ADGM data protection rules updated

Martin Hayward, data protection law specialist at Pinsent Masons in Abu Dhabi, was commenting after the Data Protection Regulations (Substantial Public Interest Conditions) Rules 2025 were enacted in the ADGM, an economic free zone in the UAE.

The new rules apply to the processing of ‘special categories’ of personal data – personal data that reveals sensitive information about an individual, such as about their health, sex life or orientation, criminal convictions, or their racial or ethnic origin, political opinions, religious or philosophical beliefs.

The processing of special category data is subject to strict conditions under ADGM data protection rules. One condition that provides for the processing of that data is where it is “necessary for reasons of substantial public interest”.

Several examples are cited in the legislation where this ground might apply – and the new rules that have now been enacted add to this list.

Under the new rules, for example, insurers will have scope to process special category data on ‘substantial public interest’ grounds in a potentially broad range of contexts – including when advising on, arranging, underwriting or administering an insurance contract; administering a claim under an insurance contract; or exercising a right, or complying with an obligation, arising in connection with an insurance contract, including a right or obligation arising under an enactment or rule of law.

While there are certain carve outs that insurers will need to be aware of, the provisions can be applied to general insurance, long-term insurance or re-insurance contracts.

A further new rule enables special category data to be processed on ‘substantial public interest’ grounds, without the consent of the individual to whose data it relates, in certain cases to safeguard children under the age of 18 or older individuals deemed to be “at risk”. According to the rules, this could be in order to protect an individual from neglect or physical, mental or emotional harm, or to protect their physical, mental or emotional well-being.

This condition for processing will only be met if, in the circumstances, the individual concerned cannot give consent to the intended processing; the controller cannot reasonably be expected to obtain such consent; or where the processing must be carried out without consent because obtaining consent would prejudice the provision of the intended protection.

Hayward said: “With the increasing growth and diversity of ADGM companies, particularly following the recent of expansion of ADGM into Al Reem Island, it is important for the ADGM’s data protection regulations to continue to develop to reflect that growth and diversity.”