Data Protection Regulations (Substantial Public Interest Conditions) Rules 2025

Public Consultation Paper No. 6 of 2025 Appendix 1 1 DATA PROTECTION REGULATIONS (SUBSTANTIAL PUBLIC INTEREST CONDITIONS) RULES 2025 Date of Adoption: [●] 2025 The Board of Directors of the Abu Dhabi Global Market, pursuant to section 60 of the Data Protection Regulations 2021 and after taking into account the general provisions of sections 1, 2 and 3 of the Regulations, hereby makes the following rules to be implemented and enforced by the Commissioner of Data Protection of the Abu Dhabi Global Market:

1. Citation, commencement and interpretation (1) These Rules may be cited as the Data Protection Regulations (Substantial Public Interest Conditions) Rules 2025. (2) In these Rules, “Regulations” means the Data Protection Regulations 2021. (3) Terms used in these Rules which are defined in the Regulations shall have the meanings given to them in the Regulations. (4) These Rules come into force on the date of their publication.
2. Application These Rules shall apply to the Processing of Special Categories of Personal Data based on section 7(2)(k)(xii) of the Regulations.
3. Condition related to insurance (1) This condition is met if the Processing— (a) is necessary for an insurance purpose, (b) is of Special Categories of Personal Data, and (c) is necessary for reasons of substantial public interest, subject to subsection (2). (2) Where— (a) the Processing is not carried out for the purposes of measures or decisions with respect to the Data Subject, and (b) the Data Subject does not have and is not expected to acquire— (i) rights against, or obligations in relation to, a person who is an insured person under an insurance contract to which the insurance purpose mentioned in subsection (1)(a) relates, or (ii) other rights or obligations in connection with such a contract,

Public Consultation Paper No. 6 of 2025 Appendix 1 2 the Processing does not meet the condition in subsection (1) unless, in addition to meeting the requirements in that subsection, it can reasonably be carried out without the Consent of the Data Subject. (3) For the purposes of subsection (2), Processing can reasonably be carried out without the Consent of the Data Subject only where— (a) the Controller cannot reasonably be expected to obtain the Consent of the Data Subject, and (b) the Controller is not aware of the Data Subject withholding Consent. (4) In this Rule— (a) “insurance contract” means a contract of general insurance, long-term insurance, or re-insurance; (b) “insurance purpose” means— (i) advising on, arranging, underwriting or administering an insurance contract, (ii) administering a claim under an insurance contract, or (iii) exercising a right, or complying with an obligation, arising in connection with an insurance contract, including a right or obligation arising under an enactment or rule of law. (5) The reference in subsection (3)(b) to a Data Subject withholding Consent does not include a Data Subject merely failing to respond to a request for Consent. 4. Condition related to the safeguarding of children and of individuals at risk (1) This condition is met if— (a) the Processing is necessary for the purposes of— (i) protecting an individual from neglect or physical, mental or emotional harm, or (ii) protecting the physical, mental or emotional well-being of an individual, (b) the individual is— (i) aged under 18, or (ii) aged 18 or over and at risk, (c) the Processing is carried out without the Consent of the Data Subject for one of the reasons listed in subsection (2), and (d) the Processing is necessary for reasons of substantial public interest.

Public Consultation Paper No. 6 of 2025 Appendix 1 3 (2) The reasons mentioned in subsection (1)(c) are— (a) in the circumstances, Consent to the Processing cannot be given by the Data Subject; (b) in the circumstances, the Controller cannot reasonably be expected to obtain the Consent of the Data Subject to the Processing; and (c) the Processing must be carried out without the Consent of the Data Subject because obtaining the Consent of the Data Subject would prejudice the provision of the protection mentioned in subsection (1)(a). (3) For the purposes of this Rule, an individual aged 18 or over is “at risk” if the Controller has reasonable cause to suspect that the individual— (a) has needs for care and support, (b) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and (c) as a result of those needs is unable to protect himself or herself against the neglect or harm or the risk of it. (4) In subsection (1)(a), the reference to the protection of an individual or of the well￾being of an individual includes both protection relating to a particular individual and protection relating to a type of individual.