Consultation Paper No. 6 of 2025 – Substantial Public Interest Rules

CONSULTATION PAPER
NO. 6 OF 2025
PROPOSED ‘SUBSTANTIAL PUBLIC INTEREST’
RULES TO BE ISSUED UNDER THE DATA
PROTECTION REGULATIONS 2021
11 June 2025

Consultation Paper No. 6 of 2025
CONTENTS
Introduction.............................................................................................................................. 3
Why are we issuing this paper? .......................................................................................... 3
Who should read this paper? .............................................................................................. 3
How to provide comments................................................................................................... 3
What happens next? ............................................................................................................ 4
Scope and Approach to the Proposed Amendments............................................................ 5
Proposed Amendments........................................................................................................... 6
Current Position ................................................................................................................... 6
Proposed Amendments ....................................................................................................... 6
Proposed Amendments and Enactments............................................................................... 9

Consultation Paper No. 6 of 2025
Why are we issuing this paper?
The Abu Dhabi Global Market (“ADGM”) Registration Authority (“RA”) has issued this Consultation Paper to invite public feedback and comments on the proposed amendment to the Data Protection Regulations 2021 (“Data Protection Regulations” or “Regulations”) to introduce additional substantial public interest grounds that will apply to the Processing of Special Categories of Personal Data through the issuance of the Data Protection Regulations (Substantial Public Interest Conditions) Rules 2025 (“Substantial Public Interest Rules”). The proposed amendment to the Regulations and the Substantial Public Interest Rules are set out in Annex A and Appendix 1 to this Consultation Paper, respectively. This Consultation Paper summarises the key proposals within the Regulations and the Substantial Public Interest Rules. The summaries provided within should be read as an introduction to the provisions only – the precise details and specifics are contained in the draft Regulations and Substantial Public Interest Rules. Capitalized terms used in this Consultation Paper shall have the meanings given to them in the Regulations. Who should read this paper? The proposals in this Consultation Paper would be of interest to all ADGM licensed entities, or those seeking to become ADGM licensed entities, insurance companies, schools, universities, nurseries, data controllers, data processors, and their respective professional advisors. How to provide comments All comments should be in writing and sent to the email specified below. Please include the Consultation Paper number in the subject line (No. 6 of 2025). If relevant, please identify the organisation you represent when providing your comments. The RA reserves the right to publish, including on its website, any comments you provide, unless you expressly request otherwise at the time of making any comments. Comments supported by reasoning and evidence will be given more weight. Introduction

Consultation Paper No. 6 of 2025
What happens next?
The deadline for providing comments on this proposal is 2 July 2025.
Following receipt and review of any comments, consideration will be had for whether any modifications to the proposals are required, and the ADGM Board of Directors (“Board”) and the RA will then proceed to enact the proposals in their final form. You should not act on these proposals until such time as the final Regulations and Substantial Public Interest Rules, and any guidance thereon, is issued by the Board and the RA. A notice will be issued on the ADGM website upon issuance of the final Regulations and Substantial Public Interest Rules. Comments to be addressed to:
Consultation Paper No. 6 of 2025
Email: ra.consultation@adgm.com

Consultation Paper No. 6 of 2025

1. This Consultation Paper aims to explain the proposed:
   a. Amendment to the Regulations; and b. Substantial Public Interest Rules.
2. The proposed amendment to the Regulations will add a reference to additional substantial
   public interest grounds for Processing Special Categories of Personal Data.
3. The Substantial Public Interest Rules will provide conditions that must be met for a
   Controller to rely on substantial public interest to process Special Categories of Personal Data in connection with:
   c. Insurance; and
   d. Safeguarding of children and of individuals at risk.
4. A draft of the amended Regulations and Substantial Public Interest Rules can be found in
   Annex A and Appendix 1, respectively.
   Scope and Approach to the Proposed Amendments

Consultation Paper No. 6 of 2025
Current Position

1. Under the Data Protection Regulations, the default position with respect to the Processing of
   Special Categories of Personal Data is that it is prohibited, unless a Controller can rely upon an additional ground provided under Section 7(2), such as where an individual has given explicit consent or where processing is necessary for the establishment, exercise or defence of legal claims. In addition to this, Section 7(2)(k) permits the Processing of Special Categories of Personal Data under a number of ‘substantial public interest’ grounds, subject to the Controller having an appropriate policy document in place that documents and explains the procedures in place for handling Special Categories of Personal Data.
2. However, the ADGM Office of Data Protection (“ODP”) has noted two key gaps under the
   substantial public interest grounds related to insurance and reinsurance activities, and the safeguarding of children’s physical, emotional and mental well-being. Given the recent expansion to Al Reem Island, the ODP considers it necessary to introduce the Substantial Public Interest Rules to provide the conditions that must be met to process Special Categories of Personal Data for insurance purposes and in connection with the safeguarding of children. These conditions have been benchmarked against the UK Data Protection Act 2018. Proposed Amendments
3. The Substantial Public Interest Rules propose that certain conditions must be met in order for
   a Controller to rely on substantial public interest to process Special Categories of Personal Data for insurance purposes. The insurance condition is met if the Processing:
   (a) is necessary for an insurance purpose;
   (b) is of Special Categories of Personal Data; and (c) is necessary for reasons of substantial public interest. ‘Substantial public interest’ reasons covers a wide range of principles in relation to the public good or the best interests of society, rather than commercial or private interests. Insurance companies will need to point to reasons of substantial public interest rather than just their own interests. In other words, insurance companies may still have a private interest, however, they will need to make sure they can also point to a wider public benefit. Proposed Amendments Q1: DO YOU HAVE ANY CONCERNS WITH, OR FEEDBACK ON, THE PROPOSED CONDITIONS TO PROCESS SPECIAL CATEGORIES OF PERSONAL DATA FOR AN INSURANCE PURPOSE?

Consultation Paper No. 6 of 2025
4. The insurance condition mentioned in paragraph 3 of this Consultation Paper is subject to the
following additional condition if (i) the Processing is not carried out for purposes of any actions or decisions with respect to the Data Subject, and (ii) the Data Subject is not expected to acquire any rights or obligations against or towards the insured under the relevant insurance contract:
(a) the Processing can reasonably be carried out without the Consent of the Data Subject. For purposes of this condition, this means that the Controller cannot reasonably be expected to obtain the Data Subject’s Consent, and that the Controller is not aware of the Data Subject withholding Consent. A Data Subject’s failure to respond to a request for Consent will not be considered as withholding Consent.
5. The Substantial Public Interest Rules will define ‘insurance contract’ and ‘insurance purpose’
as follows:
“(a) “insurance contract” means a contract of general insurance, long-term insurance, or re-insurance; (b) “insurance purpose” means— (i) advising on, arranging, underwriting or administering an insurance contract, (ii) administering a claim under an insurance contract, or (iii) exercising a right, or complying with an obligation, arising in connection with an insurance contract, including a right or obligation arising under an enactment or rule of law.”
6. The Substantial Public Interest Rules also propose certain conditions that must be met in
order for a Controller to rely on substantial public interest to process Special Categories of Personal Data for the safeguarding of children and individuals at risk. In other words, this condition will allow the Processing of Personal Data in certain situations where the protection of vulnerable individuals is necessary. This condition will be met if:
Q2: DO YOU HAVE ANY CONCERNS WITH, OR FEEDBACK ON, THE PROPOSED ADDITIONAL CONDITION RELATING TO PROCESSING WITHOUT THE CONSENT OF THE DATA SUBJECT? Q3: DO YOU HAVE ANY CONCERNS WITH, OR FEEDBACK ON, THE PROPOSED DEFINITIONS OF INSURANCE CONTRACT AND/OR INSURANCE PURPOSE?

Consultation Paper No. 6 of 2025
(a) the Processing is necessary to protect an individual from emotional or physical harm or to protect the emotional or physical well-being of an individual; (b) the individual is aged under 18, or aged over 18 and at risk; (c) the Processing is carried out without the Data Subject’s Consent; and (d) the Processing is necessary for reasons of substantial public interest. As previously stated, ‘substantial public interest’ reasons covers a wide range of principles in relation to the public good or the best interests of society, rather than commercial or private interests. The safeguarding of vulnerable individuals should align with broader public interest goals, such as public health, safety, or preventing harm to society as a whole. For example, preventing child abuse or protecting vulnerable adults from exploitation.
7. In order for the Processing to be carried out without the Data Subject’s Consent:
(a) Consent cannot be given by the Data Subject; (b) the Controller cannot reasonably be expected to obtain the Data Subject’s Consent; and (c) the Processing must proceed without the Data Subject’s Consent, otherwise the protection of an individual from emotional or physical harm or the protection of the emotional or physical well-being of an individual would be prejudiced. For subsection (a), this may include situations where the individual is incapacitated or unable to understand, or where the individual is too frightened given the circumstances. For subsection (b), this may be the case where urgent or immediate action is required.
8. An individual aged 18 or over will be considered ‘at risk’ if the Controller has reasonable cause
to suspect that the individual has a need for care or support, is experiencing (or at risk of experiencing) neglect or physical or emotional harm, and as a result of such needs is unable to protect themselves from any harm or neglect, or the risk of it. Q4: DO YOU HAVE ANY CONCERNS WITH, OR FEEDBACK ON, THE PROPOSED CONDITIONS TO PROCESS SPECIAL CATEGORIES OF PERSONAL DATA FOR THE PURPOSE OF SAFEGUARDING A CHILD OR INDIVIDUAL AT RISK? Q5: DO YOU HAVE ANY CONCERNS WITH, OR FEEDBACK ON, THE PROPOSED ADDITIONAL CONDITIONS RELATING TO PROCESSING WITHOUT THE CONSENT OF THE DATA SUBJECT? Q6: DO YOU HAVE ANY CONCERNS WITH, OR FEEDBACK ON, THE PROPOSED DEFINITION OF AN INDIVIDUAL AGED 18 OR OVER AND CONSIDERED ‘AT RISK’? Q7: DO YOU HAVE ANY BROADER FEEDBACK ON THE PROPOSED AMENDMENTS THAT IS NOT COVERED BY THE QUESTIONS SET OUT ABOVE?

Consultation Paper No. 6 of 2025
Regulations
Annex A Proposed Amendment to Data Protection Regulations 2021
Appendix 1 Proposed Data Protection Regulations (Substantial Public Interest
Conditions) Rules 2025
Proposed Amendments and Enactments

---

Public Consultation Paper No. 6 of 2025
Annex A
DATA PROTECTION REGULATIONS (AMENDMENT NO. 1) 2025

Public Consultation Paper No. 6 of 2025
Annex A
DATA PROTECTION REGULATIONS (AMENDMENT NO. 1) 2025 Regulations amending the Data Protection Regulations 2021 Date of Enactment: [●] 2025 The Board of Directors of the Abu Dhabi Global Market, in exercise of its powers under Article 6(1) of Law No. 4 of 2013, as amended, concerning the Abu Dhabi Global Market issued by His Highness the Ruler of the Emirate of Abu Dhabi, hereby enacts the following Regulations:

1. Amendment to the Data Protection Regulations 2021
   The Data Protection Regulations 2021 are amended as follows:
   (1) In subsection 7(2)(k)(x), delete the “or” after the semi-colon.
   (2) In subsection 7(2)(k)(xi), replace the full stop with a semi-colon and insert the word “or” after the newly inserted semi-colon. (3) Insert a new subsection 7(2)(k)(xii) as follows:
   (xii) any other conditions as set out in Rules made by the Board.
   (4) In subsection 36(1)(c), replace the number “36” with “37”.
2. Short title, extent and commencement
   (1) These Regulations may be cited as the Data Protection Regulations (Amendment No.1) 2025. (2) These Regulations shall apply in the Abu Dhabi Global Market. (3) These Regulations come into force on the date of their publication.

---

Public Consultation Paper No. 6 of 2025
Appendix 1
DATA PROTECTION REGULATIONS (SUBSTANTIAL PUBLIC INTEREST CONDITIONS) RULES 2025 Date of Adoption: [●] 2025 The Board of Directors of the Abu Dhabi Global Market, pursuant to section 60 of the Data Protection Regulations 2021 and after taking into account the general provisions of sections 1, 2 and 3 of the Regulations, hereby makes the following rules to be implemented and enforced by the Commissioner of Data Protection of the Abu Dhabi Global Market:

1. Citation, commencement and interpretation
   (1) These Rules may be cited as the Data Protection Regulations (Substantial Public Interest Conditions) Rules 2025. (2) In these Rules, “Regulations” means the Data Protection Regulations 2021. (3) Terms used in these Rules which are defined in the Regulations shall have the meanings given to them in the Regulations. (4) These Rules come into force on the date of their publication.
2. Application
   These Rules shall apply to the Processing of Special Categories of Personal Data based on section 7(2)(k)(xii) of the Regulations.
3. Condition related to insurance
   (1) This condition is met if the Processing—
   (a) is necessary for an insurance purpose,
   (b) is of Special Categories of Personal Data, and (c) is necessary for reasons of substantial public interest, subject to subsection (2). (2) Where— (a) the Processing is not carried out for the purposes of measures or decisions with respect to the Data Subject, and (b) the Data Subject does not have and is not expected to acquire— (i) rights against, or obligations in relation to, a person who is an insured person under an insurance contract to which the insurance purpose mentioned in subsection (1)(a) relates, or (ii) other rights or obligations in connection with such a contract,

Public Consultation Paper No. 6 of 2025
Appendix 1
the Processing does not meet the condition in subsection (1) unless, in addition to meeting the requirements in that subsection, it can reasonably be carried out without the Consent of the Data Subject. (3) For the purposes of subsection (2), Processing can reasonably be carried out without the Consent of the Data Subject only where— (a) the Controller cannot reasonably be expected to obtain the Consent of the Data Subject, and (b) the Controller is not aware of the Data Subject withholding Consent. (4) In this Rule— (a) “insurance contract” means a contract of general insurance, long-term insurance, or re-insurance; (b) “insurance purpose” means— (i) advising on, arranging, underwriting or administering an insurance contract, (ii) administering a claim under an insurance contract, or (iii) exercising a right, or complying with an obligation, arising in connection with an insurance contract, including a right or obligation arising under an enactment or rule of law. (5) The reference in subsection (3)(b) to a Data Subject withholding Consent does not include a Data Subject merely failing to respond to a request for Consent.
4. Condition related to the safeguarding of children and of individuals at risk
(1) This condition is met if—
(a) the Processing is necessary for the purposes of— (i) protecting an individual from neglect or physical, mental or emotional harm, or (ii) protecting the physical, mental or emotional well-being of an individual, (b) the individual is— (i) aged under 18, or (ii) aged 18 or over and at risk, (c) the Processing is carried out without the Consent of the Data Subject for one of the reasons listed in subsection (2), and (d) the Processing is necessary for reasons of substantial public interest.

Public Consultation Paper No. 6 of 2025
Appendix 1
(2) The reasons mentioned in subsection (1)(c) are— (a) in the circumstances, Consent to the Processing cannot be given by the Data Subject; (b) in the circumstances, the Controller cannot reasonably be expected to obtain the Consent of the Data Subject to the Processing; and (c) the Processing must be carried out without the Consent of the Data Subject because obtaining the Consent of the Data Subject would prejudice the provision of the protection mentioned in subsection (1)(a). (3) For the purposes of this Rule, an individual aged 18 or over is “at risk” if the Controller has reasonable cause to suspect that the individual— (a) has needs for care and support, (b) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and (c) as a result of those needs is unable to protect himself or herself against the neglect or harm or the risk of it. (4) In subsection (1)(a), the reference to the protection of an individual or of the well￾being of an individual includes both protection relating to a particular individual and protection relating to a type of individual.