Skip survey header

Direct Marketing and Electronic Communications Assessment Tool

The Data Protection Law, DIFC Law No 5 of 2020 (the DP Law 2020) addresses issues around direct marketing and electronic communications on a basic level.  Perhaps not as extensively as other standards such as the EU e-Privacy legislation governing marketing, cookies, and other forms of online monitoring, targeting and communications, but various articles provide requirements when collecting and using Personal Data for through cookies and for electronic communications of any kind – traditional direct marketing is not the only form of electronic communications, and your compliance with all requirements is the difference between a large fine and recommended remedial actions. 

In practice, Personal Data can be all sorts of things.  It includes employee files that contain hiring and termination information, health insurance information, or anything else employment related that identifies that person.  It is client data, including information recorded on invoices, from business cards, on reservation apps or books, and so on. It can be supplier data, recorded in or as a result of any contracts for services or goods.  PD is not limited by any other distinctions, such as business or personal, public or private, large amounts or small amounts. If it identifies somebody, then it is PD.

Personal Data, if any, that is collected as a result of completing this assessment will be handled in accordance with the DIFC Online Data Protection Policy.

Please note that assessment tool / guidance is for informational purposes only and should not be construed as legal advice provided by the Commissioner’s Office.

1. Does your company collect personal data for electronic communications, including marketing (via text, email, phone or other formats), collecting cookies, or sharing information about events or other services? *This question is required.
Does your company post a privacy policy or use another other way of communicating notice to individuals that the Personal Data your company collects may be used for electronic communications, including marketing (via text, email, phone or other formats), collecting cookies, or sharing information about events or other services? *This question is required.
Has your company made clear in a privacy policy or elsewhere the lawful basis on which an individual’s Personal Data is processed? *This question is required.
Does your company buy or receive lists containing Personal Data, to be used for electronic communications, indirectly or from 3rd parties (including new joiners, partners / associates, etc)? *This question is required.
How does your company manage collecting opt-in or soft-opt in preferences for the Personal Data it collects for electronic communications?  *This question is required.
Do your electronic communications for anything other than day to day business comms contain an unsubscribe link by which individuals may manage their preferences? *This question is required.
Does your company set default privacy / cookies preferences to the minimum setting necessary to obtain or collect Personal Data in order to deliver or receive the relevant services, prompting the individual to actively select his privacy preferences on first use and providing a way to easily change such preferences? *This question is required.
0%