ADGM implements new significant Public Interest Under Data Protection Regulations Rules 2025

On 9 September 2025, the Registration Authority of the Abu Dhabi Global Market (ADGM) amended the existing Data Protection Regulations 2021 and introduced the newly enacted Data Protection Regulations (Substantial Public Interest Conditions) Rules 2025 (Rules).

These Rules were introduced following Consultation Paper No.6 of 2025 in June 2025 which highlighted two gaps under the substantial public interest grounds related to insurance and reinsurance activities, and the safeguarding of children’s wellbeing.  

Key Developments 

1. Clarity on when and how Special Categories of Personal Data can be processed under public interest grounds - particularly in the insurance and education sector. 

• This states that the condition related to insurance is met if the processing is necessary for an insurance purpose, is of Special Categories of Personal Data and is necessary for reasons of substantial public interest. 
• In respect of the latter i.e. substantial public interest, the processing is not carried out for the purposes of measures or decisions with respect to the data subject, and the data subject does not have and is not expected to acquire (i) rights against, or obligations in relation to, a person who is an insured person under an insurance contract to which the insurance purpose (above) relates, or (ii) other rights or obligations in connection with such a contract.
• Note that processing will not meet this condition (in addition to meeting the other requirements as set out above), if the controller cannot reasonably be expected to obtain the consent of the data subject; and the controller is not aware of the data subject withholding consent. This does not include a data subject merely failing to respond to a request for consent. 

2. Clear definitions for "insurance contract" and "insurance purposes" bringing much needed clarity and consistency to these sectors. 

• Insurance contract means a contract of general insurance, long-term insurance, or re-insurance; and
• Insurance purposes means (i) advising on, arranging, underwriting or administering an insurance contract; (ii) administering a claim under an insurance contract; or (iii) exercising a right, or complying with an obligation, arising in connection with an insurance contract, including a right or obligation arising under an enactment or rule of law.

3. Permitting the processing of Special Categories of Personal Data without consent in specific cases - especially around safeguarding children or individuals at risk. 

• This includes if the processing is necessary for the purposes of 1) protecting an individual from neglect or physical, mental or emotional harm, or 2) protecting the physical, mental or emotional well-being of an individual. 
• This is applicable where the individual is aged under 18 or aged 18 or over and at risk, and the processing is carried out without the consent of the data subject and the processing is necessary for reasons of substantial public interest. 

4. A clearer framework for assessing when individuals aged 18+ may be considered "at risk" and therefore entitled to additional protection.

• An individual aged 18 or over is “at risk” if the controller has reasonable cause to suspect that the individual has needs for care and support, is experiencing, or at risk of, neglect or physical, mental or emotional harm and as a result of those needs, is unable to protect himself or herself against the neglect or harm or the risk of it. 

Impact

These amendments represent a major advancement in balancing responsible data processing with the protection of sensitive personal information. By clearly outlining the conditions under which special categories of data may be processed, ADGM is reinforcing safeguards that serve the public interest while supporting key sectors such as insurance and education.