An organisation must provide personal data to data subjects or to another controller when requested by a data subject. This Practice Note will provide an overview of how an organisation can meet its obligation in relation to transmitting personal data to data subjects, or to another data controller, when asked by a data subject, and when an organisation may refuse to proceed with such a request.

• ADGM: Abu Dhabi Global Market.

• Data subject: An identified or identifiable living natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

• Controller: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purpose and means of the processing of personal data.

• Commissioner of Data Protection: The person appointed by the board to be the Head of the Office of Data Protection.