Personal Data Protection Law · Federal Decree-Law 45 of 2021
Article 5
English translation
Personal Data Processing Controls Personal Data shall be processed according to the following controls:
1. Processing shall be carried out in a fair, transparent and lawful manner.
2. Personal Data shall be collected for a specific and clear purpose. It shall not be processed at any later time in a manner incompatible with such purpose. However, it may be processed if the purpose is similar or close to the purpose for which this data is collected.
3. Personal Data shall be sufficient and limited to what is necessary in accordance with the purpose for which the processing is carried out.
4. Personal Data shall be accurate and correct and shall be updated whenever necessary.
5. The necessary measures shall be taken to ensure that incorrect Personal Data is deleted or corrected.
6. Personal Data shall be kept securely, including protecting it from any violation, penetration, or illegal or unauthorized processing through the development and use of appropriate technical and organizational measures and procedures in accordance with the laws and legislation in force in this regard.
7. Personal Data shall not be kept after the purpose of its processing has been exhausted. It may be kept if the identity of the Data Subject has been concealed using the "Anonymization Mechanism"
8. Any other controls set out in the Executive Regulations of this Decree by Law.
Official translation, as published by the portal.
Official Arabic text
ضوابط معالجة البيانات الشخصية يتم معالجة البيانات الشخصية وفقًا للضوابط الآتية:
.1 أن تكون المعالجة بطريقة عادلة وشفافة ومشروعة.
.2 أن تكون البيانات الشخصية قد جمعت لغرض محدد وواضح، وألا يتم معالجتها في أي وقت لاحق على نحو يتنافى مع ذلك الغرض، ومع ذلك يجوز معالجتها في حال كان الغرض منها مشابه أو متقارب من الغرض الذي جمعت هذه البيانات من أجله.
.3 أن تكون البيانات الشخصية كافية ومقتصرة على ما هو ضروري وفقًا للغرض الذي تمت المعالجة من أجله.
.4 أن تكون البيانات الشخصية دقيقة وصحيحة، وأن تخضع للتحديث متى اقتضى الأمر ذلك.
.5 أن تتوفر تدابير وإجراءات لضمان محو أو تصحيح البيانات الشخصية غير الصحيحة.
.6 أن تكون البيانات الشخصية محفوظة بشكل آمن بما فيها حمايتها من أي انتهاك أو اختراق أو معالجة غير مشروعة أو غير مصرح بها من خلال وضع واستخدام تدابير وإجراءات تقنية وتنظيمية ملائمة وفق القوانين والتشريعات السارية في هذا الشأن.
.7 عدم الاحتفاظ بالبيانات الشخصية بعد استنفاد الغرض من معالجتها، ويجوز الإبقاء عليها في حال تم إخفاء هوية صاحب البيانات باستخدام خاصية "آلية إخفاء الهوية".
.8 أي ضوابط أخرى تحددها اللائحة التنفيذية لهذا المرسوم بقانون.
What it means when you sign
This article sets the controls that personal data processing must follow. Processing must be fair, transparent and lawful. Data must be collected for a specific and clear purpose and not processed later in a way incompatible with that purpose, although a similar or close purpose is allowed. The data must be sufficient and limited to what the purpose needs, and accurate and updated when necessary, with measures to delete or correct incorrect data. It must be kept securely, protected from breach and from illegal or unauthorised processing, through appropriate technical and organisational measures. It must not be kept once the purpose of processing is exhausted, unless the data subject's identity has been concealed through anonymization. The executive regulations may set other controls.
When you are about to sign a contract involving personal data, this article means clauses on data use, storage and retention may be read against these controls. A clause that allows data to be collected for no stated purpose, used for unrelated purposes, or kept indefinitely after the purpose has ended, may run into this article.
In Fahm reports this article usually sits under: One-sided mechanisms
Related articles
- Article 1This is a definitions article for the personal data protection law.
- Article 2Cited in Fahm reportsThis article sets out who and what the personal data protection law applies to, and what it leaves out.
- Article 3This article gives the Data Bureau a power to exempt some establishments from the personal data protection requirements.
- Article 4Cited in Fahm reportsThis article sets the starting rule that personal data may not be processed without the consent of its owner.
- Article 6Cited in Fahm reportsThis article sets the conditions for consent to personal data processing to count.
- Article 7This article lists the general obligations of the controller, the party that decides how and why personal data is processed.