Versions

 

51. Data protection

(1) In relation to Personal Data relating to a Data Subject, the Employer shall comply with the duties set out in subsections (2) to (8).
(2) Personal Data shall be Processed by the Employer only for the purposes of —
(a) exercising or performing any right or obligation which is conferred or imposed by law on the Employer in connection with the employment or engagement of the Data Subject;
(b) complying with any legal obligation to which the Employer is subject, other than an obligation imposed by contract;
(c) protecting the vital interests of the Data Subject; or
(d) fulfilling the legitimate commercial interests of the Employer, except where the Processing is unwarranted in any particular case by reason of the prejudice to the legitimate interests of the Data Subject.
(3) Personal Data must be adequate, relevant and not excessive in relation to the purpose or purposes for which they are Processed.
(4) The Employer shall take reasonable steps to ensure that the Personal Data are accurate and kept up-to-date (having regard to the purpose or purposes for which they are Processed).
(5) Personal Data must not be kept for longer than is necessary by the Employer (having regard to the purpose or purposes for which they are Processed).
(6) The Employer shall take appropriate technical and organisational measures against unauthorised or unlawful Processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data.
(7) An Employer shall be permitted to transfer Personal Data outside of the Abu Dhabi Global Market only where —
(a) such transfer is necessary to comply with any legal obligation to which the Employer is subject, other than an obligation imposed by contract;
(b) such transfer enables the Employer to manage the employment or engagement of the Data Subject (and, in such circumstances, the Employer shall take reasonable steps to ensure that it remains able to fulfil its obligations under subsections (2) to (8));
(c) such transfer is to fulfill the legitimate commercial interests of the Employer, except where the transfer is unwarranted in any particular case by reason of the prejudice to the legitimate interests of the Data Subject; or
(d) the Data Subject has given his written consent to such transfer (and for these purposes consent given in a written contract of employment or other written contract between the Data Subject and the Employer shall be valid consent).
(8) A Data Subject is entitled, by giving to the Employer a minimum of 20 business days' prior written notice, to be provided with access to the Employer's records containing the Personal Data of the Data Subject which are used by the Employer in connection with the employment or engagement of the Data Subject. A Data Subject may only use this access for the purpose of notifying the Employer of any inaccuracy in the Personal Data.
(9) An Employer shall be entitled to exclude from the records provided under subsection (8) any information that is the Personal Data of another Data Subject, subject to a duty of confidentiality owed to a third party or is specified by rules made by the Board from time to time to be excluded from such duty.