm.com, assets.adgm.com

Cookies and consent

Being verified

Maximum penalty

Administrative fines of up to USD 28 million; failing to pay the data protection fee can attract fines of up to 150% of the fee. Individuals can also claim compensation.✓Sources: assets.adgm.com, taylorwessing.com, tamimi.com

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

• Register with the Office of Data Protection and pay the annual data protection fee.
• Report qualifying breaches to the Commissioner without undue delay, within 72 hours where feasible.
• Answer data subject requests within two months (extendable by one month).
• Appoint a DPO where required, e.g., for high-risk processing.

Recent changes

9 September 2025: ADGM amended the DPR 2021 to let the Board set further special-category conditions by Rules, and issued the Substantial Public Interest Conditions Rules 2025 on processing special category data.✓

Sources

• Primary source: https://www.adgm.com/operating-in-adgm/office-of-data-protection
• Second source: https://www.taylorwessing.com/en/insights-and-events/insights/2021/04/new-abu-dhabi-global-market-data-protection-law---key-changes-you-need-to-consider
• Regulator: Commissioner of Data Protection, ADGM Office of Data Protection

✓ = confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.