TRW & Co · Data, Privacy & Cyber
ADGM Data Protection
ADGM data protection governs how businesses in the Abu Dhabi Global Market handle personal data under the Data Protection Regulations 2021, a regime closely modelled on the GDPR. New rules for special category data in 2025, the Al Reem expansion and 2026 mutual adequacy with the DIFC and QFC make this a good moment to review compliance.
Key pointADGM is the UAE regime closest to the GDPR, but a European policy is not enough: ADGM entities need ADGM-specific transfer mechanisms, a 72-hour breach plan and documented special category conditions, and Al Reem businesses may now be inside the regime without realising it.
At a glance
GDPR-style Regulations
The ADGM Data Protection Regulations 2021 follow the GDPR closely, covering lawful bases, rights, accountability, breach notification, transfers and enforcement by the Commissioner.
New SPI Rules
Rules adopted on 9 September 2025 allow special category data to be processed for insurance and safeguarding purposes, subject to documented safeguards.
Al Reem now included
Cabinet Resolution No. 41 of 2023 extended ADGM jurisdiction to Al Reem Island, bringing many more businesses within ADGM licensing and data rules.
Seventy-two hour expectation
Breaches must be reported to the Commissioner without undue delay and, where feasible, within 72 hours unless unlikely to pose a risk to individuals.
Regional mutual adequacy
Since January 2026, ADGM, the DIFC and the Qatar Financial Centre recognise each other as adequate, easing transfers between the three centres.
Swipe or scroll →
What ADGM data protection covers
ADGM data protection is the regime that governs how personal data is collected, used, shared, secured and transferred by businesses in the Abu Dhabi Global Market. Its core is the ADGM Data Protection Regulations 2021, a framework closely modelled on the EU General Data Protection Regulation and supervised by ADGM's Commissioner of Data Protection.
It applies to controllers and processors established in ADGM, whatever their sector: banks and asset managers regulated by the FSRA, family offices, holding companies, technology firms, clinics, schools and the service providers that support them. Personal data includes customer files, employee records, CCTV footage, investor KYC and online identifiers.
The question becomes urgent at familiar moments: opening an ADGM entity, launching a product, onboarding a cloud or payroll provider, sending data to a parent abroad, responding to an access request from an employee in dispute, or handling a breach. Each of these has specific ADGM requirements that differ in places from the federal law that applies elsewhere in Abu Dhabi.
The legal framework for ADGM data protection
The Regulations and the Commissioner
The Data Protection Regulations 2021 set out the principles, lawful bases, data subject rights, accountability duties, breach notification, international transfer rules and enforcement powers. They are supported by rules and guidance issued by ADGM's Office of Data Protection, which also runs the breach reporting channel. The full texts are on the ADGM rules and regulations page.
On 9 September 2025 ADGM adopted the Data Protection Regulations (Substantial Public Interest Conditions) Rules 2025. They add conditions allowing special category data to be processed where necessary for insurance purposes, and to protect children and at-risk individuals from harm, provided the controller documents its reliance on the condition, keeps processing necessary and proportionate, and applies appropriate safeguards.
Geographic scope and Al Reem Island
Cabinet Resolution No. 41 of 2023 extended ADGM's jurisdiction from Al Maryah Island to include Al Reem Island. Businesses there had a transitional period to the end of 2024 to obtain ADGM licences, and Abu Dhabi courts have since treated the expansion as having immediate effect for jurisdiction purposes. For data protection, that means many Al Reem businesses that once looked only at the federal law must now apply ADGM data protection rules as well.
Relationship with the federal PDPL and sector rules
The federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, excludes free zones that have their own data protection legislation, so ADGM entities apply the ADGM Regulations rather than the PDPL to their ADGM processing. A group with an onshore Abu Dhabi company and an ADGM holding or service company will often run both regimes side by side; see our page on federal personal data protection in the UAE.
Sector rules sit on top. FSRA-regulated firms have conduct, outsourcing and record-keeping duties under the ADGM financial regulation framework. Health providers licensed by Abu Dhabi's Department of Health must apply its health information and cyber security standard, which requires health information to stay in the UAE. Federal health data law imposes similar localisation.
| Issue | ADGM | DIFC | Federal PDPL |
|---|---|---|---|
| Main instrument | Data Protection Regulations 2021 | DIFC Data Protection Law 2020, amended 2025 | Federal Decree-Law No. 45 of 2021 |
| Regulator | ADGM Commissioner of Data Protection | DIFC Commissioner of Data Protection | Federal regulator; implementing regulations still awaited |
| Model | Closely follows the GDPR | GDPR-influenced with DIFC-specific features | GDPR-influenced, less detailed |
| Breach notice to regulator | Without undue delay and, where feasible, within 72 hours | As soon as practicable | On becoming aware; detail left to regulations |
| Mutual adequacy | Recognised with DIFC and QFC from January 2026 | Recognised with ADGM and QFC from January 2026 | Transfer rules depend on regulations not yet issued |
Core obligations for controllers and processors
Lawful basis and transparency
Every processing activity needs a lawful basis, such as consent, performance of a contract, a legal obligation or legitimate interests. Special category data, such as health, biometric or religious information, needs an additional condition, which the 2025 Rules expanded for insurance and safeguarding. Individuals must receive a clear privacy notice explaining purposes, recipients, transfers and retention.
Data subject rights
Individuals can request access, rectification, erasure, restriction, portability and object to certain processing, including direct marketing. Access requests are often used tactically in employment disputes, so HR teams need a process for locating, reviewing and redacting records within the response period.
Accountability
Controllers must keep records of processing, apply data protection by design and default, carry out impact assessments for high-risk processing and appoint a data protection officer where the Regulations require one, for example for large-scale processing of special category data. Security must be appropriate to the risk, and processors must be engaged under written contracts with mandatory terms, covered on our page on data-processing agreements.
Breach notification
Personal data breaches must be reported to the Commissioner without undue delay and, where feasible, within 72 hours of becoming aware, unless unlikely to result in a risk to individuals. High-risk breaches must also be communicated to affected individuals. Our page on data breach response in the UAE sets out a response plan across regimes.
ADGM data protection is closer to the GDPR than any other UAE regime, which helps international groups, but only if they apply ADGM's own rules, timelines and transfer requirements rather than assuming a European policy is enough.
International transfers from ADGM
Any transfer of personal data outside ADGM, including to a group company in onshore Abu Dhabi or Dubai, needs a lawful mechanism. The three routes follow the GDPR pattern.
First, transfers to jurisdictions recognised as providing adequate protection. Since January 2026, ADGM, the DIFC and the Qatar Financial Centre have recognised each other's regimes as adequate, so transfers between them need no additional transfer mechanism, as announced by the Qatar Financial Centre. Check ADGM's current list before relying on adequacy for any other destination.
Second, appropriate safeguards, such as standard data protection clauses recognised in ADGM or binding corporate rules. Third, specific derogations, such as explicit informed consent or necessity for a contract or legal claims, which suit occasional transfers but not routine data flows. Adequacy deals only with the transfer itself: lawful basis, minimisation, security and sector rules still apply. For a wider view, see cross-border data transfers in the UAE.
Health data handled by an ADGM clinic or a wellness business is likely to be subject to Abu Dhabi health localisation rules as well as ADGM data protection. A transfer mechanism that satisfies the Regulations does not override a localisation requirement, so check sector rules before using a global cloud or HR platform.
Common processing scenarios in ADGM
Employees and HR
Employers process salary, visa, medical and performance data, and often monitor email, devices and premises. Monitoring should be justified, proportionate and explained in an employee privacy notice, and an impact assessment is sensible where it is systematic. Medical information from insurers or occupational health providers is special category data and should be kept separate from general HR files. When employment ends, retention periods should reflect limitation periods and record-keeping duties, not a default of keeping everything.
Investors, clients and KYC
Fund managers, banks and family offices collect identity documents, source-of-wealth information and screening results. Anti-money laundering rules require much of this to be kept, which supports a legal obligation basis, but the data should not be reused for marketing or analytics without a separate lawful basis. Where KYC is outsourced to a group centre or a vendor abroad, the transfer and processor terms must cover it.
Marketing, websites and AI tools
Electronic marketing, cookies and tracking technologies need a lawful basis and clear information, and individuals can object to direct marketing at any time. Generative AI and analytics tools raise questions about training data, accuracy, automated decisions and transfers to the tool provider. Before deploying them on client or employee data, record the purpose, check the provider's terms and hosting location, and consider an impact assessment.
Government and semi-government clients
ADGM service providers that work for Abu Dhabi government or semi-government entities often find that the client's contract imposes stricter rules than the Regulations: data hosted only in the UAE, security clearances for staff, approval before any sub-contracting and audit rights. Read these clauses alongside the Regulations, because breaching a localisation or security commitment can end the contract even where no data protection rule was broken. Build them into vendor selection and disaster recovery planning from the start.
Building an ADGM data protection programme, step by step
- Confirm scope. Identify every group entity licensed in ADGM, including Al Reem entities, and which processing each controls or performs for others.
- Map data and flows. Record categories of data and individuals, systems, vendors, retention and every transfer outside ADGM, including to onshore UAE.
- Set lawful bases and notices. Assign a lawful basis and any special category condition to each activity, and update privacy notices for customers, investors, staff and website users.
- Govern vendors and transfers. Put compliant processor terms in place, select a transfer mechanism for each flow and document transfer risk assessments where needed.
- Assess high-risk processing. Run impact assessments for monitoring, profiling, AI tools, biometrics and large-scale special category data, and decide on DPO appointment.
- Prepare for incidents and requests. Adopt a breach plan geared to the 72-hour expectation and a process for rights requests, with named owners and templates.
- Train and review. Train staff, test the breach plan, audit key vendors and review the programme when ADGM issues new rules or guidance.
Documents and evidence to hold
- Record of processing activities covering each ADGM entity.
- Privacy notices for customers, investors, employees, job applicants and website visitors.
- Lawful basis and special category condition analysis, including documentation required by the 2025 Rules.
- Data protection impact assessments and DPO appointment records or reasons for not appointing.
- Processor and sub-processor contracts, and transfer mechanism records.
- Information security policies, access controls and incident logs, including a breach register.
- Data subject request logs and retention and deletion schedules.
The Commissioner can ask for this evidence during an inquiry, and counterparties increasingly request it in due diligence for fund launches, acquisitions and outsourcing.
Risks and common mistakes
Assuming the federal PDPL applies to the ADGM entity
Groups that set up an ADGM holding or service company sometimes copy onshore policies drafted for the federal law. The ADGM Regulations are more detailed and closer to the GDPR, with different breach timelines, transfer rules and accountability duties. The result can be a policy suite that is non-compliant in ADGM and over-engineered onshore. Map which entity controls which data, then align policies to the regime that actually applies, and keep the onshore and ADGM versions consistent where staff or systems are shared.
Overlooking the Al Reem expansion
Businesses on Al Reem Island that were licensed onshore for years may now fall within ADGM's jurisdiction, with ADGM licensing and ADGM data protection obligations. Some only discover the change in a dispute, when the Abu Dhabi courts decline jurisdiction in favour of the ADGM Courts. Confirm the licensing position, update privacy notices and contracts to reflect the ADGM entity, and check whether existing transfer arrangements still work now that the data is leaving ADGM rather than moving within the onshore UAE.
Treating mutual adequacy as a full compliance answer
Recognition between ADGM, the DIFC and the QFC removes the need for extra transfer safeguards between those centres. It does not cover transfers to onshore UAE entities, Saudi Arabia or other GCC states, and it does not relax the rules on lawful basis, minimisation, security or retention. Sector requirements, such as banking secrecy or health localisation, still apply. Keep transfer records for every destination and do not extend the adequacy finding beyond what was announced.
Weak processor contracts with global vendors
Global SaaS terms are often written for the GDPR and refer only to EU or UK law. They may lack ADGM-specific transfer terms, audit rights or breach notification timelines that allow the controller to meet its 72-hour expectation. If the vendor uses sub-processors in several countries, each onward transfer needs a mechanism. Negotiate an ADGM addendum, confirm where data is hosted and supported from, and diary reviews of sub-processor changes.
Missing the special category conditions
Insurers, brokers, employers, schools and clinics regularly process health data and other special category data. Before September 2025, some relied on consent where consent was not freely given. The 2025 Rules provide clearer conditions for insurance and safeguarding purposes, but only if the controller documents its reliance and keeps processing necessary and proportionate. Review each special category use, document the condition and record why consent is not used where the Rules allow that.
Cross-border angle: groups in Bangladesh, the UK, Saudi Arabia and Asia
ADGM entities are often part of groups whose data flows run to London, Riyadh, Mumbai, Dhaka, Singapore or Shanghai. Each destination needs a lawful transfer route under ADGM data protection, and the receiving entity may have its own obligations under local law.
UK and EU groups will find the ADGM concepts familiar, but should not assume their GDPR transfer tools work automatically. Saudi Arabia has its own Personal Data Protection Law and implementing regulations, on which SDAIA consulted on amendments in 2026, so data moving between Abu Dhabi and Riyadh is regulated at both ends. India, Singapore and China each impose their own consent, transfer or localisation rules on data sent from or to them. Bangladesh's framework is developing, so contractual protections carry more of the weight for data sent there.
Where a group shared service centre in Bangladesh or India supports an ADGM fund manager or family office, the contract, transfer mechanism and security controls should be designed together, with clear allocation of controller and processor roles.
How TRW & Co helps with ADGM data protection
We advise on design, documentation and incident handling, and coordinate with technical and forensic specialists. Where representation before the ADGM Courts or other courts is required, we work alongside locally licensed advocates and registered practitioners.
Scoping and gap analysis
We confirm which group entities fall under ADGM, DIFC or federal rules and benchmark current practice against the 2021 Regulations and 2025 Rules.
Policies and notices
We draft privacy notices, records of processing, retention schedules and internal policies that reflect how the business actually works.
Vendor and transfer terms
We negotiate processor terms, ADGM addenda and transfer mechanisms with cloud, payroll and outsourcing providers.
Impact assessments
We run impact assessments for AI tools, monitoring, biometrics and health data, linking to our AI governance work.
Breaches and requests
We support breach triage, Commissioner notifications and complex access requests, especially in employment disputes.
Transactions
We conduct data protection due diligence and draft data provisions for acquisitions, fund launches and outsourcing.
Related reading: DIFC data protection, the ADGM Data Protection Regulations explained, data localisation rules and all our practices.
Checklist for decision-makers
- Which group entities, including any on Al Reem Island, are subject to ADGM data protection?
- Is there an up-to-date record of processing and data map for each?
- Does every activity have a lawful basis, and every special category use a documented condition?
- Are processor contracts and transfer mechanisms in place for every vendor and destination?
- Do health, banking or government data flows face localisation rules beyond the Regulations?
- Is a DPO required, and are impact assessments done for high-risk processing?
- Can the business notify the Commissioner within 72 hours where feasible?
- Who reviews new ADGM rules and guidance and updates the programme?
To discuss your ADGM data protection position, contact TRW & Co at info@trw.co or +971 58 942 1012.
Frequently asked questions
01Does the federal PDPL apply to ADGM companies?
Generally not for their ADGM processing. The federal Personal Data Protection Law excludes free zones that have their own data protection legislation, and ADGM has the Data Protection Regulations 2021. An ADGM company that also has onshore branches or group companies may find the federal law applies to those entities. Sector rules, such as federal and Abu Dhabi health data requirements or financial regulation, can apply alongside ADGM data protection whatever the entity’s location.
02Do we need a data protection officer in ADGM?
Not every ADGM entity needs one. The Regulations require a data protection officer in specified cases, such as where core activities involve large-scale processing of special category data or large-scale systematic monitoring of individuals. Public authorities and some regulated activities may also trigger the requirement. If you decide not to appoint, record the reasons. Many firms appoint a privacy lead in any case, because someone must own breach response, impact assessments and rights requests.
03How quickly must we report a breach in ADGM?
A controller must notify the Commissioner of Data Protection without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals. Where the risk to individuals is high, they must also be told without undue delay. Processors must alert their controller promptly. Keep a breach register of every incident, including those not notified, as the Commissioner may ask to see it.
04Can we send data from ADGM to our Dubai or onshore office?
Yes, but it is a transfer outside ADGM and needs a lawful mechanism. Since January 2026, transfers between ADGM, the DIFC and the Qatar Financial Centre benefit from mutual adequacy recognition. Transfers to onshore UAE entities, including those in Dubai mainland or other free zones, need another basis, such as recognised standard clauses or a permitted derogation. Check sector rules too, because health and some financial data may also be subject to localisation requirements.
05What changed with the 2025 Substantial Public Interest Rules?
Adopted on 9 September 2025, the Rules add conditions allowing special category data to be processed where necessary for reasons of substantial public interest in two areas: insurance activity, from advice and underwriting to claims, and protecting children and at-risk individuals from harm. Controllers must document their reliance on the condition, keep processing strictly necessary and proportionate, and apply appropriate safeguards. They are particularly relevant to insurers, brokers, employers, schools and health providers in ADGM.
06What can the ADGM Commissioner do if we breach the Regulations?
The Commissioner can investigate, require information, issue directions and warnings, and impose financial penalties for contraventions of the Regulations. Individuals can complain to the Commissioner and may pursue remedies, including compensation, through the ADGM Courts. Regulatory findings can also have knock-on effects for FSRA-regulated firms and in commercial relationships. Early, cooperative engagement and good records usually improve the outcome, so prepare an evidence file before any inquiry arrives.
07Can TRW & Co represent us before the ADGM Commissioner or Courts?
We advise on compliance strategy, prepare submissions and documents, and coordinate the response to Commissioner inquiries and data subject complaints. Where representation before the ADGM Courts or onshore courts is required, we work alongside locally licensed advocates and registered practitioners so that clients have one coordinated team. Contact us at info@trw.co or +971 58 942 1012 to discuss an inquiry, a breach or a compliance review.
Sources and official materials
- ADGM Office of Data Protection — Regulations, guidance and breach reporting
- ADGM rules and regulations — Data Protection Regulations 2021 and 2025 Rules
- QFC, ADGM and DIFC reciprocal adequacy recognition — Mutual adequacy announcement, 2026
- UAE Government portal: Data protection laws — Federal and free zone data protection overview
- Department of Health, Abu Dhabi — Health information and cyber security standards
- ADGM Courts — Courts with jurisdiction over ADGM matters
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
