ADGM has issued the Data Protection Regulations (Substantial Public Interest Conditions) Rules 2025 (“Substantial Public Interest Rules”) under its existing Data Protection Regulations 2021, following Consultation Paper No. 6 of 2025. The Registration Authority published the Rules on September 9, 2025.
The Rules clarify when ADGM-licensed entities may process Special Categories of Personal Data under defined public interest grounds. The sectors most immediately affected include insurance, education, and entities that safeguard children or individuals at risk.
Under the new regime, “insurance purpose” and “insurance contract” receive formal definitions, setting standards for insurers that wish to handle sensitive data without explicit consent when servicing substantial public interest objectives. Special conditions apply to protecting minors or adults deemed at risk, including emotional or physical harm scenarios.
The Rules were designed to align ADGM’s framework with global best practices while addressing local regulatory demands. Entities processing data under these rules must satisfy safeguards in the Rules, such as restricting processing to what is necessary, establishing risk-mitigation measures, and ensuring compliance with oversight by the Commissioner of Data Protection.
Entities affected include insurance companies, educational institutions, nurseries, data controllers and processors. They will need to review their policies, obtain or revise internal compliance procedures, and assess whether their processing activities align with the new substantial public interest grounds.
The “Rules” represent a legally binding condition under Section 60 of the Data Protection Regulations 2021. Organisations that fail to comply may face regulatory consequences under ADGM’s enforcement framework.
The enactment follows public consultation ending 2 July 2025. ADGM received feedback on the proposed conditions, particularly around what qualifies as “at risk” and how to balance individuals’ rights with public interest in sectors like insurance.
With these Rules in force, ADGM aims to offer stronger protection for vulnerable individuals while allowing certain special category data uses where social or economic benefits warrant it. The development signals continued regulatory evolution in the UAE, particularly in balancing data protection with sectoral needs.
