Abu Dhabi Global Market · Data Protection Regulations 2021
ADGM data protection compliance and requirements, ready for the Commissioner's questions.
Every entity established in ADGM that handles personal data answers to the Data Protection Regulations 2021, wherever the processing itself happens. Sterling's expert and experienced consultants map your data, settle a lawful basis for each use, set up breach handling and transfer routes, and leave you with records the Office of Data Protection can inspect. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced privacy and information security consultants, with data protection programmes delivered across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. No certificate of compliance with the Regulations exists; the Commissioner of Data Protection supervises and Sterling does not certify
8,100+ client engagements in 60+ countries.
ADGM data protection client experience
What it is
What are the ADGM Data Protection Regulations 2021?
The Data Protection Regulations 2021 are the privacy law of Abu Dhabi Global Market, the international financial centre on Al Maryah Island established under Abu Dhabi Law No. 4 of 2013. They govern how firms established there collect, use, share, keep and delete information about identifiable people: clients, investors, employees, visitors and the contacts behind corporate counterparties. The regime is supervised by the Commissioner of Data Protection, working through the ADGM Office of Data Protection, which keeps a register of controllers, handles complaints, issues guidance and enforces the Regulations.
Reach is the first thing to get right. The Regulations follow the establishment, not the server: a fund manager in ADGM whose client files sit with a cloud provider in Europe, or whose payroll runs from a group office in India, still processes that data under ADGM law. This page covers ADGM only. The federal UAE PDPL and the DIFC regime each have their own page on this site.
Current text. The ADGM Board enacted the Data Protection Regulations 2021 on 11 February 2021, replacing the 2015 Regulations. Entities incorporated after 14 February 2021 had to comply from 14 August 2021, and existing entities from 14 February 2022; both periods have ended, so the Regulations apply in full. The Office of Data Protection publishes guidance that explains each Part. Confirm the current consolidated text on ADGM's official legislation portal before relying on any provision, and take advice from your legal advisers on its interpretation.
Who it is for
Who needs ADGM data protection compliance?
Any controller or processor established in ADGM that handles personal data by automated means, or keeps it in a structured filing system, is within scope. In practice four situations bring ADGM firms to Sterling:
- Institutional clients and investors send due diligence questionnaires. Banks, allocators and corporate customers ask how you handle their people's data, who your processors are and how you would report a breach. A documented programme turns those answers into evidence.
- A mandate, tender or outsourcing deal depends on it. Procurement teams expect a lawful basis per activity, signed data terms and a named contact for privacy matters before they award work.
- The Office of Data Protection writes, or an individual complains. A request from the Commissioner, an access request from a former employee or a complaint from a client is when gaps in records become visible. Better to find them first.
- Your group runs data centrally. Shared HR, CRM and cloud platforms mean ADGM data leaves the zone every day. Each flow needs a recognised transfer route, and the ADGM entity still carries its own obligations whatever group policy says.
What the programme delivers is control of personal data and proof of that control. It does not transfer accountability: your ADGM entity remains responsible as controller or processor.
Requirements
What do the ADGM Data Protection Regulations require?
The Regulations are arranged in eight Parts. The list below summarises each at title level, as the Office of Data Protection's guidance presents them; your programme is tested against the text in force, Part by Part, during the engagement.
- Part 1 General provisions: the material scope (automated processing and filing systems) and the territorial reach, which follows an establishment in ADGM wherever processing happens.
- Part 2 Principles: lawful, fair and transparent processing, one of six lawful bases for each activity (consent, contract, legal obligation, vital interests, public task or legitimate interest) and extra conditions for special categories such as health, biometric and genetic data.
- Part 3 Rights of the data subject: transparent information, and rights of access, rectification, deletion and objection, each with a route for people to exercise them.
- Part 4 Controller and processor: records of processing, a data protection officer in the circumstances the Regulations set, impact assessments before high-risk processing, breach notification to the Commissioner within 72 hours of becoming aware, and payment of the data protection fee.
- Part 5 Transfers of personal data outside ADGM: transfers on an adequacy decision, under appropriate safeguards such as standard contractual clauses or binding corporate rules, or on a derogation for a specific situation.
- Part 6 Independent supervisory authority: the Commissioner of Data Protection and the Office's powers to advise, investigate complaints and enforce.
- Part 7 Fines and remedies: the sanctions available to the Commissioner and the remedies open to individuals.
- Part 8 Final provisions: rule-making powers and the definitions used throughout.
What does useful ADGM data protection evidence look like?
A record of processing that matches the systems staff really use, the lawful basis noted against each activity, legitimate interest assessments where you rely on that basis, notices dated before collection, the DPO decision with its reasoning, completed impact assessments, a breach log that includes incidents judged not reportable, a request log with response dates, and a transfer register naming the route for every flow out of ADGM. We set these up in Effivity at the first workshop so they build as work happens.
Compliance process
How do you achieve ADGM data protection compliance?
No assessment ends in a certificate. Compliance is shown through records, through the way requests and incidents are handled and through the answers you can give when the Commissioner asks.
- 01Confirm the establishment and map the data.Identify which entities are established in ADGM, whether each acts as controller or processor, and every system, supplier and group platform that holds personal data about the people it serves or employs.
- 02Gap analysis: test current practice against each Part.We compare lawful bases, notices, rights handling, the DPO position, impact assessments, breach procedure, fee status and transfer routes with the Regulations and ODP guidance, then agree actions, owners and dates.
- 03Decide, document and contract.Settle the basis per activity, issue notices and procedures, choose the transfer route for each outbound flow, put data terms in supplier and group agreements, and decide on the DPO.
- 04Train people and rehearse a breach.Staff who handle personal data learn their part; the response team walks through a scenario against the 72-hour window, and the internal audit then tests the whole programme.
- 05Run the programme and answer outside questions from evidence.Requests, incidents, new systems and new suppliers go through the agreed routes; the fee is paid on time and client questionnaires or ODP enquiries are answered from records that already exist.
Check the route before you sign. Only the Commissioner of Data Protection supervises the Regulations, and no consultant, software vendor or certification body can declare an ADGM entity compliant. Ask what records the work will leave behind, and confirm fees, filings and guidance directly on the Office of Data Protection's pages at adgm.com. The certification buyer's checklist
Cost
How much does ADGM data protection compliance cost?
A five-person advisory boutique with one CRM and a payroll provider needs a fraction of the work of a bank branch with core systems, outsourced operations and group platforms abroad. The proposal prices your actual data landscape, with each part itemised and the fee fixed.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Number of systems and suppliers to map, entities in scope, special-category data, transfer flows, and whether your team leads the work (Design™) or Sterling runs it (Drive™) |
| Regulatory fees | The data protection fee payable to the Commissioner, set by ADGM and paid by your entity; no assessment fee exists because there is no certificate |
| Internal and legal time | System-owner time for the inventory, IT changes for retention, access and deletion, DPO capacity, and any legal review of notices, contracts and transfers |
| Software and learning | Included in a Sterling engagement: Effivity to run the programme and Sterling Academy access for your people, with users, courses and access period set in the proposal |
| Continued support | Yearly impact assessment reviews, breach rehearsals, internal audits and tracking of new ODP guidance under Sustain™ |
What moves the price
- How many systems, suppliers and group platforms hold personal data
- Volume of special-category data, such as health or biometric records
- Number of transfer flows out of ADGM and the routes they need
- Whether a GDPR or ISO/IEC 27701 programme already exists
- Deadlines set by clients, investors or the regulator
What a Sterling proposal always shows
- Scope, deliverables, assumptions and exclusions stated in writing
- ADGM fees and any legal review shown as separate from our fee
- Effivity, training and Academy access listed at no additional cost
- Milestone payments linked to delivered work
- A single all-inclusive proposal, with no later additions
Timeline
How long does ADGM data protection compliance take?
The data inventory usually sets the pace, since every later decision rests on it, followed by the transfer routes and supplier terms that depend on other parties. As an estimate, most ADGM entities reach a defensible position in three to six months, faster where a GDPR programme already exists.
| Phase | What sets the pace |
|---|---|
| Inventory and gap analysis | Access to system owners, supplier lists and group data flows |
| Decisions and documents | Sign-off on lawful bases, the DPO question and notice wording |
| Transfers and contracts | Responses from suppliers and group entities to new data terms |
| Training, rehearsal and audit | Scheduling staff sessions, the breach exercise and the internal audit |
Your engagement
What your ADGM data protection engagement includes
Every engagement runs on Sterling OS™, adapted here to a regulation rather than a certificate. Sterling does not certify or attest compliance with the Regulations: the Commissioner of Data Protection supervises them, and your entity stays accountable as controller or processor.
Design™: guided support
Your people build the programme; a Sterling consultant sets the method, reviews each record, assessment and notice, and coaches the DPO or privacy lead.
Drive™: managed support
The alternative to Design™ when your team is stretched: Sterling drafts the inventory, assessments, procedures and transfer register with your owners and takes the programme through to management approval.
Sustain™: after the programme
Reviews of assessments and records, breach rehearsals, fee and guidance watch and internal audits, kept to an agreed calendar.
Automate™: Effivity
The registers, logs and actions run in Effivity, included with the engagement at no additional cost.
Training for your people
Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Supervision, investigations and enforcement remain with the Commissioner of Data Protection.
Often combined with
Standards organisations pair with ADGM Data Protection Regulations 2021
- APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
- APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
- Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
- CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
- Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.
- Data Privacy Act (Philippines)Philippine Data Privacy Act compliance consulting: DPO, privacy impact assessments, security and 72-hour breach handling, from our office in Manila.
Effivity · privacy compliance software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the ADGM Data Protection Regulations 2021.
Every Sterling ADGM data protection engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant sets up the workspace within the agreed scope, so the record of processing, lawful bases, impact assessments, rights requests, breaches, transfer routes, supplier reviews and training records sit together, the programme runs in day-to-day work and a request from the Office of Data Protection is answered from live data. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Entities, roles and scope
Each ADGM entity recorded with its controller or processor role and the systems in scope, so the reach of the programme is written down rather than assumed.
Record of processing and lawful bases
Every activity listed with its purpose, data categories, retention and chosen basis, plus legitimate interest assessments where that basis is used.
Requests and notices
Access, rectification, deletion and objection requests logged on arrival, assigned and tracked to a dated reply, with notice versions kept alongside.
Impact assessments and the DPO
High-risk projects screened early, assessments completed in a standard format and approved before launch, and the DPO decision stored with its reasoning.
Breaches and the 72-hour window
Incidents triaged against the Commissioner's deadline, decisions recorded, notices drafted and every incident logged, reported or not.
Transfer register and supplier reviews
Each outbound flow tied to its route (adequacy, safeguards or derogation) and each processor reviewed on a schedule.
Regulator correspondence and fees
Letters from the Office of Data Protection, filing dates and fee reminders held in one place with owners and due dates.
Audit, actions and reporting
Internal audits, findings and corrective actions tracked to closure, with dashboards for management and the DPO.
What this means when the regulator asks
An enquiry from the Commissioner or a client's due diligence team usually wants the record of processing, the impact assessments, the breach log and the transfer routes. In Effivity each is a screen with owners, dates and attachments, ready the same day. After the programme, Sustain™ runs in the same workspace, so the records stay current.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Existing registers and logs migrated, not retyped
- Admin and user training for your team
- Modules for ISMS and other standards when you extend the programme
Sterling Academy · data protection e-learning
Train everyone who touches personal data, not only the DPO.
Sterling Academy offers e-learning for whole workforces and for the people who run the programme: video lessons, practice checkpoints, a final exam and a numbered Certificate of Completion per learner that can be verified online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Awareness for all staff on handling personal data and spotting a breach
- Deeper learning for the DPO, privacy lead and system owners
- Internal auditor training, as applicable to your standard, as part of the engagement
- Completion records by team, ready for a client questionnaire or regulator request
- New joiners trained as they start, so records never lapse
- A Sterling consultant on hand when a learner has a question
Keep exploring
Explore more about ADGM Data Protection Regulations 2021
ADGM data protection resources
Services for ADGM Data Protection Regulations 2021
Why Sterling
Why choose Sterling for ADGM data protection?
ADGM firms rarely sit alone: most belong to groups with entities onshore, in other free zones and abroad, each under a different privacy law. Sterling builds one programme that meets the ADGM Regulations for the ADGM entity and connects cleanly to what the rest of the group already runs, with offices in 21 countries including Dubai.
Privacy programmes in 60+ countries since 2003
Data protection and information security programmes delivered under many regimes, so group transfers and overlapping laws are familiar ground.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with ADGM fees and legal review shown separately. No surprises, ever.
Records built from real work
Registers and logs filled from the systems and suppliers you actually use, not a relabelled template set that nobody maintains.
Expert and experienced consultants
Privacy and information security consultants who work alongside your legal advisers, so decisions on bases, transfers and breaches are practical and documented.
The Sterling Promise
What our ADGM data protection compliance success guarantee means
We stay with you until your agreed ADGM data protection compliance outcome is achieved, through the gap analysis, the decisions and documents, transfer routes, training and the closure of internal audit findings.
The engagement identifies the standard, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed controls into use. The Commissioner of Data Protection supervises the Regulations and your entity remains accountable for compliance. Our commitment concerns the agreed compliance support, not a promise that no breach will ever occur or of any regulatory outcome.
FAQs
Frequently asked questions about ADGM data protection
Do the ADGM Data Protection Regulations apply if our data is processed outside ADGM?
Yes. The Regulations cover processing in the context of the activities of an establishment in ADGM, regardless of whether the processing takes place in ADGM or not. Data held by an overseas cloud provider or handled by a group service centre on your behalf stays within their reach.
Is there an ADGM data protection certificate?
No. The Regulations provide no certification, and the Commissioner of Data Protection does not issue a compliance certificate. If clients want independent assurance, the programme can support ISO/IEC 27701 certification from an accredited certification body, which evidences privacy management but is not a ruling on ADGM compliance.
How quickly must an ADGM entity report a personal data breach?
Within 72 hours of becoming aware of it, to the Commissioner of Data Protection. The practical test is whether your team can triage an incident, decide whether it must be reported and prepare the notice within that window. The ODP's guidance also covers when affected individuals must be told.
Can we send personal data from ADGM to group companies or cloud providers abroad?
Yes, on a recognised route. The destination may be one ADGM treats as adequate, the transfer may rely on appropriate safeguards such as standard contractual clauses or binding corporate rules, or a specific derogation may apply. Record the route for each flow and check the ODP's list of adequate jurisdictions when it changes.
We already comply with the GDPR. How much carries over to ADGM?
Much of the method carries over: the six lawful bases, the rights process, impact assessments and the 72-hour breach clock are familiar. The ADGM layer is what changes: the Commissioner as regulator, the data protection fee, ADGM's own adequacy list for transfers, and notices and contract terms that refer to the ADGM Regulations. A gap analysis shows exactly what to add.
Keep exploring
More on ADGM Data Protection Regulations 2021 and related standards
More in Privacy & data protection
Talk to a consultant
Plan your ADGM data protection programme with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice