# UAE PDP Law Compliance Assessment Record

## Organisation Details

| Field | Value |
|-------|-------|
| **Organisation Name** | [Legal entity name] |
| **Trade License Number** | [License number] |
| **Jurisdiction** | [Mainland / DIFC / ADGM / Other free zone] |
| **Data Protection Officer** | [Name, contact details] |
| **Assessment Date** | [YYYY-MM-DD] |
| **Assessor** | [Name, Title] |

## Applicability Determination

| Factor | Assessment |
|--------|-----------|
| **Established in UAE?** | [Yes / No] |
| **Offering goods/services to UAE data subjects?** | [Yes / No] |
| **Monitoring UAE data subject behaviour?** | [Yes / No] |
| **UAE PDP Law applicable?** | [Yes / No] |
| **DIFC Law applicable?** | [Yes / No / N/A] |
| **ADGM Regulations applicable?** | [Yes / No / N/A] |
| **Exemptions applicable?** | [None / Government / Health / Banking / Personal / Media] |

## Legal Basis Mapping (Article 5)

| Processing Activity | Data Categories | Data Subjects | Legal Basis | Documented? |
|--------------------|-----------------|---------------|-------------|-------------|
| [Activity 1] | [Categories] | [Subjects] | [Article 5 reference] | [Yes / No] |
| [Activity 2] | [Categories] | [Subjects] | [Article 5 reference] | [Yes / No] |

## Sensitive Personal Data (Article 7)

| Category | Processed? | Legal Basis | Safeguards |
|----------|-----------|-------------|------------|
| Racial or ethnic origin | [Yes / No] | [Basis] | [Description] |
| Political opinions | [Yes / No] | [Basis] | [Description] |
| Religious beliefs | [Yes / No] | [Basis] | [Description] |
| Criminal records | [Yes / No] | [Basis] | [Description] |
| Biometric data | [Yes / No] | [Basis] | [Description] |
| Health data | [Yes / No] | [Basis] | [Description] |
| Genetic data | [Yes / No] | [Basis] | [Description] |

## Data Subject Rights (Articles 13-18)

| Right | Implemented? | Mechanism | Response Timeline |
|-------|-------------|-----------|-------------------|
| Right to be informed (Art. 13) | [Yes / No] | [Description] | [Days] |
| Right of access (Art. 14) | [Yes / No] | [Description] | [Days] |
| Right to rectification (Art. 15) | [Yes / No] | [Description] | [Days] |
| Right to erasure (Art. 15) | [Yes / No] | [Description] | [Days] |
| Right to restrict processing (Art. 16) | [Yes / No] | [Description] | [Days] |
| Right to data portability (Art. 17) | [Yes / No] | [Description] | [Days] |
| Right to object (Art. 17) | [Yes / No] | [Description] | [Days] |
| Automated decision-making (Art. 18) | [Yes / No] | [Description] | [Days] |

## Technical and Organisational Measures (Article 11)

| Measure | Implemented? | Evidence |
|---------|-------------|----------|
| Encryption at rest | [Yes / No] | [Reference] |
| Encryption in transit | [Yes / No] | [Reference] |
| Access controls | [Yes / No] | [Reference] |
| Logging and monitoring | [Yes / No] | [Reference] |
| Incident detection | [Yes / No] | [Reference] |
| Regular security testing | [Yes / No] | [Reference] |
| Staff training | [Yes / No] | [Last date] |
| Data protection policies | [Yes / No] | [Reference] |

## Data Protection Impact Assessments (Article 9)

| Processing Activity | DPIA Required? | DPIA Conducted? | Date | Outcome |
|--------------------|---------------|----------------|------|---------|
| [Activity] | [Yes / No] | [Yes / No] | [YYYY-MM-DD] | [Approved / Mitigations required] |

## Cross-Border Transfers (Article 22)

| Recipient | Country | Transfer Mechanism | Adequacy Status | Agreement Ref |
|-----------|---------|-------------------|----------------|---------------|
| [Recipient] | [Country] | [Adequacy / SCC / BCR / Consent / Derogation] | [Adequate / Safeguards in place] | [Reference] |

## Processor Agreements

| Processor | Service | Agreement Date | Article 20 Compliant? | Audit Date |
|-----------|---------|---------------|----------------------|------------|
| [Processor] | [Service] | [YYYY-MM-DD] | [Yes / No / Partial] | [YYYY-MM-DD] |

## Breach Notification Readiness

| Element | Status | Notes |
|---------|--------|-------|
| Breach detection capability | [In place / Partial / Not in place] | [Details] |
| UAE Data Office notification procedure | [Documented / Not documented] | [Details] |
| Data subject notification template | [Prepared / Not prepared] | [Details] |
| Breach response tested | [Yes / No] | [Last test date] |

## Remediation Plan

| Gap | Priority | Action Required | Owner | Target Date | Status |
|-----|----------|----------------|-------|-------------|--------|
| [Gap 1] | [Critical / High / Medium / Low] | [Action] | [Name] | [YYYY-MM-DD] | [Open / In progress / Closed] |

## Sign-Off

| Role | Name | Signature | Date |
|------|------|-----------|------|
| Data Protection Officer | [Name] | __________ | [YYYY-MM-DD] |
| Assessor | [Name] | __________ | [YYYY-MM-DD] |
| Senior Management | [Name] | __________ | [YYYY-MM-DD] |

---

*This assessment is conducted under Federal Decree-Law No. 45 of 2021 and its Executive Regulations (Cabinet Decision No. 111 of 2023).*