Federal Decree-Law No. 45/2021 On the Protection of Personal Data allows controllers and processors to transfer personal data outside the United Arab Emirates (UAE) under specified circumstances. One of the allowed cases is to transfer personal data outside the UAE on the basis of a bilateral or multilateral agreement between the UAE and the data recipient’s country.

• Personal data: Any data relating to an identified natural person, or one who can be identified directly or indirectly by way of linking data, using identifiers such as name, voice, picture, identification number, online identifier, geographic location, or one or more special features that express the physical, psychological, economic, cultural or social identity of such person. It also includes sensitive personal data and biometric data.

• Sensitive personal data: Any data that directly or indirectly reveals a natural person's family, racial origin, political or philosophical opinions, religious beliefs, criminal records, biometric data, or any data related to the health of such person, such as their physical, psychological, mental, genetic or sexual condition, including information related to health care services provided thereto that reveals their health status.

• Data subject: A natural person who is the subject of the personal data.