Misuse of personal data can significantly impact people’s lives.
The UAE Federal Decree Law No. 45 of 2021 (the “Law”) brings to light new means and procedures regarding the collection, processing, and use of individuals’ personal data (the “Data Subject”).
The Law requires that, when using personal data, you must tell the Data Subject what you are using their data for, how you are using it, and what their rights are in relation to their personal data.
This information is usually written in a document called a privacy policy.
The main criteria are very simple: you need a privacy policy whenever you use personal data.
Typical cases of processing personal data are:
- User profile;
- Contact form;
- Email address;
- Payment processing;
- Website or application analytics;
- Online questionnaire;
- Delivery of products and/or services;
- Live chat
In these cases, you use personal data, and the Law requires you to have a privacy policy.
If you don’t have a privacy policy, you will be fined by data protection authorities.
First and foremost, the consent of the Data Subject is explicitly required and freely revokable at any time.
Plus, the processing should be fair and transparent, and you need a valid and lawful reason to use personal data; otherwise, you can face heavy fines. This is important because you must include in your privacy policy the legal basis that you rely on when processing data.
As a Data Subject, the Law grants you many rights regarding the processing of your data:
- The right of access;
- The right of rectification;
- The right to erasure;
- The right to restrict processing;
- The right to data portability;
- The right to object.
You should mention all the above-mentioned rights in your privacy policy.
By adopting privacy policies reflecting the above criteria, you will not only be compliant with the Law, but you will, most importantly, inspire trust, which will be very supportive for your business.
If you are interested – you can generate your privacy policy by clicking here.