Skip survey header

DP Assessment Tool: Article 29 and 30 – Privacy Notices

The Data Protection Law, DIFC Law No 5 of 2020 (the DP Law 2020) addresses issues around notices and information that must be shared with individuals when collecting Personal Data directly or indirectly from them for use within your business. 

In practice, Personal Data can be all sorts of things.  It includes employee files that contain hiring and termination information, health insurance information, or anything else employment related that identifies that person.  It is client data, including information recorded on invoices, from business cards, on reservation apps or books, and so on. It can be supplier data, recorded in or as a result of any contracts for services or goods.  PD is not limited by any other distinctions, such as business or personal, public or private, large amounts or small amounts. If it identifies somebody, then it is PD.

A privacy notice must contain both clear and plain language, as well as lawful basis/es for processing Personal Data. The notice must also clarify information about who your company shares it with, how they can access it, to whom they may complain or ask question about the processing, etc. 

Personal Data, if any, that is collected as a result of completing this assessment will be handled in accordance with the DIFC Online Data Protection Policy.

Please note that assessment tool / guidance is for informational purposes only and should not be construed as legal advice provided by the Commissioner’s Office.

1. Does your company provide a privacy policy link or other public notice of the lawful basis and other important information about its Personal Data collection and processing activities? *This question is required.
2. Does your company provide sufficient notice that it uses or develops technology that may restrict or prevent the Data Subject from exercising his rights to request rectification or erasure of Personal Data in accordance with Article 33, or to object to the processing of the Personal Data in accordance with Article 34? 

Please note – this requirement only applies to companies that use or develop such technology.  If you are unaware of whether or not this is the case, please conduct a data protection impact assessment of the technology/ies utilized to collect or process Personal Data.  Then come back and run this assessment again. *This question is required.
3.

In accordance with Article 40, do you provide information, either in your privacy notice or elsewhere, about 2 methods that an individual can to contact your company to submit a request to exercise his rights?

*This question is required.
0%