Do I need a data protection officer in the UAE?

Under the federal UAE PDPL, only in three cases (Article 10): processing that poses a high risk to privacy because it uses new technologies or large volumes of data, a systematic and comprehensive assessment of sensitive data, including profiling, or processing large volumes of sensitive data. The DIFC and ADGM set their own tests.

In the DIFC, a DPO is mandatory for DIFC Bodies and for controllers or processors carrying out High Risk Processing Activities on a systematic or regular basis (Article 16), and must reside in the UAE unless the role is held within a group. A controller that needs none must still allocate responsibility for data protection and name those people to the Commissioner on request.

In the ADGM, a DPO is needed for public authorities, for core activities that require regular and systematic monitoring of people on a large scale, and for core activities that consist of large-scale processing of special categories of data. Under the federal law, the DPO can be a staff member or someone on a service contract, and need not be located in the UAE.