Consultation Paper No. 6 of 2025 – Substantial Public Interest Rules

CONSULTATION PAPER NO. 6 OF 2025 PROPOSED ‘SUBSTANTIAL PUBLIC INTEREST’ RULES TO BE ISSUED UNDER THE DATA PROTECTION REGULATIONS 2021 11 June 2025

Consultation Paper No. 6 of 2025 2 CONTENTS Introduction.............................................................................................................................. 3 Why are we issuing this paper? .......................................................................................... 3 Who should read this paper? .............................................................................................. 3 How to provide comments................................................................................................... 3 What happens next? ............................................................................................................ 4 Scope and Approach to the Proposed Amendments............................................................ 5 Proposed Amendments........................................................................................................... 6 Current Position ................................................................................................................... 6 Proposed Amendments ....................................................................................................... 6 Proposed Amendments and Enactments............................................................................... 9

Consultation Paper No. 6 of 2025 3 Why are we issuing this paper? The Abu Dhabi Global Market (“ADGM”) Registration Authority (“RA”) has issued this Consultation Paper to invite public feedback and comments on the proposed amendment to the Data Protection Regulations 2021 (“Data Protection Regulations” or “Regulations”) to introduce additional substantial public interest grounds that will apply to the Processing of Special Categories of Personal Data through the issuance of the Data Protection Regulations (Substantial Public Interest Conditions) Rules 2025 (“Substantial Public Interest Rules”). The proposed amendment to the Regulations and the Substantial Public Interest Rules are set out in Annex A and Appendix 1 to this Consultation Paper, respectively. This Consultation Paper summarises the key proposals within the Regulations and the Substantial Public Interest Rules. The summaries provided within should be read as an introduction to the provisions only – the precise details and specifics are contained in the draft Regulations and Substantial Public Interest Rules. Capitalized terms used in this Consultation Paper shall have the meanings given to them in the Regulations. Who should read this paper? The proposals in this Consultation Paper would be of interest to all ADGM licensed entities, or those seeking to become ADGM licensed entities, insurance companies, schools, universities, nurseries, data controllers, data processors, and their respective professional advisors. How to provide comments All comments should be in writing and sent to the email specified below. Please include the Consultation Paper number in the subject line (No. 6 of 2025). If relevant, please identify the organisation you represent when providing your comments. The RA reserves the right to publish, including on its website, any comments you provide, unless you expressly request otherwise at the time of making any comments. Comments supported by reasoning and evidence will be given more weight. Introduction

Consultation Paper No. 6 of 2025 4 What happens next? The deadline for providing comments on this proposal is 2 July 2025. Following receipt and review of any comments, consideration will be had for whether any modifications to the proposals are required, and the ADGM Board of Directors (“Board”) and the RA will then proceed to enact the proposals in their final form. You should not act on these proposals until such time as the final Regulations and Substantial Public Interest Rules, and any guidance thereon, is issued by the Board and the RA. A notice will be issued on the ADGM website upon issuance of the final Regulations and Substantial Public Interest Rules. Comments to be addressed to: Consultation Paper No. 6 of 2025 Email: ra.consultation@adgm.com

Consultation Paper No. 6 of 2025 5

1. This Consultation Paper aims to explain the proposed: a. Amendment to the Regulations; and b. Substantial Public Interest Rules.
2. The proposed amendment to the Regulations will add a reference to additional substantial public interest grounds for Processing Special Categories of Personal Data.
3. The Substantial Public Interest Rules will provide conditions that must be met for a Controller to rely on substantial public interest to process Special Categories of Personal Data in connection with: c. Insurance; and d. Safeguarding of children and of individuals at risk.
4. A draft of the amended Regulations and Substantial Public Interest Rules can be found in Annex A and Appendix 1, respectively. Scope and Approach to the Proposed Amendments

Consultation Paper No. 6 of 2025 6 Current Position

1. Under the Data Protection Regulations, the default position with respect to the Processing of Special Categories of Personal Data is that it is prohibited, unless a Controller can rely upon an additional ground provided under Section 7(2), such as where an individual has given explicit consent or where processing is necessary for the establishment, exercise or defence of legal claims. In addition to this, Section 7(2)(k) permits the Processing of Special Categories of Personal Data under a number of ‘substantial public interest’ grounds, subject to the Controller having an appropriate policy document in place that documents and explains the procedures in place for handling Special Categories of Personal Data.
2. However, the ADGM Office of Data Protection (“ODP”) has noted two key gaps under the substantial public interest grounds related to insurance and reinsurance activities, and the safeguarding of children’s physical, emotional and mental well-being. Given the recent expansion to Al Reem Island, the ODP considers it necessary to introduce the Substantial Public Interest Rules to provide the conditions that must be met to process Special Categories of Personal Data for insurance purposes and in connection with the safeguarding of children. These conditions have been benchmarked against the UK Data Protection Act 2018. Proposed Amendments
3. The Substantial Public Interest Rules propose that certain conditions must be met in order for a Controller to rely on substantial public interest to process Special Categories of Personal Data for insurance purposes. The insurance condition is met if the Processing: (a) is necessary for an insurance purpose; (b) is of Special Categories of Personal Data; and (c) is necessary for reasons of substantial public interest. ‘Substantial public interest’ reasons covers a wide range of principles in relation to the public good or the best interests of society, rather than commercial or private interests. Insurance companies will need to point to reasons of substantial public interest rather than just their own interests. In other words, insurance companies may still have a private interest, however, they will need to make sure they can also point to a wider public benefit. Proposed Amendments Q1: DO YOU HAVE ANY CONCERNS WITH, OR FEEDBACK ON, THE PROPOSED CONDITIONS TO PROCESS SPECIAL CATEGORIES OF PERSONAL DATA FOR AN INSURANCE PURPOSE?

Consultation Paper No. 6 of 2025 7 4. The insurance condition mentioned in paragraph 3 of this Consultation Paper is subject to the following additional condition if (i) the Processing is not carried out for purposes of any actions or decisions with respect to the Data Subject, and (ii) the Data Subject is not expected to acquire any rights or obligations against or towards the insured under the relevant insurance contract: (a) the Processing can reasonably be carried out without the Consent of the Data Subject. For purposes of this condition, this means that the Controller cannot reasonably be expected to obtain the Data Subject’s Consent, and that the Controller is not aware of the Data Subject withholding Consent. A Data Subject’s failure to respond to a request for Consent will not be considered as withholding Consent. 5. The Substantial Public Interest Rules will define ‘insurance contract’ and ‘insurance purpose’ as follows: “(a) “insurance contract” means a contract of general insurance, long-term insurance, or re-insurance; (b) “insurance purpose” means— (i) advising on, arranging, underwriting or administering an insurance contract, (ii) administering a claim under an insurance contract, or (iii) exercising a right, or complying with an obligation, arising in connection with an insurance contract, including a right or obligation arising under an enactment or rule of law.” 6. The Substantial Public Interest Rules also propose certain conditions that must be met in order for a Controller to rely on substantial public interest to process Special Categories of Personal Data for the safeguarding of children and individuals at risk. In other words, this condition will allow the Processing of Personal Data in certain situations where the protection of vulnerable individuals is necessary. This condition will be met if: Q2: DO YOU HAVE ANY CONCERNS WITH, OR FEEDBACK ON, THE PROPOSED ADDITIONAL CONDITION RELATING TO PROCESSING WITHOUT THE CONSENT OF THE DATA SUBJECT? Q3: DO YOU HAVE ANY CONCERNS WITH, OR FEEDBACK ON, THE PROPOSED DEFINITIONS OF INSURANCE CONTRACT AND/OR INSURANCE PURPOSE?

Consultation Paper No. 6 of 2025 8 (a) the Processing is necessary to protect an individual from emotional or physical harm or to protect the emotional or physical well-being of an individual; (b) the individual is aged under 18, or aged over 18 and at risk; (c) the Processing is carried out without the Data Subject’s Consent; and (d) the Processing is necessary for reasons of substantial public interest. As previously stated, ‘substantial public interest’ reasons covers a wide range of principles in relation to the public good or the best interests of society, rather than commercial or private interests. The safeguarding of vulnerable individuals should align with broader public interest goals, such as public health, safety, or preventing harm to society as a whole. For example, preventing child abuse or protecting vulnerable adults from exploitation. 7. In order for the Processing to be carried out without the Data Subject’s Consent: (a) Consent cannot be given by the Data Subject; (b) the Controller cannot reasonably be expected to obtain the Data Subject’s Consent; and (c) the Processing must proceed without the Data Subject’s Consent, otherwise the protection of an individual from emotional or physical harm or the protection of the emotional or physical well-being of an individual would be prejudiced. For subsection (a), this may include situations where the individual is incapacitated or unable to understand, or where the individual is too frightened given the circumstances. For subsection (b), this may be the case where urgent or immediate action is required. 8. An individual aged 18 or over will be considered ‘at risk’ if the Controller has reasonable cause to suspect that the individual has a need for care or support, is experiencing (or at risk of experiencing) neglect or physical or emotional harm, and as a result of such needs is unable to protect themselves from any harm or neglect, or the risk of it. Q4: DO YOU HAVE ANY CONCERNS WITH, OR FEEDBACK ON, THE PROPOSED CONDITIONS TO PROCESS SPECIAL CATEGORIES OF PERSONAL DATA FOR THE PURPOSE OF SAFEGUARDING A CHILD OR INDIVIDUAL AT RISK? Q5: DO YOU HAVE ANY CONCERNS WITH, OR FEEDBACK ON, THE PROPOSED ADDITIONAL CONDITIONS RELATING TO PROCESSING WITHOUT THE CONSENT OF THE DATA SUBJECT? Q6: DO YOU HAVE ANY CONCERNS WITH, OR FEEDBACK ON, THE PROPOSED DEFINITION OF AN INDIVIDUAL AGED 18 OR OVER AND CONSIDERED ‘AT RISK’? Q7: DO YOU HAVE ANY BROADER FEEDBACK ON THE PROPOSED AMENDMENTS THAT IS NOT COVERED BY THE QUESTIONS SET OUT ABOVE?

Consultation Paper No. 6 of 2025 9 Regulations Annex A Proposed Amendment to Data Protection Regulations 2021 Appendix 1 Proposed Data Protection Regulations (Substantial Public Interest Conditions) Rules 2025 Proposed Amendments and Enactments