The Abu Dhabi Global Market introduced its Data Protection Regulations in 2021. The Regulations had prohibited the processing of special categories of Personal Data which related to:
• Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs,
• Genetic Data, Biometric Data for the purpose of uniquely identifying a natural person, Data Concerning Health, or data concerning a natural person’s sex life or sexual orientation; and
• Personal Data relating to criminal convictions and offences or related security measures.
However, the Regulations also provide exceptions to this general rule of prohibition, which include the processing of data necessary for reasons of substantial public interest, such as insurance purposes or for the safeguarding of children and individuals at risk.
Expanding on the regulations, the Board of Directors of the ADGM has issued the Data Protection Regulations (Substantial Public Interest Conditions) Rules 2025.
Substantial Public Interest Conditions Rules
These regulations provide for certain conditions that can be used as exception to the general rule of prohibition of processing the special categories of Personal Data. Conditions for processing data for insurance-related services include that the data:
(a) is necessary for insurance purposes,
(b) is of Special Categories of Personal Data, and
(c) is necessary for reasons of substantial public interest.
Such Processing, however, has to be as per an appropriate policy document to be issued by the Controller in the future.
For children or individuals at risk, the special categories of personal data can be processed if processing is necessary for the purpose of an individual under 18 or above 18 (if at risk) for:
-protecting the individual from neglect or physical or mental, or emotional harm, or
-protecting the physical, mental, or emotional well-being of an individual.
The above conditions are only applicable if the consent for processing cannot be given by the data subject, or the Controller is not expected to take the consent of the Data Subject, or if obtaining consent may prejudice the provision of protection for such individual.
An individual aged 18 or above is considered at risk if the Controller has reasonable cause to suspect that the individual
– has needs for care and support,
– is experiencing or at risk of neglect or physical, mental, or emotional harm, and
– As a result of such need, is unable to protect himself or herself against the neglect or harm or the risk of it.
Conclusion
These regulations create special provisions for insurance purposes and for individuals with special needs, wherein Special Categories of Personal Data may be processed without the consent of the Data Subject. Such exceptions are necessary for ensuring that the insurance companies do not face repercussions in providing support, and the individuals at risks are protected.
For more information, you may contact:
Thomas Paoletti
Francesca Romana Valeri
Fauzia Khan
“This article is for information purposes only and does not constitute legal or professional advice.”
