Data protection and the UAE PDPL

Our lawful basis for processing

We process personal data only where the law gives us a valid ground to do so. Under the PDPL we rely on consent, the performance of a contract, compliance with a legal obligation, the protection of vital interests, and our legitimate interests where those interests are not overridden by the rights of the person. We match each processing activity to one ground, we record that choice, and we review it if the activity changes. Where we rely on consent we make it specific, informed and freely given, and we make withdrawal as easy as the original agreement. Where we rely on legitimate interest we carry out and document a balancing assessment. For EU and EEA data subjects we rely on the equivalent GDPR grounds.

Controller and processor: which role we hold

Data protection law draws a line between the controller, who decides why and how data is processed, and the processor, who acts on the controller's instructions. Our role depends on the activity.

For our own website, our marketing and our recruitment, Corpshore Emirates is the controller. We decide what data to collect, why, and how long to keep it, and we carry the controller's duties for that data.

For the outsourcing work we do on behalf of a client, we are usually the processor. The client is the controller, the client decides the purpose, and we process the personal data of the client's customers or staff only on the client's documented instructions. In that role we help the client meet its own obligations, we keep the data secure, we do not use it for our own purposes, and we return or delete it at the end of the engagement. Where an engagement makes us a joint controller with a client, we agree that in writing and we set out who does what.

The processing agreement clients can request

When we act as a processor, a written data processing agreement governs the relationship. Any client can request one, and we expect to have one in place before we process personal data on a client's behalf. The agreement sets out the subject matter and duration of the processing, the nature and purpose, the types of data and categories of data subject, and the obligations of each party. It commits us to process only on the client's instructions, to impose confidentiality on our staff, to apply appropriate security, to engage a sub-processor only with the client's authorisation and under equivalent terms, to help the client respond to data subject requests, to assist with breach notification and impact assessments, and to delete or return the data at the end. Clients who are subject to DIFC, ADGM, GDPR or Central Bank requirements can ask us to reflect those specific obligations in the agreement, and we will accommodate reasonable additions. To request a processing agreement, contact us at info@corpshore.ae.

Central Bank outsourcing expectations

When we serve a bank, an insurer or another financial institution regulated by the Central Bank of the United Arab Emirates, we recognise that the regulator holds the institution responsible for its outsourcing. We support our regulated clients in meeting that responsibility. We agree clear service terms, we keep customer data within the controls the client requires, we support the client's right to audit and the regulator's right of access, we manage sub-outsourcing transparently, and we plan for business continuity so a disruption on our side does not put the client's obligations at risk. Where a client needs data to remain in a specific location, we accommodate that requirement as part of the engagement design.

Rights of the individual and the UAE Data Office

The PDPL gives every individual rights over their personal data. These include the right to be informed about processing, the right to access their data, the right to have inaccurate data corrected, the right to erasure where there is no valid reason to keep the data, the right to restrict processing while a concern is resolved, the right to portability of the data they provided, the right to object to processing based on legitimate interest and to direct marketing, and the right not to be subject to a solely automated decision with a significant effect. We honour these rights for the data we control, and for the data we process on a client's behalf we pass a request to the client and help them respond.

To exercise a right, or to raise a concern, contact us at info@corpshore.ae. We verify identity where needed and we respond within the period the law sets, which we treat as one month from a valid request. If you are not satisfied, you have the right to complain to the UAE Data Office, the federal authority responsible for the PDPL. Where your data relates to a DIFC or ADGM activity you may instead have recourse to the DIFC Commissioner of Data Protection or the ADGM Office of Data Protection, and where the GDPR applies you may complain to the supervisory authority in your country.

Cross-border transfers and safeguards

Cross-border data flow is part of how we deliver a global service. The PDPL permits a transfer of personal data outside the UAE where the destination country provides an adequate level of protection, or where an appropriate safeguard is in place. Our safeguards include standard contractual clauses with our processors, binding internal commitments across the Corpshore group, and, for a specific transfer that no other mechanism covers, the explicit and informed consent of the individual. For data protected by the GDPR we rely on an adequacy decision where one exists, and otherwise on standard contractual clauses with any supplementary measures the transfer needs. For DIFC and ADGM data we apply the transfer rules of the DIFC Data Protection Law 2020 and the ADGM Data Protection Regulations 2021. We record the mechanism that applies to each transfer, and we will tell a client or an individual which one applies on request.

Security and breach handling

We apply technical and organisational measures proportionate to the risk of the processing. These include encryption in transit and at rest, access limited by role and protected by strong authentication, network and application controls, logging and monitoring, staff confidentiality and training, and periodic review of our controls and our providers. We hold our processors to recognised security standards and to contractual security duties.

If a personal data breach occurs, we act on a defined plan. We contain and assess the incident, we record it, and where the breach is likely to create a risk to individuals we notify the UAE Data Office as the law requires. Where the breach is likely to create a high risk to the individuals affected, we inform them without undue delay and tell them how to protect themselves. When we act as a processor, we notify the affected client promptly so the client can meet its own notification duties, and we support that client throughout.

The principles we apply to every activity

Whichever framework applies, the same core principles run through how we handle personal data. We apply them to our own processing and we build them into the services we run for clients.

• Lawfulness, fairness and transparency. We process data on a valid basis, we do not use it in ways a person would not expect, and we tell people plainly what we do.
• Purpose limitation. We collect data for a specified purpose and we do not reuse it for an incompatible one.
• Data minimisation. We collect only what a purpose needs, and no more.
• Accuracy. We keep data accurate and up to date, and we correct or delete data that is wrong.
• Storage limitation. We keep data only as long as the purpose or the law requires, then we delete or anonymise it.
• Integrity and confidentiality. We protect data with security measures suited to the risk.
• Accountability. We can show how we meet each of these principles, and we hold our providers to them too.

Sub-processors and our supply chain

We use a small set of trusted service providers to run our platforms and our website, and some of them act as sub-processors when we deliver a client engagement. Our main providers are Zoho, for customer, recruitment and email operations, Vercel, for website hosting and delivery, Cloudflare, for bot protection on our forms, and Calendly, for meeting bookings. We engage each of them under a written agreement that requires equivalent data protection and security duties, and that limits them to processing on our instructions. When we act as a processor for a client, we add a sub-processor only with that client's authorisation, we pass down the same duties, and we remain responsible to the client for the sub-processor's performance. We can provide a current list of the sub-processors involved in a given engagement on request, and we tell a client before a change that affects their data.

Impact assessments and privacy by design

Before we start a processing activity that is likely to carry a higher risk to individuals, we assess that risk and record how we will manage it. We build data protection into a new service or a new tool from the design stage, and we default to the most protective settings so that a person does not have to act to protect their own data. When we help a client design a service, we bring the same discipline, so that the client's own impact assessment and controls are supported rather than undermined by what we do.

Accountability and governance

We treat accountability as an ongoing duty, not a one-off exercise. We keep a record of our processing activities, we assess the impact of higher-risk processing before we start it, we apply data protection by design and by default when we build a service or select a tool, and we hold our people and our providers to written data protection commitments. We review this framework as our services, our client base and the law develop.

Our Data Protection Officer

Corpshore Emirates has appointed a Data Protection Officer to oversee our compliance, advise our teams, act as a point of contact for individuals and for the UAE Data Office, and monitor how we handle personal data. Our Data Protection Officer is info@corpshore.ae, and you can reach the office at info@corpshore.ae. The registered entity name, the trade licence and the registered address of Corpshore Emirates are Corpshore Emirates, and the governing law and forum for any formal matter are the laws of the United Arab Emirates. This statement is drafted for review by our UAE counsel and will take effect once that review is complete.