Consultation Paper No. 2 of 2017 – Amendments to ADGM’s Data Protection Regulations — FSRA — AE

CONSULTATION PAPER
NO.2 OF 2017
4 MAY 2017
PROPOSED AMENDMENTS TO ADGM’S DATA
PROTECTION REGULATIONS

2
INTRODUCTION
WHY ARE WE ISSUING THIS PAPER?

The Abu Dhabi Global Market ("ADGM") and the Registration Authority (“RA”) has issued this
Consultation Paper to invite public comment on proposed amendments to the Data Protection Regulations 2015 (the “Regulations”).
We have summarised the main provisions of the Regulations in this Consultation Paper. The summaries
provided within should be read as an introduction to the provisions only – many of the precise details and specifics are contained in the draft Regulations themselves. Where terms are capitalised in this paper, they (unless context requires otherwise) should be taken to have the definitions ascribed to such terms in the Regulations.
A proposed draft of the Regulations is set out at Annex A to this Consultation Paper.
WHO SHOULD READ THIS PAPER?
The proposals in this Consultation Paper would be of interest to individuals, organisations and investors
with an interest in establishing a presence in ADGM or otherwise doing business in ADGM, and their professional advisors. HOW TO PROVIDE COMMENTS
All comments should be in writing and sent to the address or email specified below. If sending your
comments by email, please use the Consultation Paper number in the subject line. You may, if relevant, identify the organisation you represent in providing your comments. The Registration Authority reserves the right to publish, including on its website, any comments you provide, unless you expressly request otherwise at the time of making comments. Comments supported by reasoning and evidence will be given more weight by the Registration Authority. WHAT HAPPENS NEXT?
The deadline for providing comments on this proposal is 30 May 2017. Once we receive your
comments, we will consider whether any modifications are required to this proposal. The amendments to the Regulations will then be considered by the ADGM Board of Directors (the “Board”) for enactment. You should not act on these proposals until the amended Regulations are issued. We shall issue a notice on our website telling you when this happens. COMMENTS TO BE ADDRESSED TO:
Consultation Paper No. 2 of 2017
Registration Authority
Abu Dhabi Global Market Square
Al Maryah Island
PO Box 111999
Abu Dhabi, UAE
Email: ra@adgm.com

3
AMENDMENT TO DATA PROTECTION REGULATIONS
SCOPE AND APPROACH TO THE PROPOSED AMENDMENTS OF DATA PROTECTION REGULATIONS
7. This Consultation Paper aims to propose amendments to the existing Regulations. The proposed
amendments offer more clarity on defined terms, designation of jurisdictions with adequate level of protection, enhanced enforcement provisions, amendment to the Registrar notification provisions, amendment to data transfer agreements, amendment for ADGM authorities to share information with other authorities and amendment to the fees schedule.
8. The Board is aware of the EU General Data Protection Regulation ("GDPR”), which has been developed
by the European Commission to replace the current EU Data Protection Directive (Directive 95/46/EC). The GDPR applies from 25 May 2018 and until such time the EU Data Protection Directive will still be applicable. The draft Regulations have not attempted to preempt GDPR.
9. The Regulations apply to any person based in the ADGM who, either alone or jointly with others,
determines the purposes or processing methods of any Personal Data (collectively defined as "Data Controllers").
10. The following amendments are proposed to the defined terms:
a. The definition of Sensitive Personal Data has been amended to include Person Data concerning an individual’s criminal record. This addresses a difference in scope from the same concept in equivalent EU legislation. b. The definition of Personal Data has been amended by introduction of Data and Relevant Filing System as new defined terms. The amendments have the effect of:
i. explicitly including electronic databases and filing systems (please see definition of
‘Relevant Filing System’); and
ii. introducing various consequential changes throughout the Regulations and the
Schedules to define ‘Data’ where used (as distinct from ‘Personal Data’).
c. The definitions of Abu Dhabi Global Market Board, ADGM Registration Authority, ADGM Courts,
and ADGM Financial Services Regulatory Authority have also been updated to refer to the meanings given to those terms in the Interpretation Regulations 2015. ISSUE FOR CONSIDERATION Q1: DO YOU AGREE WITH THE PROPOSED AMENDMENTS TO THE DEFINED TERMS?

4
11. Certain provisions of the Regulations have been amended with the effect that:
a) Jurisdictions listed in Schedule 3 to the Regulations are now designated as jurisdictions with an adequate level of protection for Personal Data pursuant to the Regulations (rather than, as previously, pursuant to designation by the Registrar); and b) The Registrar now has an explicit power to designate further jurisdictions as having an adequate level of protection for Personal Data, and to withdraw such status from a jurisdiction.
12. This addresses possible issues that have arisen in the EU, as regards the legality of the European
Commission’s designation of the USA as equivalent. By making this designation take effect under the Regulations, questions as to the status of ADGM designations are eliminated. ISSUE FOR CONSIDERATION Q2: DO YOU AGREE WITH THE PROPOSED METHOD OF DESIGNATING JURISDICTIONS OFFERING ADEQUATE PROTECTION FOR PERSONAL DATA AND POWERS GRANTED TO THE REGISTRAR TO MAKE SUCH DESIGNATION?
13. The proposed amendments in the Regulations to enhance enforcement provisions establishing specific
power of the Registrar are as follows:
a) To make additional rules regarding procedures relating to the imposition of financial penalties; and b) To impose fines in respect of contraventions of directions of the Registrar, the Regulations, or rules made pursuant to the Regulations;
14. An additional provision establishes the presumption that enforcement related certificates signed by
the Registrar are deemed to be:
a) Conclusive evidence of the application of the enforcement action in question; and b) Prima facie evidence of the facts contained in the direction or notice.
15. Non-compliance with any direction issued by the Registrar, the Regulations or any rules made pursuant
to the Regulations are now subject to a maximum fine of USD25,000 (currently USD15,000 in the Regulations). ISSUE FOR CONSIDERATION Q3: DO YOU AGREE WITH THE PROPOSED ADDITIONAL ENFORCEMENT PROVISIONS? Q4: DO YOU AGREE TO AN INCREASED MAXIMUM FINE PROPOSED IN THE AMENDMENT REGULATIONS?

5
16. The amendment Regulations propose time limits and clarifications to the existing provisions regarding
when Data Controllers must make certain notifications to the Registrar.
ISSUE FOR CONSIDERATION
Q5: DO YOU AGREE WITH THE PROPOSED TIME LIMITS OF ONE MONTH SPECIFIED FOR NOTIFICATIONS BY DATA CONTROLLER TO THE REGISTRAR?
17. The amendment Regulations propose amendments to the Model Data Transfer Agreements with the
effect that clauses relating to parties’ obligations and termination clauses correspond to the proposed amendments in jurisdictions that have either been designated by the Regulations or the Registrar as having an adequate level of protection for Personal Data. In addition to that, a grandfathering clause has been added to the Regulations to ensure that model data transfer agreements entered into prior to the proposed amendments remain effective, and that data transfers in accordance with such agreements will be in compliance with the Regulations. ISSUE FOR CONSIDERATION Q6: DO YOU AGREE WITH THE PROPOSED AMENDMENTS TO THE MODEL DATA TRANSFER AGREEMENT?
18. The amendment Regulations propose general exemption for ADGM independent authorities to share
data with other authorities to enable the Board, ADGM Registration Authority, ADGM Courts, or ADGM Financial Services Regulatory Authority to share Personal Data and Sensitive Data with other governmental or regulatory bodies or authorities for the purpose of exercising the recipient’s, ADGM Registration Authority’s, ADGM Courts’, or ADGM Financial Services Regulatory Authority’s powers or objectives. ISSUE FOR CONSIDERATION Q7: DO YOU AGREE WITH THE PROPOSED EXPANDED GENERAL EXEMPTIONS GRANTED TO ADGM AND ITS AUTHORITIES?
19. The amendment Regulations propose amendments to the Fees schedule to the effect of further
detailing certain types of applications/notifications for which fees are payable. For example, the amendments clarify that the fee for appointment of a Data Processor is payable per appointment where there is more than one.
20. There are no new fees introduced nor amendment to the quantum of existing fees.

6
21. The rule-making provisions in the Regulations have also been supplemented so that the Board is
empowered to make rules imposing additional fees for any other matters related to the Regulations, and to amend the level of fees payable for applications/notifications under Schedule 3 of the Regulations or under any other rules made by the Board pursuant to the Regulations. ISSUE FOR CONSIDERATION Q8: DO YOU AGREE WITH THE PROPOSED CHANGES TO THE FEES SCHEDULE?

7
ANNEX A: PROPOSED AMENDED DATA PROTECTION REGULATIONS

Consultation Paper No. 2 of 2017
Annex A
DATA PROTECTION (AMENDMENT) REGULATIONS 2017

Amendments to the Data Protection Regulations 2015 ..................................................... 2
Insertion of new sections ................................................................................................... 9
Short title, extent and commencement............................................................................. 10

Annex A
2
DATA PROTECTION (AMENDMENT) REGULATIONS 2017
Regulations to amend the Data Protection Regulations 2015.
Date of Enactment: [] 2017
The Board of Directors of the Abu Dhabi Global Market, in exercise of its powers under Article 6(1) of Law No. 4 of 2013 concerning the Abu Dhabi Global Market issued by His Highness the Ruler of the Emirate of Abu Dhabi, hereby enacts the following Regulations–

Amendments to the Data Protection Regulations 2015
(1) The Data Protection Regulations 2015 are amended as follows.
(2) All references to "data" in those regulations shall be substituted by references to "Data", except where indicated below:
(a) in the sentence stating “Regulations to make provision for the protection of personal data within the Abu Dhabi Global Market and for connected purposes” in the recitals to the Data Protection Regulations 2015; (b) in subsections 5(1)(n), 17(1) and 17(6); (c) in the sentence stating “For the purposes of section 5 of the Data Protection Regulations 2015 (the "Regulations") for the transfer of Personal Data to data controllers established in jurisdictions outside the Abu Dhabi Global Market which do not ensure an adequate level of data protection ("Non-Abu Dhabi Global Market Data Controllers")” in Schedule 1; (d) in the terms “third party data controller”, “data transfer agreement” or “data protection standards” in subparagraph (2) of paragraph 3 of Schedule 1; (e) in subparagraph (2) of paragraph 7 of Schedule 1; (f) in the sentence stating “For the purposes of section 5 of the Data Protection Regulations 2015 (the "Regulations") for the transfer of Personal Data to Data Processors established in jurisdictions outside the Abu Dhabi Global Market which do not ensure an adequate level of data protection” in Schedule 2; and (g) in the terms “data processor”, “data protection obligations” or “data protection aspects” in subparagraphs 1(d), 11(1) and 11(3) of Schedule 2. (3) For subsection (1) of section 4, the following shall be substituted— "Except as set out in section 5, a transfer of Personal Data to a Recipient located in a jurisdiction outside the Abu Dhabi Global Market may take place only if the jurisdiction is listed in
Schedule 3 or has been designated by the Registrar under subsection (3)."
(4) For paragraph (c) of subsection (2) of section 4, the following shall be substituted— “if the Personal Data do not emanate from the Abu Dhabi Global Market, the country of origin and country of final destination of the Personal Data; and”.

Annex A
3
(5) For subsection (3) of section 4, the following shall be substituted— “Certain jurisdictions are hereby designated as providing an adequate level of protection for Personal Data for the purposes of subsection (1). These are listed in Schedule 3 to these Regulations. Additional jurisdictions may be designated by the Registrar from time to time to the list of jurisdictions considered to fall under subsection (1) which shall be deemed to be part of Schedule 3 by a publication to such effect on the Registrar's website.” (6) In section 4, a new subsection (4) shall be inserted as follows— “The Registrar may also, by publication to such effect on the Registrar’s website, withdraw a designation from a jurisdiction designated under subsection (3) or listed in Schedule 3 if the Registrar considers that: (a) the relevant jurisdiction no longer provides an adequate level of protection for Personal Data for the purposes of subsection (1); and (b) such removal is warranted in order to further the protection of Personal Data.” (7) In section 5, the number "(1)" shall be inserted before the words "A transfer or a set of transfers of Personal Data to a Recipient" and any existing references to paragraphs (a) to (n) of section 5 of the Data Protection Regulations 2015 prior to the date of commencement of these Regulations shall be construed as references to the corresponding paragraphs (a) to (n) of subsection (1) of section 5 of the Data Protection Regulations 2015 accordingly. (8) In section 5, a new subsection (2) shall be inserted as follows— “(2) A transfer or set of transfers of Personal Data to a Recipient which is not subject to laws which ensure an adequate level of protection within the meaning of section 4(1) shall still be regarded as having been made pursuant to subsection 5(1)(m) if – (a) a legally binding agreement had been entered into between the transferor and Recipient prior to the date of commencement of the Data Protection (Amendment) Regulations 2017; and (b) the agreement mentioned in subsection (a) above is in the form previously contained in Schedule 1 or 2 of the Data Protection Regulations 2015 prior to the amendments made by the Data Protection (Amendment) Regulations 2017, regardless of whether such transfer occurs prior to or after the effective date of the Data Protection (Amendment) Regulations 2017.” (9) In subparagraph (v) of paragraph (c) of subsection (1) of section 6, for the words "5(k)", the words "5(1)(k)" shall be substituted. (10) In subparagraph (v) of paragraph (c) of subsection (1) of section 7, for the words "5(k)", the words "5(1)(k)" shall be substituted. (11) In subsection (1) of section 12, for the words "data controller", the words "Data Controller" shall be substituted. (12) For subsection (3) of section 12, the following shall be substituted— “(3) A Data Controller must also notify the Registrar of– (a) an intention to renew its annual registration as a Data Controller, within one month of the end of its
current registration;

Annex A
4
(b) an intention to appoint a Data Processor (prior to such appointment taking effect), to renew annually or to change any appointed Data Processor, within one month of the change taking effect; (c) any change in the particulars of any appointed Data Processor, within one month of the change; and (d) any change in its business contact details, within one month of the change.” (13) In paragraph (c) of subsection (3) of section 14 the word “and” shall be omitted. (14) For paragraph (d) of subsection (3) of section 14, the following shall be substituted— “(d) issue directions or warnings and make recommendations to Data Controllers;” (15) In subsection (3) of section 14, new paragraphs (e) and (f) shall be inserted as follows— “(e) impose fines in the event of non-compliance with its direction; and (f) impose fines in the event of non-compliance with these Regulations and any rules made pursuant to these Regulations.” (16) For subsection (2) of section 16, the following shall be substituted— “(2) In particular, the Board when exercising the power in subsection (1) may make rules in respect of– (a) forms, procedures and requirements under these Regulations; (b) the keeping of the register of notifications established under section 13; (c) the conduct of the Registrar and its staff in relation to the exercise of powers and performance of functions under these Regulations; (d) the procedures relating to the imposition of sanctions or fines and the recovery of fines under Part 6; (e) the level of fees payable for any matter listed in Schedule 4 to these Regulations or the level of fees payable for any other matter or step, and shall be entitled to amend any of the amounts specified in Schedule 4; and (f) requiring any other fees to be paid in connection with any application or notification.” (17) For subsection (1) of section 17, the following shall be substituted— “(1) If the Registrar is satisfied that a Data Controller, Data Processor or data controller established outside the Abu Dhabi Global Market has contravened or is contravening these Regulations or any rules made under these Regulations, the Registrar may issue a direction to the Data Controller requiring him to do either or both of the following– (a) to do or refrain from doing any act or thing within such time as may be specified in the direction; or

Annex A
5
(b) to refrain from Processing any Personal Data specified in the direction or to refrain from Processing Personal Data for a purpose or in a manner specified in the direction.” (18) For paragraph (b) of subsection (2) of section 17, the following shall be substituted— “(b) a statement to the effect that the Data Controller may refer the matter to the Court.” (19) For subsection (3) of section 17, the following shall be substituted— “(3) A Data Controller, who fails, without reasonable excuse, to comply with– (a) any direction issued by the Registrar under this section; (b) these Regulations; or (c) any rules made pursuant to these Regulations, shall be liable to a fine of up to USD 25,000.” (20) For subsection (4) of section 17, the following shall be substituted— “(4) A Data Controller, who receives a direction under this section may refer the matter to the Court.” (21) In section 17, a new subsection (8) shall be inserted as follows— “(8) Court Procedure Rules may make provision for any reference to the Court under subsection (4).” (22) For subsection (3) of section 19, the following shall be substituted— “(3) Without prejudice to subsection (1) above, none of sections 4, 5, 6, 7, 10, 11, 17 or 17A shall apply to the Board, the Court, the Regulator or the Registrar if the application of these sections would be likely to prejudice the proper discharge by those entities of their powers or functions in so far as such powers or functions are designed for protecting members of the public against– (a) financial loss due to dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, persons carrying on any Controlled Activities; or (b) dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, persons carrying on Regulated Activities.” (23) In section 19, a new subsection (4) shall be inserted as follows— “(4) The restrictions in these Regulations relating to the disclosure of confidential information, Personal Data and Sensitive Personal Data do not apply to the Board, the Court, the Regulator or the Registrar if disclosures are made pursuant to any memorandum of understanding or other arrangements for information exchange to any other governmental or other regulatory body or authority whether in the Abu Dhabi Global Market or otherwise for the purpose of assisting the performance by any such person of its functions and powers or made in good faith for the purposes of the exercise of the functions and powers of the Board, the Court, the Regulator, or the Registrar or in order to further the Court’s, the Board’s, the Regulator’s or the Registrar’s objectives.”

Annex A
6
(24) For section 20, the following shall be substituted— “In these Regulations, unless the context indicates otherwise, the defined terms listed below shall have the following meanings– “Abu Dhabi Global Market” has the meaning given to “Abu Dhabi Global Market” in the Interpretation Regulations 2015; “ADGM Founding Law” means Law No. 4 of 2013 concerning the Abu Dhabi Global Market issued by His Highness the Ruler of the Emirate of Abu Dhabi; “Board” has the meaning given to “Board” in the Interpretation Regulations 2015; "Company" has the meaning given to that term in the Financial Services and Markets Regulations 2015; "Controlled Activities" means controlled activities as defined in the Commercial Licensing Regulations 2015; "Court" has the meaning given to “Courts” in the Interpretation Regulations 2015; “Court Procedure Rules” has the meaning given under Part 7 of the ADGM Courts, Civil Evidence, Judgments, Enforcement and Judicial Appointments Regulations 2015; "Data" means any information which– (a) is being processed by means of equipment operating automatically in response to instructions given for that purpose; (b) is recorded with the intention that it should be processed by means of such equipment; or (c) is recorded as part of a Relevant Filing System or with the intention that it should form part of a Relevant Filing System; "Data Controller" means any person in the Abu Dhabi Global Market (excluding a natural person acting in his capacity as a staff member) who alone or jointly with others determines the purposes and means of the Processing of Personal Data; "Data Processor" means any person (excluding a natural person acting in his capacity as a staff member) who Processes Personal Data on behalf of a Data Controller; "Data Subject" shall mean the natural person to whom Personal Data relate; "Group" has the meaning given to that term in the Financial Services and Markets Regulations 2015; "Identifiable Natural Person" means a natural person who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his biological, physical, biometric, physiological, mental, economic, cultural or social identity; "Personal Data" means any Data relating to an identified natural person or Identifiable Natural Person;

Annex A
7
"Processing" means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction, and "Processed", "Processes" and "Process" shall be construed accordingly; "Recipient" means any person to whom Personal Data are disclosed, whether a Third Party or not, but does not include any person to whom disclosure is or may be made as a result of, or with a view to, a particular inquiry by or on behalf of that person made in the exercise of any power conferred by law; “Registrar” means the “Registration Authority” as that term is defined in the Interpretation Regulations 2015; "Regulated Activities" has the meaning given to it in the Financial Services and Markets Regulations 2015; “Regulator” means the “Financial Services Regulator” as that term is defined in the Interpretation Regulations 2015; "Relevant Filing System" means any set of information relating to an Identifiable Natural Person to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible; "Sensitive Personal Data" means Personal Data revealing or concerning (directly or indirectly) racial or ethnic origin, political opinions, religious or philosophical beliefs, criminal record, trade-union membership and health or sex life; "Staff" include past, existing or prospective employees, directors, partners, trustees, officers, office holders, temporary or casual workers, agents and volunteers; and "Third Party" means any person other than the Data Subject, the Data Controller, the Data Processor and the persons who, under the direct control of the Data Controller or the Data Processor, are authorised to Process the Personal Data.” (25) In subparagraph (a) of paragraph 1 of Schedule 1 the word ""Data"," is to be inserted before the words "Personal Data". (26) For subparagraph (i) of paragraph (2) of section 3 of Schedule 1, the following shall be substituted— "the third party data controller processes the Personal Data in accordance with the laws of a jurisdiction outside the Abu Dhabi Global Market that has been designated under the Regulations or by the Registrar as providing adequate protection for Personal Data;". (27) Subparagraphs (5) to (7) of section 5 of Schedule 1 shall be renumbered as paragraphs (1) to (3). All references to subparagraphs (5) to (7) of section 5 of Schedule 1 shall be construed as references to the corresponding subparagraphs (1) to (3) of section 5 of Schedule 1 of the Data Protection
Regulations 2015 accordingly. (28) For subparagraph (3) of paragraph 8 of Schedule 1, the following shall be substituted—

Annex A
8
“(3) Either Party may terminate these Clauses if each jurisdiction in which the Data Importer is incorporated or operates or uses the Personal Data is either: (a) subject to a designation under
section 4 of the Regulations by the Registrar; or (b) is or becomes listed in Schedule 3 to the
Regulations.”
(29) In subparagraph (a) of paragraph 1 of Schedule 2, the word ""Data"," is to be inserted before the words "Personal Data". (30) For subparagraph (4) of paragraph 6 of Schedule 2 the following shall be substituted— “(4) In addition to the Data Exporter's entitlement to terminate the Clauses in accordance with Clause 5(a), either Party may terminate these Clauses if each jurisdiction in which the Data Importer and each of its Subprocessors is incorporated or operates or uses the Personal Data is either: (a) subject to a designation under section 4 of the Regulations by the Registrar; or (b) is or becomes listed in Schedule 3 to the Regulations.” (31) In Schedule 3, for the words "by the Registrar", the word "herein" shall be substituted. (32) For Schedule 4, the following shall be substituted— FEES The following fees are payable by a Data Controller or Data Processor in respect of the applications and notifications made in accordance with the Regulations– Application or notification Fee payable (USD) Application for initial registration as a Data Controller 300 Application for initial appointment of a Data Processor (per appointment if more than one Data Processor) 300 Annual renewal of registration as a Data Controller and annual renewal of appointment of a Data Processor (per appointment if more than one Data Processor) 100 Notification of Data Controller no longer Processing Personal Data and/or removal of a Data Processor 0 Notification of change in the particulars of an appointed Data Processor 0 Notification of a change in the contact details of a Data Controller 0 Application to obtain a permit to process Sensitive Personal Data 100 Application to obtain a permit to transfer Personal Data 100

Annex A
9
2. Insertion of new sections
(1) Following section 17, new sections 17A and 17B shall be inserted as follows— “17A. Fines (1) The Board may make rules in respect of the procedures relating to the imposition and recovery of fines under this Part. (2) Where the Registrar considers that a Data Controller has contravened– (a) any direction issued by the Registrar under section 17, (b) these Regulations; or (c) any rules made pursuant to these Regulations, the Registrar, by written notice (a “monetary penalty notice”) to the Data Controller, may impose a fine in respect of the contravention. (3) A monetary penalty notice is a written notice requiring the Data Controller to pay to the Registrar a fine of an amount determined by the Registrar as the Registrar may consider appropriate. (4) The amount determined by the Registrar must not exceed the maximum fine specified in section 17(3). (5) The fine must be paid to the Registrar within the period specified in the monetary penalty notice. (6) The monetary penalty notice must contain such information as may be prescribed. (7) A Data Controller, who receives a monetary penalty notice under this section, may make a reference to the Court in respect of– (a) the issue of the monetary penalty notice; (b) the amount of the fine specified in the notice. (8) Court Procedure Rules may make provision for any reference under subsection (7). (9) If, within the period specified in the monetary penalty notice– (a) the Data Controller pays the fine specified in the notice to the Registrar– (i) subject to paragraph (ii) below, no proceedings or actions pursuant to this Part may be commenced, whether in the Courts or otherwise, by the Registrar against the Data Controller in respect of the relevant contravention; and (ii) without prejudice to paragraph (i) above, neither the imposition nor payment of a fine shall restrict the Registrar from taking any action against a Data Controller or refrain from doing any act or thing in relation to any continuing contravention; or

Annex A
10
(b) if all or any portion of a fine has not been paid at the end of the period stated in a monetary penalty notice, the obligation of the Data Controller to pay the fine is enforceable as a debt payable to the Registrar. The Registrar may apply to the Court for the recovery of the debt. (10) In this section “prescribed” means prescribed by rules made by the Board pursuant to these Regulations. 17B. Certificates A certificate that is signed by the Registrar and states that a direction under section 17 was issued to, or a monetary penalty notice prescribing a fine under section 17A was imposed on, a Data Controller is– (a) conclusive evidence of the giving of the direction or the imposition of the notice to the Data Controller; and (b) prima facie evidence of the facts contained in the direction or the notice, in any proceedings commenced under sections 17(4), 17(5), 17(6) or sections 17A(7) and 17A(9)(b).”
3. Short title, extent and commencement
(1) These Regulations may be cited as the Data Protection (Amendment) Regulations 2017. (2) These Regulations shall apply in the Abu Dhabi Global Market. (3) These Regulations come into force on the date of their publication.