I hold my clients' financial data — how does the UAE's data protection law actually affect my firm?

By the nature of its work, an accounting or advisory firm holds a large volume of sensitive personal and financial data about its clients — bank statements, payroll, ownership structures. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (in force since 2 January 2022), together with its implementing regulation issued in 2024, is the framework governing how that data must be handled. The basic rule: any processing of personal data needs a clear legal basis, most commonly specific, informed consent from the data subject, and that bar rises further when the data qualifies as "sensitive," which detailed financial data typically does.

In practice, there are specific obligations a firm needs to be ready for: if a data breach occurs that could plausibly cause harm, it must be reported to the relevant data office within 72 hours of discovery, and affected individuals must be notified "without undue delay" where the risk is high. If you transfer client data outside the UAE — say, to a partner office abroad or a cloud service hosted overseas — there needs to be an approved basis for that transfer, whether an adequacy list, standard contractual clauses, or explicit consent in limited cases. Appointing a formal data protection officer isn't mandatory for every small firm, but becomes necessary once the volume of sensitive data you process is substantial. Fines can reach up to AED 5 million per violation. RASEEKH helps professional firms build a realistic data-handling policy sized to their operations, rather than ignoring the obligation or over-engineering it.