The PDPL imposes strict requirements around data security. Controllers and Processors are required to put in place sufficient technical and authorised measures to protect and secure Personal Data, preserve its confidentiality and privacy, and ensuring that such personal data is not breached, destroyed or altered. The measures which must be taken need to take into account the nature, scope and purposes of processing and the possibility of risks to the confidentiality and privacy of the Data Subject’s Personal Data. Put simply, this means the higher the risk of harm to the Data Subject and / or the higher the likelihood of a breach, the greater the steps to secure personal data that need to be taken. 

The UAE's Federal Cabinet has issued Resolution No. 21 of 2013, concerning the Regulation of Information Security in Federal Authorities. Although it applies to information security within UAE federal government bodies, the requirements of this resolution might be passed on to contractors providing services to Federal government bodies when they are entering into service supply agreements with such bodies. Similarly, contractors to emirate level government bodies may need to require with emirate government security standards. Examples, include the Information Security Regulations of the Dubai Electronic Security Center.

Article 24.9 of the TDRA Consumer Protection Regulations v2.0 requires telecommunications service providers to “take all reasonable and appropriate measures to prevent the unauthorised disclosure or the unauthorised use of subscriber information”. Article 24.4 further stipulates that telecommunications service providers must take “all reasonable measures to protect the privacy of Subscriber Information that it maintains in its files, whether electronic or paper for”, and that “reliable security measures” should be employed.

The UAE Cyber Crime Law focuses on offences related to accessing data without permission and / or illegally (Articles 2 and 3), including financial information (e.g. credit card information or bank account information) (Articles 12 and 13).

Based on the above, best practice from a UAE law perspective would be to take appropriate technical security measures against unauthorised or unlawful processing of, and against accidental disclosure of, personal data. The measures taken must ensure a level of security adequate enough to minimise the risk of liability arising out of a claim for breach of privacy made by a Data Subject.