ADGM Data Protection Regulations 2021: what they mean for websites
Entities in Abu Dhabi Global Market follow ADGM's own Data Protection Regulations 2021, not the UAE federal law. Consent must be a clear affirmative action, silence, inaction and pre-ticked boxes do not count, and you must keep records of consent and of withdrawals. ADGM's guidance lists cookie identifiers among the identifiers that make data personal, and fines can reach $28 million.
Feb 2022
Applies to all existing entities (new entities from Aug 2021)
$28 million
Maximum fine (ADGM guidance)
72 hours
To notify a breach to the Commissioner, where feasible
The short answer
Does ADGM require consent for cookies?
ADGM has published no guidance specific to cookies. But its guidance lists cookie identifiers and IP addresses as identifiers, so information linked to them is personal data, and where you rely on consent for analytics or advertising cookies it must be a statement or clear affirmative action: silence, inaction and pre-ticked boxes do not count. In our reading, that means asking before those cookies run.
Two further duties matter for a website. You must keep records of consent and of withdrawals, and withdrawing must be as easy as giving consent. A banner that only shows a message, without recording what each visitor chose, meets neither.
ADGM Data Protection Regulations 2021 Guidance, Part 1 (PDF)What the regulations are
The ADGM Data Protection Regulations 2021 replaced the Data Protection Regulations 2015.
They came into force on 14 August 2021 for new entities and on 14 February 2022 for entities that already existed (section 63). They apply to processing in the context of an ADGM establishment, wherever that processing happens (ADGM guidance, Part 1, sections 3.5 to 3.7).
The regulator is the Commissioner of Data Protection, through ADGM's Office of Data Protection, and every ADGM entity that processes personal data must register as a data controller, which carries an annual fee. There are six lawful bases for processing, including legitimate interests.
ADGM has published no guidance specific to cookies, but its guidance lists cookie identifiers and IP addresses as identifiers (Part 1, section 2.3), so data tied to them is personal data. The UAE federal law, Federal Decree-Law No. 45 of 2021, excludes companies in free zones that have their own data protection legislation (Article 2(2)(g)); it does not name ADGM.
What the regulations require of a website
- 01
Consent by a statement or clear affirmative action
Where you rely on consent, it must be freely given, specific and informed, and given by a statement or a clear affirmative action (ADGM guidance, Part 1, section 5.1.1).
- 02
Silence, inaction and pre-ticked boxes do not count
In the guidance's own words: "Silence, inaction and pre-ticked boxes do not constitute consent." A banner that sets analytics or advertising cookies before the visitor acts, or that treats carrying on browsing as agreement, relies on exactly that.
- 03
Records of consent and of withdrawals
"You need to keep records of consent and withdrawals" (section 5.1.1), and withdrawing consent must be as easy as giving it. A banner that does not log choices leaves you without that record.
- 04
Cookie identifiers are identifiers
The guidance lists cookie identifiers and IP addresses as identifiers (Part 1, section 2.3). ADGM has no dedicated cookie guidance, so the consent rules above are the ones that govern cookies used for analytics or advertising.
- 05
Breach notification and a DPO where required
Notify the Commissioner of a breach without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk to individuals. A data protection officer is required for public authorities, for large-scale regular and systematic monitoring, and for large-scale processing of special-category data; the Commissioner must be notified within one month of the appointment.
- 06
Registration and transfers
Every ADGM entity that processes personal data registers with the Office of Data Protection as a data controller and pays an annual fee. For transfers out of ADGM, ADGM adopts the European Commission's adequacy decisions and adds jurisdictions such as the DIFC and the QFC.
Penalties
ADGM's guidance states that the Commissioner has the power to issue fines of up to $28 million for breaches of the Regulations (Part 1, section 1.9).
- 01
Fines up to $28 million
The maximum the Commissioner can impose for breaches of the Data Protection Regulations 2021, as stated in ADGM's guidance (Part 1, section 1.9).
What Arqam360 does for a website run from ADGM
- 01
Consent by category, with Reject all
The banner asks for consent by category, with a Reject all choice, and sends Google Consent Mode v2 signals so Google tags know what the visitor allowed.
- 02
A dated record of each choice
ADGM's guidance asks you to keep records of consent and withdrawals. Each visitor's choice is stored with its date and the categories accepted or refused.
- 03
Withdraw at any time
Visitors can withdraw their consent at any time, and withdrawing must be as easy as giving consent.
- 04
Arabic and English, and the regime by country
A right-to-left Arabic banner with an English version. Regime detection works by the visitor's country: it recognises visitors in the UAE, but it cannot tell whether a site belongs to an ADGM entity, so choose the banner settings for your own case.
Timeline
In force for new entities
The Data Protection Regulations 2021, replacing the 2015 Regulations, apply to entities established from 14 August 2021.
In force for existing entities
From 14 February 2022 the Regulations apply to entities that already existed (section 63).
Check what your site does before consent
The free scanner loads your site in a real browser and lists the cookies and trackers that run before a visitor chooses. Cookies set before any action are the ones silence cannot justify.
Scan your siteDone for you
We set it up on your website
We install the consent banner, wire Google Consent Mode v2, test your Google and Meta tags, and publish your bilingual privacy policy. $299 to install, then $99.99 a month per domain.
Regulations
Compliance guides for GDPR, PDPL, and more
regulations.adgmDataProtection.faq.title
regulations.adgmDataProtection.faq.subtitle
Federal Decree-Law No. 45 of 2021 excludes companies in free zones that have their own data protection legislation (Article 2(2)(g)). It does not name ADGM, but ADGM has its own Data Protection Regulations 2021, which apply to processing in the context of an ADGM establishment, wherever it happens.
Put an Arabic and English consent banner on your site
The banner takes minutes on WordPress, Shopify or any custom site. Registration, the DPO and your privacy notice are yours to arrange; the banner is the part your visitors see first. Start free, or let our team install it and test your tags.