ADGM Introduces New Substantial Public Interest Rules under Data Protection Regulations 2021

The Riffle

The Abu Dhabi Global Market (ADGM) has introduced the Data Protection Regulations (Substantial Public Interest Conditions) Rules 2025, effective September 9, 2025. These rules amend the existing Data Protection Regulations 2021, with the aim of enhancing safeguards for processing Special Categories of Personal Data under well-defined public interest grounds .

The reforms are aligned with global best practices and are particularly significant for sectors such as insurance and education, where sensitive personal data is processed extensively. Importantly, the rules prioritize the protection of vulnerable individuals, including children and those at risk of harm, while enabling responsible data use across 

Why These Rules Matter

According to H.E. Rashed Al Blooshi, CEO of the Registration Authority at ADGM, the framework is “built on the principles of accountability, transparency, and public trust.” It seeks to strike a balance between facilitating innovation and protecting the most vulnerable in society.

The Substantial Public Interest Rules provide clarity on:

• When and how sensitive personal data can be processed without consent

• What safeguards must be in place

• Which sectors and scenarios the rules apply to most directly

Key Highlights

1. Insurance Sector

Under Rule 3, insurance firms are now permitted to process Special Categories of Personal Data if:

• It is necessary for an insurance purpose (e.g., underwriting, claims management, or contract administration).

It is justified on grounds of substantial public interest.

Consent is not always required, particularly when it is unreasonable to expect it or where the data subject has not explicitly withheld consent. This ensures insurance operations remain functional without compromising safeguards.

2. Safeguarding Children and At-Risk Individuals

Rule 4 provides conditions for processing sensitive data without consent if it is necessary to:

• Protect a child (under 18) from harm or neglect.

Safeguard an adult (18+) who is “at risk” due to care needs, neglect, or inability to protect themselves.

This reflects a proactive approach to child protection and welfare, ensuring data protection rules support—not hinder—efforts to safeguard vulnerable individuals.

3. Implementation and Safeguards

• The rules followed Consultation Paper No. 6 of 2025 and came into force immediately upon publication.

• They require robust safeguards to prevent misuse of personal data while allowing exceptions in legitimate cases.

• ADGM has reaffirmed its commitment to ensuring regulations evolve with global standards and local societal needs.

What This Means for ADGM

These changes signal a significant step forward in ADGM’s data protection journey. By clearly defining conditions under which sensitive personal data can be processed for public interest, ADGM strengthens its position as a global financial centre that values responsibility, transparency, and trust.

For firms operating within ADGM—especially in insurance, education, and sectors dealing with vulnerable populations—these rules offer both clarity and accountability, ensuring compliance while enabling efficient service delivery.

Takeaway for Businesses

Review your data handling practices, particularly around sensitive information, to ensure compliance with the new Substantial Public Interest Rules. Prioritize governance, transparency, and safeguards when processing data for insurance purposes or in protecting vulnerable individuals.

Read the full briefing document presented by 10 Leaves here -