UAE New Data Privacy Law
The Current Status of UAE Data Privacy Regulations
The UAE does not have a comprehensive data privacy law at its federal level and there is no single national data privacy regulator. However, the UAE has a number of special economic or sector free zones, three of which have specific data privacy laws: The Dubai International Financial Center (DIFC), the Abu Dhabi Global Market (ADGM) and the Dubai Healthcare City (DHCC).
In addition, the UAE has a number of laws to govern privacy and data security in the UAE across public sectors, financial services (Central Bank of the UAE) and in the healthcare sector. There are also sector-specific data protection provisions in certain laws. These laws require data subjects to provide consent to the transfer of personal data to third parties inside or outside the UAE, and prohibit the transfer of data to jurisdictions with less stringent requirements. This includes other parts of the UAE outside the respective free zones. These prohibitions are not generally enforced in practice, but could give rise to a claim by an individual who believes their data has been dealt with in breach of the applicable laws.
The UAE data localization policy is based on assumptions that localizing the data makes it safer and prevents foreign law enforcement from accessing data. nIt is also seen as a means of attracting and locking ICT investment into the country.
U.S. Companies’ Challenges with the Current Data Privacy Requirements in the UAE include increased cost of doing business, limited access to innovation in cloud computing, and issues relating to cross border data flows and trade.
Opportunities for U.S. companies in the current and evolving data privacy environment in the UAE center on to sharing best practices for data privacy and certification mechanisms for cross-border transfers of data with U.S. and UAE policymakers.
UAE Defense Sector Opportunities
UAE defense sector spending increased by 38 percent in 2019 and is expected to remain strong in 2020, offering opportunities for U.S. companies. In addition to opportunities, though, it comes with complex offset obligations that are paramount to understand. A company incurs offset obligations if the value of the supply contract is equal to or more than $10 million, and if the value is less than $10 million, but the company already has active offset obligation.
U.S. companies who would like to learn more about these opportunities or about the UAE offsets program can contact George Messiha at the U.S. Commercial Service Abu Dhabi at office.abudhabi@trade.gov . Additionally, U.S. companies interested in this sector should consider attending the International Defense Exhibition and Conference (February 21-25, 2021) in Abu Dhabi. Firms interested in aerospace defense opportunities can also consider the Dubai Airshow (November 14-18, 2021), and for U.S. companies interested in drones, robotics, or unmanned systems, UMEX 2022 (February 20-22, 2022)
Background:
In 1992, the UAE created the Tawazun Economic Council (Tawazun, https://www.tawazun.ae) to form and implement the Tawazun Economic Program (TEP) and Policy Guidelines. The TEP seeks to promote further economic diversification in the UAE by:
• Building critical national defense sectors and generating high value exports
• Creating a knowledge-based economy and diversifying the UAE economy
• Creating business and employment opportunities for UAE citizens.
The UAE introduced offsets in 2015 and updated its policies in 2019; the update broadens the scope of projects eligible for offset credits. Although the policy continues to focus on the development of the defense and security industry, the new guidelines emphasize projects in strategic industries including:
• Aerospace
• Infrastructure and transportation
• Communication technology
• Education technology
• Sustainability
• Environment and climate change, and
• Food and water security.
The revised 2019 policy guidelines also changed the project process. The offset project duration and milestones for investment and contractual engagement project categories are, by default, set at seven (7) years commencing from the effective date, unless otherwise agreed. For the capability development project category, the project duration is, by default, set at three (3) years commencing from the effective date, unless otherwise agreed.
Challenges facing U.S. companies in delivering offset projects:
1- Required Licenses for Knowledge Transfer - in some cases, U.S. regulations do not allow companies to export technologies which Emiratis are interested in obtaining.
2- Ownership of Intellectual Property Rights – When working with a local partner, there may be issues concerning whether the UAE or U.S. partner owns the IP.
3- Disagreement on the Value of Offset Proposed Projects - There could be a difference between the U.S. company’s evaluation of the project and Tawazun’s evaluation of project.
4- Competition with Other Countries’ Offset Programs – Many other countries have their own offset requirements. Over the past year, officials from the UAE and Saudi Arabia announced that a certain level of cooperation and coordination in defense manufacturing would allow foreign companies to gain offset credits for joint projects established in one of the two countries.
5- Emiratization - One of the main objectives of the offset program is to create high-paid, high-tech, jobs for Emirati nationals. However, U.S. companies face difficulties finding enough qualified Emiratis.
While the offset program can be challenging, U.S. companies that study the requirements and get good advice from local experts can take advantage of great opportunities in the UAE market.
If a U.S. company has products or services relevant to the data privacy field or has questions about the UAE’s data privacy laws, they can contact the U.S. Commercial Service in Abu Dhabi at Office.AbuDhabi@trade.gov.