New ADGM Data Protection Rules: Substantial Public Interest Conditions

Under the Abu Dhabi Global Market (ADGM) Data Protection Regulations, Special Categories of Personal Data include: (a) information revealing racial or ethnic origin, political opinions, or religious and philosophical beliefs; (b) genetic data, biometric data used for uniquely identifying an individual, health data, or information concerning a person’s sex life or sexual orientation; and (c) data relating to criminal convictions, offences, or associated security measures. The processing of such sensitive personal data is prohibited. However, Regulation 7(2) outlines specific exemptions that permit processing of such sensitive personal data. 

The ADGM has recently introduced the Data Protection (Substantial Public Interest Conditions) Rules 2025 to provide clear additional legal grounds for processing Special Categories of Personal Data in situations where there is a substantial public interest. These rules ensure that sensitive data can be processed responsibly, especially when obtaining consent is difficult or impossible, but the processing is necessary for the greater good.

How will these new rules help?
The rules set out specific conditions under which Special Categories of Personal Data can be processed, such as:

• For insurance purposes, where processing is necessary and in the public interest, even if consent cannot reasonably be obtained.
• For safeguarding children and individuals at risk, allowing data processing without consent when it is essential to protect someone from harm or neglect.

Who will benefit? 

• Vulnerable individuals (children and adults at risk) who need protection from harm.
• Insurance providers and policyholders who require efficient handling of claims and administration.
• Organizations that need to process sensitive data for public interest reasons, while remaining compliant with ADGM’s data protection regulations.

At Baker Tilly (UAE), we provide expert Data Protection advisory services and assist clients in navigating and complying with Data Protection regulatory requirements.