New Dubai Rules: Provision of Digital Services

Law No. (9) of 2022 ‘Regulating the Provision of Digital Services’ in the Emirate of Dubai (the “law”) was issued on 14 March 2022 and entered into force on 24 March 2022 and aims to further enhance and improve the quality of Dubai’s digital services whilst continuing to drive Dubai’s digital transformation journey. The law adds to Dubai’s digital legal landscape and will work in conjunction with recent federal UAE digital and data laws.

The law applies to Digital Services

The law applies to both digital services provided by the Dubai government and to digital services provided by non-government entities in Dubai and establishes key requirements for effective digital service delivery.

The law will be overseen by the “Competent Authority” which is defined in the law as the General Secretariat of the Executive Council, the Dubai Digital Authority (DDA), and the Dubai Electronic Security Centre (DESC). The law will cover the delivery of digital services across the spectrum of digital channels, including websites and smart applications. There is a one-year grace period to comply with the law. This grace period can be extended by the Executive Council of the Emirate of Dubai. The law talks about a potential phased roll-out of the law’s provisions. This roll-out may be further clarified in resolutions to be issued by the Competent Authority.

The key points to note are:

• The law applies throughout the Emirate of Dubai, including Dubai’s free zones (including the Dubai International Financial Centre).
• The Competent Authority will establish technical and organizational requirements for the provision of digital services and will roll-out digital services standards and controls to be followed by the digital services providers. This will include information security and business continuity requirements to manage digital services disruption.
• Detailed privacy requirements feature in the law with requirements around data retention, data classification and data security and with a focus on data accuracy and completeness. Digital service providers will need to review their privacy compliance programs to ensure that they meet the requirements of the law.
• The DDA will approve and roll out appropriate digital identification tools for the use in the provision of digital services in line with the recently issued federal UAE electronic transactions and trust services law.
• Digital services must be provided in Arabic and English as a minimum and ensure that the digital services are both broadly available and easily and equally accessible to all Dubai residents.
• Digital transactions, regardless of type, shall have the same status as transactions handled in person.
• Government entities may outsource the provision of digital services subject to having appropriate contractual protections in place.

Further resolutions and technical guides relating to the effective implementation of the law should be expected and will be issued by the Competent Authority and the DDA