Navigating Multi-Jurisdictional Personal Data Protection Regimes By VASPs And FinTechs

INTRODUCTION

With businesses increasingly driven by personal data, jurisdictions globally have enacted legislations and regulations to safeguard the interests of data subjects' resident in their respective jurisdictions. This puts the data subjects' rights at the forefront of all business considerations, along with the institution of internal policies to manage personal data. Regional and global businesses must now navigate complex compliance obligations imposed by the various data protection frameworks existing the UAE. Interestingly, businesses such as Virtual Assets ("VA") Service Providers ("VASP") and financial technology companies ("FinTech"), based in the UAE, ADGM or DIFC, have clients and operations spread across the globe, resulting in personal data collection and processing across jurisdictions. In this case, they must comply with the applicable data protection regimes of multiple jurisdictions. Particularly relevant for such businesses spread across