Data Controllers may collect and Process Personal Data when any of the following conditions are met (set out under Article 10 DPL):

• a Data Subject has given consent, which complies with the comprehensive consent requirements set out under Article 12 of the DPL, to the Processing of that Personal Data for specific purposes;
• Processing is necessary for the performance of a contract to which a Data Subject is a party, or in order to take steps at the request of a Data Subject prior to entering into such contract;
• Processing is necessary for compliance with applicable law that a Controller is subject to;
• Processing is necessary in order to protect the vital interests of a Data Subject or of another natural person;
• Processing is necessary for:
  
  • performance of a task carried out by a DIFC Body in the interests of the DIFC;
  • exercise of a DIFC Body’s powers and functions; or
  • the exercise of powers or functions vested by a DIFC Body in a Third Party to whom Personal Data is disclosed by the DIFC Body; or
• Processing is necessary for the purpose of legitimate interests pursued by a Controller (or a third party to whom the Personal Data has been made available, subject to Article 13 of the DPL which sets out certain restrictions on the ability to rely upon legitimate interests), except where such interests are overridden by the interests or rights of a Data Subject.

Data controllers may collect and Process Special Categories of Personal Data when any of the following conditions are met (as per Article 11 DPL), in addition to establishing one of the legal bases under Article 10, set out above:

• a Data Subject has given explicit consent, which complies with the comprehensive consent requirements set out under Article 12 of the DPL, to the Processing of those Special Categories of Personal Data for one (1) or more specified purposes;
• Processing is necessary for the purpose of carrying out the obligations and exercising the specific rights of a Controller or a Data Subject in the context of the Data Subject's employment, including but not limited to recruitment, visa or work permit Processing, the performance of an employment contract, termination of employment, the conduct of proceedings relating to employment and the administration of a pension, retirement or employee money purchase benefit scheme;
• Processing is necessary to protect the vital interests of a Data Subject or of another natural person, where the Data Subject is physically or legally incapable of giving consent;
• Processing is carried out by a foundation, association or any other non-profit-seeking body in the course of its legitimate activities, subject to appropriate assurances and provided that the Processing relates:
  
  • solely to the members or former members of such an entity, or to other persons who have regular contact with such a body in connection with its purpose; and
  • the Personal Data is not disclosed to a Third Party without the consent of a Data Subject;
• Processing relates to Personal Data that has been made public by a Data Subject;
• Processing is necessary for the establishment, exercise or defence of legal claims (including, without limitation, arbitration and other structured and commonly recognised alternative dispute resolution procedures, such as mediation) or is performed by the Court acting in its judicial capacity;
• Processing is necessary for compliance with a specific requirement of Applicable Law to which a Controller is subject, and in such circumstances the Controller must provide a Data Subject with clear notice of such Processing as soon as reasonably practicable unless the obligation in question prohibits such notice being given;
• Processing is necessary to comply with Applicable Law that applies to a Controller in relation to anti-money laundering or counter-terrorist financing obligations or the prevention, detection or prosecution of any crime;
• Processing is required for the purposes of preventive or occupational medicine, the assessment of the working capacity of an employee, medical diagnosis, the provision of health or social care or the treatment or the management of health or social care systems and services, provided that the Personal Data is Processed by or under the responsibility of a health professional subject to an obligation of professional secrecy under applicable law or by another person also subject to an obligation of secrecy under applicable law;
• Processing is required for protecting members of the public against dishonesty, malpractice, incompetence or other improper conduct of persons providing banking, insurance, investment, management consultancy, information technology services, accounting or other services or commercial activities (either in person or indirectly by means of outsourcing), including any resulting financial loss; or
• Processing is proportional and necessary to protect a Data Subject from potential bias or inaccurate decision making, where such risk would be increased regardless of whether Special Category Personal Data is Processed.
• Processing is necessary for Substantial Public Interest reasons that are proportionate to the aim(s) pursued, respect the principles of data protection and provide for suitable and specific measures to safeguard the rights of the Data Subject.

Information Provision

Controllers are required to provide Data Subjects with certain information around how their Personal Data is processed in a concise, transparent, intelligible and easily accessible form, using clear and plain language. The information required to be provided is set out in detail under Part 5 of the DPL.

Where the Controller collects the Personal Data from the Data Subject, the information must be provided at the time of collection. (Article 29 DPL)

Where the Controller does not collect the Personal Data from the Data Subject, the Controller must provide the information:

• no longer than one (1) month from obtaining the Personal Data; or
• if the Personal Data is used for communicating with the Data Subject, no later than the first communication; or
• if a disclosure (including the making available for Processing) to a Processor or a third party is envisaged, no later than the time when the Personal Data is first disclosed. 

(Article 30 DPL)