GDPR-style regime administered by the ADGM Office of Data Protection: data-protection principles, individual rights, controller and processor duties, data protection officers for certain entities, breach notification and a registration requirement for every ADGM entity that processes personal data, renewed annually. Replaced the 2015 regulations with transition periods for existing entities.
The ADGM Data Protection Regulations 2021 are the data-protection statute for Abu Dhabi Global Market. Every entity registered in ADGM that collects or processes personal data is subject to them, must register with the Registrar as a Data Controller, and must renew that registration every year. The regime is administered by the ADGM Office of Data Protection, which keeps the register of Data Controllers, enforces controller obligations and upholds the rights of individuals.
The Regulations replaced the Data Protection Regulations 2015. Under Article 63 the 2015 Regulations were repealed and the 2021 Regulations took effect six months after publication for new ADGM entities (14 August 2021) and twelve months after publication for entities that already existed (14 February 2022). Both dates have now passed, so the 2021 Regulations apply to every ADGM entity.
The core duties as the ADGM portal describes them are these. Personal data must be processed fairly, lawfully and securely, for specified, explicit and legitimate purposes, be adequate, relevant and not excessive, accurate and kept no longer than necessary, and the controller must be able to demonstrate compliance with those principles. Processing needs a lawful condition, such as written consent, performance of a contract, a legal or regulatory obligation, vital interests, an ADGM public function or the controller's legitimate interests where these are not overridden by the data subject's. Personal data may not be transferred outside ADGM unless the destination ensures an adequate level of protection; the Office of Data Protection publishes a list of adequate jurisdictions following the European Commission approach, and transfers elsewhere are possible only with the safeguards in Part V of the Regulations, such as the data subject's consent or standard contractual clauses.
The notification duties are specific. Registration as a Data Controller is embedded in the incorporation application and is valid for one year, renewed through the online portal. Appointment or cessation of a data processor, and any change in the controller's or processor's particulars, must be notified to the Registrar. The appointment or resignation of a Data Protection Officer must be notified to the Commissioner of Data Protection within one month. A personal data breach must be notified to the Commissioner without undue delay and, where feasible, within 72 hours of the controller becoming aware of it, unless the breach is unlikely to result in a risk to the affected individuals. Where a data protection impact assessment indicates high risk to individuals, the Commissioner must be notified before the processing starts. Every ADGM entity pays a data protection registration fee on incorporation and an annual renewal fee, which the Registration Authority's 2025 fee overview sets at USD 300 each, payable separately from the commercial licence renewal.
The Regulations are in force. The ADGM portal pages read for this record summarise the regime rather than reproduce the text; the full text is published in the ADGM rulebook.
All entities registered in ADGM that collect or process personal data, as Data Controllers, together with the Data Processors that process personal data on their behalf; the individuals (data subjects) whose data is processed benefit from the rights the Regulations confer.
| Article 63 | Repeals the Data Protection Regulations 2015. The 2021 Regulations took effect six months after publication for new ADGM entities (14 August 2021) and twelve months after publication for existing ADGM entities (14 February 2022). |
| Part V | Transfers of personal data to a recipient in a jurisdiction not on the Office of Data Protection's adequacy list are possible only with safeguards such as the data subject's consent or standard contractual clauses. |
| Section: Registration as a Data Controller (portal) | An ADGM entity that intends to process personal data must register as a Data Controller with the Registrar; registration is embedded in the incorporation application, is valid for one year and is renewed annually through the online portal. |
| Section: Data Breach Notification (portal) | A controller must notify a personal data breach to the Commissioner of Data Protection without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to affected individuals. |
| Section: Data Protection Officer (portal) | The controller or processor must notify the Commissioner within one month of the appointment or resignation of any Data Protection Officer, giving contact details and, on resignation, the reasons. |
| Section: Data Protection Impact Assessment (portal) | Where an impact assessment indicates that processing would be likely to result in a high risk to the rights of natural persons, the controller must notify the Commissioner before carrying out the processing. |
| Section: Role of the Data Controller (portal) | Controllers must process personal data fairly, lawfully and securely, for specified and legitimate purposes, keep it adequate, accurate and no longer than necessary, and be able to demonstrate compliance; failure risks enforcement action and compensation claims. |
The ADGM portal states that a controller that fails to ensure compliant processing risks enforcement action by the Office of Data Protection and compensation claims from affected individuals, and the Office publishes notices and directions issued for data protection contraventions. The portal pages read for this record do not state the fine amounts; those are in the text of the Regulations in the ADGM rulebook.
Every ADGM company, SPV and foundation we administer is a Data Controller from the day it is incorporated, because the registration sits inside the incorporation application. Our compliance calendar for ADGM clients therefore carries two renewals, not one: the commercial licence and the data protection registration, each with its USD 300 fee. We keep the register of processors current, since the payroll provider, the accountant and the registered office provider we appoint for a client are usually processors that must be notified. Where a client moves personal data to a group company abroad, we check the adequacy list first and put standard contractual clauses in place where the destination is not on it. We also brief directors on the 72-hour breach clock so that an incident is reported to the Commissioner in time.
ADGM Companies Regulations
Enacted 29 April 2020 under Article 6(1) of Abu Dhabi Law No. 4 of 2013, replacing the 2015 regulations: private and public companies, restricted scope companies, directo…
ADGM RA Fee Schedule 2025
January 2025 schedule consolidating the US-dollar fees the Registration Authority charges under its fees rules for entity registration, commercial licences and renewals, …
ADGM Founding Law
Establishes the Abu Dhabi Global Market as an independent financial free zone governed by a Board of Directors, creates its three authorities (Registration Authority, Fin…
DIFC Data Protection Law
GDPR-aligned statute replacing the 2007 law: it sets lawful bases for processing, data subject rights, controller and processor duties, breach notification, data protecti…
Personal Data Protection Law (PDPL)
The UAE's first federal personal data protection law. It sets lawful-basis, consent, purpose limitation, security, breach notification and data subject rights requirement…
ADGM Commercial Licensing Regulations
Requires every person carrying on business in or from ADGM to hold a commercial licence from the Registration Authority, defines controlled activities that need specific …
Whether you are establishing a new venture, restructuring an existing enterprise, or exploring residency pathways — we are here to advise.
Arrange a Consultation →