Tools & Templates

Data Protection Assessment Tools

The Data Protection Assessment Tools on this page are designed to help companies of all sizes and in any sector to understand the various parts of the DP Law 2020 through easy, simple questions and answers that lead them to guidance responses for next steps. Rather than providing the answers straightaway, these assessments raise the important, key concepts to think about when determining whether an element of the DP Law 2020 should be implemented, to what degree, and what other gaps might need to be reviewed. They help DIFC companies (or any others that want to use them) mitigate risks, both to their processing operations that enable business, but also to the data subjects whose personal information forms the basis of their operations.

Please note that these assessment tools are not meant to express an opinion on lawfulness of specific business activities, the outcomes provided do not have the force of law, and they are not intended to constitute legal advice. Please contact legal counsel for assistance in determining your business's data protection and privacy requirements in respect of the topics addressed below, to ensure compliance with the applicable laws and regulations. The Commissioner does not make any warranty or assume any legal liability for the accuracy or completeness of the information herein as it may apply to the particular circumstances of an individual or a firm.

The following Assessment Tools can also be found on the Guidance page at this link.

Applicability (Article 6)

Conduct assessment

Notifications of Processing Operations (Article 14(7))

Conduct assessment

High Risk Processing (Article 16)

Conduct assessment

Data Protection Officers (Articles 16 to 19)

Conduct assessment

Data Protection Impact Assessments (Article 20)

Conduct assessment

Controller and Processor Obligations (Articles 23 to 25)

Conduct assessment

Data Export / International Transfers (Articles 26 & 27)

Conduct assessment

EDMRI+ Due Diligence Assessment (Articles 26 & 27)

Conduct assessment

Government Data Sharing (Article 28)

Conduct assessment

Privacy Notices (Articles 29 & 30)

Conduct assessment

Rights Request Responses (Article 32 to 40)

Conduct assessment

Personal Data Breach Reporting (Articles 41 & 42)

Conduct assessment

Marketing & Electronic Communications

Conduct assessment

Data Protection Templates

These templates may assist in ensuring accountability for processing activities and compliance with DP Law 2020. These templates are provided only for guidance and format purposes. Provision / content of these templates is not to be construed as legal advice.

Legal consultants or other duly designated persons acting for the entity may revise, add or remove anything in these templates as appropriate, and the entity remains responsible for its own compliance with DP Law 2020 when using them as a basis for their own purposes.

Templates can also be accessed on the Accountability page at this link.