ADGM Data Protection Rules 2025

The Riffle

On September 9, 2025, the Abu Dhabi Global Market (ADGM) published key updates to its data protection framework. These changes, enacted by the ADGM Board of Directors on August 22, 2025, establish new legal grounds for processing Special Categories of Personal Data when required for reasons of substantial public interest.

The Legal Framework

The reforms are built on two interconnected legal instruments:

1. Data Protection Regulations (Amendment No. 1) 2025

   • Amends the 2021 Regulations to grant the Board the power to establish new rules for processing sensitive data.

   • Inserts a new subsection, 7(2)(k)(xii), enabling the creation of conditions for substantial public interest processing.

   • Corrects minor grammatical and typographical issues in existing provisions.

2. Data Protection Regulations (Substantial Public Interest Conditions) Rules 2025

• The first set of rules issued under the new authority.

• Define specific conditions where sensitive data can be processed without explicit consent.

• Enforced by the ADGM Commissioner of Data Protection 

New Conditions for Processing Sensitive Data

The 2025 Rules provide clarity on when organisations can process Special Categories of Personal Data without consent:

1. Insurance Purposes

Processing is permitted if it meets a three-part test:

• Necessary for an insurance purpose.

• Involves special category personal data.

• Justified by substantial public interest.

Insurance purposes include: advising on, underwriting, or administering an insurance contract, as well as handling claims or obligations under such contracts.

Additional safeguard: If the data subject is not a party to the insurance contract, processing is only allowed when consent cannot reasonably be obtained, and there is no knowledge of the individual withholding consent. Silence from a data subject does not equal refusal .

2. Safeguarding of Children and At-Risk Adults

Processing is allowed when necessary to protect physical, mental, or emotional well-being from neglect or harm, specifically covering:

• Children under 18.

• At-risk adults who need care and support, face harm, and cannot protect themselves due to those needs.

Processing without consent is permitted if:

• The individual cannot provide consent.

• It is unreasonable to expect consent to be obtained.

• Seeking consent would prejudice the protection required.

This protection extends to both individual safeguarding and broader categories of individuals 

Implications for Businesses and Controllers

• Legal Certainty: Organisations now have clearer grounds for handling sensitive data in defined public interest cases.

• Enhanced Accountability: Strict criteria ensure that such processing is narrowly tailored and justified.

• Focus on Vulnerable Groups: Children and at-risk adults are explicitly protected under the rules.

• Sector-Specific Relevance: Insurance companies, healthcare providers, and social protection services are directly impacted.

   

Conclusion

The ADGM Data Protection Rules 2025 mark a significant step in balancing individual privacy rights with wider societal needs. By codifying when sensitive personal data may be processed in the public interest, the framework enhances trust, transparency, and regulatory clarity in ADGM’s data protection regime.

Read the full briefing document presented by 10 Leaves here -