The law has extraterritorial reach over digital platforms and internet service providers that operate in, or target users in, the UAE.

By Brian A. Meenagh, Danielle van der Merwe, Ksenia Koroleva, and Fady Saleh

The United Arab Emirates (UAE) has enacted Federal Decree‑Law No. 26 of 2025 on Child Digital Safety (the CDS Federal Law), establishing a comprehensive framework to protect children online with extraterritorial reach over digital platforms and internet service providers that operate in, or target users in, the UAE. The CDS Federal Law took effect on January 1, 2026, and covered entities have up to one year from that date to comply, unless the Cabinet extends the deadline.

Since the CDS Federal Law delegates key operational details to administrative regulations, several elements, including platform classification and penalties, are intended to be finalized through Cabinet decisions.

For more details, see our article.

The draft law proposes a data embassy ecosystem and comprehensive framework in Saudi Arabia, promoting its position as a global AI hub.

By Brian Meenagh, Ksenia Koroleva, and Faisal Imam*

On April 14, 2025, Saudi Arabia’s Communications, Space and Technology Commission (CST) issued a consultation draft of a “Global AI Hub Law.” This draft law marks Saudi Arabia as the first G20 nation to publish a draft of a comprehensive legal framework that embraces the concept of a data embassy and provides a roadmap for investment in and development of data embassies.

This blog post sets out the key aims and provisions under the draft law, which is open for consultation until May 14, 2025.

Background: Data Embassies

Data embassies offer a relatively recent solution to a digital society problem: How can a nation-state maintain data sovereignty and apply its laws to certain categories of data when such data needs to be hosted in a foreign state? In simple terms, a data embassy is a data center in one country that is subject to the laws of another country and not to the local laws where the data center is hosted.

Estonia piloted the concept in 2017 with a bilateral agreement with Luxembourg to host critical government data there. Monaco signed a similar agreement with Luxembourg in 2021. In these instances, bilateral agreements were necessary because the Vienna Convention on Diplomatic Relations 1961 was not considered sufficient to cover the establishment of a data embassy in a stand-alone data center, as opposed to a physical diplomatic mission in a foreign state.¹

While other nation-states have explored the idea, Saudi Arabia aims to provide a full legal framework that promotes the establishment of sovereign data centers and categorizes the variations of AI hubs.

Saudi Arabia’s Draft Law

According to the consultation portal, the draft law aims to:

• enhance Saudi Arabia’s position as a global AI hub and pioneer in advanced technologies by fostering an attractive environment for foreign governments and private sector entities to develop and adopt such technologies for peaceful purposes and uses;
• maximize the benefit of Saudi Arabia’s strategic geographical location connecting three continents to offer technology solutions for global business and consumers, enhancing access to technology and bridging the digital divide sustainably; and
• facilitate the establishment of sovereign data centers that strengthen bilateral relationships with foreign states, hyperscalers, and other digital service providers by offering continuity of service, data sovereignty beyond borders, enhanced security, and future-proofed digital infrastructure.

The draft law defines three categories of “AI Hub,” which can be an entire data center or an isolated and clearly demarcated part of a data center:

• Private Hub: Operated by a “Guest Country” under a bilateral agreement with Saudi Arabia for the sole use of the Guest Country according to its laws and regulations
• Extended Hub: Operated by a third-party “Operator” under an agreement with the “Competent Authority” and an arrangement with a Guest Country according to the Guest Country’s laws and regulations
• Virtual Hub: Operated by a third-party “Service Provider” operating in Saudi Arabia and approved by the Competent Authority to offer a Virtual Hub for use by “Customers” of the Service Provider according to the laws and regulations of a “Designated Foreign State”

The Guest Countries are responsible for ensuring that relevant hubs operate in compliance with international law, adhere to technology-use restrictions, and cooperate with Saudi Arabia’s authorities to support digital infrastructure. Customer content within a Virtual Hub is subject to the jurisdiction of the competent courts of Designated Foreign Countries, but Saudi Arabia’s courts can provide necessary assistance.

Under the draft law, the Competent Authority will be authorized to enter into discussions with prospective Guest Countries, Operators, and Service Providers regarding the entry into relevant bilateral agreements to support the establishment of private hubs. The draft law does not specify the Competent Authority, which will be determined by the Council of Ministers and may be the CST or the Saudi Data and AI Authority (SDAIA).

Each category of AI Hub is subject to separate rules in the draft law, and further elaboration may be provided in future implementing regulations. The CST has clearly considered the need for distinct rules for foreign government data centers (Private Hubs) requiring digital diplomatic immunity, foreign company data centers (Extended Hubs), and data center providers in the Kingdom wishing to comply with foreign government laws while hosting data in Saudi Arabia (Virtual Data Centers).

Next Steps

The draft law is a consultation document, and the consultation exercise is open until May 14, 2025. We expect that future iterations of the draft law or implementation regulations or guidelines from the Competent Authority will clarify the distinctions between each type of hub and the process for setting them up. As a first step in establishing a data embassy ecosystem in Saudi Arabia, the draft law is both welcome and groundbreaking.

*Admitted to practice in England & Wales only

1. See more: https://luxembourg.public.lu/en/invest/innovation/e-embassies-in-luxembourg.html. ↩︎

The healthcare and life sciences ecosystem is witnessing significant growth in the Middle East as the GCC continues to seek economic diversification.

By Brian A. Meenagh, Sara Patel, and Lucy Tucker

The United Arab Emirates (UAE) and Kingdom of Saudi Arabia (KSA) are advancing initiatives to nurture a thriving life sciences ecosystem in the Middle East and North Africa (MENA). In January 2024, Saudi Arabia launched its National Biotechnology Strategy, which aims to position itself as a biotech leader in MENA by 2030 and an international biotech hub by 2040. Abu Dhabi Vision 2030 has also identified the biotechnology industry as one of the main sub-sectors to develop. In this blog post, we outline key trends including investments, licensing and collaboration, and legislative developments.

Investments, Licensing, and Collaborations

The UAE and Saudi Arabia are developing a healthcare and life sciences ecosystem in MENA and starting to focus on manufacturing, clinical trial infrastructure, and research and development (R&D). Advances in genomics and precision medicine are further opening up new opportunities for personalized medicine, while the development of targeted therapies aims to help improve patient outcomes and reduce healthcare costs.

In the last few years, regulators and investors have been building public-private partnerships with biopharmaceuticals and life sciences companies. While government initiatives are prioritizing research into diseases, increasing life span, and developing drugs, the biopharmaceutical industry has made progress with developing manufacturing capabilities.

Regional startups and multinationals are being drawn to the GCC’s favorable business environment, availability of financing options, and the potential for R&D. Initiatives include tax incentives, research grants, and the establishment of research and innovation hubs. Examples of the UAE and KSA incentivizing multinationals to operate in the region include:

UAE

• The Abu Dhabi Economic Vision 2030 and the UAE Vision 2071 include the objective of making the UAE a world-class healthcare system.
• The “UAE National Strategy for Artificial Intelligence 2031” demonstrates its commitment to innovation-driven healthcare transformation, with the UAE spearheading various initiatives to promote artificial intelligence adoption in healthcare.
• The UAE cabinet has established the Emirates Drug Corporation (EDC) in September 2023, which will replace the Ministry of Health and Prevention (MOHAP) for the regulation of pharmaceuticals and medical devices and aims to strengthen the country’s position as a global hub for pharmaceutical and medical industries.
• The UAE has launched the Emirati Genome Programme, a national strategy to map the DNA of every Emirati to provide personalized medical care for every citizen, which in the future aims to produce, design, and manufacture ground-breaking treatments on a local basis. This project utilizes large-scale genomic data to empower healthcare practitioners for personalized treatments.
• High-profile collaborations between the UAE and US in relation to hospitals and medical facilities, including technology transfer, have attracted experts and researchers to the UAE. Further, the rise of biosimilars and biologics manufacturing demonstrates the UAE’s growing capabilities in the pharmaceutical industry.

KSA

• The National Biotechnology Strategy aims to advance Saudi Arabia’s self-sufficiency in vaccines, biomanufacturing, and genomics, unlocking a high-growth sector, fostering innovation, and improving health and wellbeing. The strategy aims to provide a flexible regulatory environment and advanced infrastructure, as well as integration and collaboration between the public and private sectors.
• Saudi Arabia has also launched the National Transformation Program, which includes a range of initiatives focused on improving healthcare services, including establishing new medical cities.
• Investments in bioinformatics and digital health continue to drive the region’s healthcare agenda. KSA’s Vision 2030 framework promotes the use of artificial intelligence to facilitate innovative digital health solutions. In particular, the National Strategy for Data and Artificial Intelligence includes healthcare as a priority sector that is being implemented through local gigaprojects.

Legislative Developments

UAE

The UAE is laying the groundwork for the use of innovative digital health technologies by developing a regulatory framework for such technologies. It has issued a regulation which aims to ensure the safe and ethical use of the human genome for various purposes, such as health, research, and legal matters (while protecting the rights of individuals), as well as a comprehensive national AI strategy, in November 2023.

Guidelines and policies have been put in place to safeguard patient data privacy and address security concerns. For example, in February 2019, the UAE issued Federal Law No. 2 of 2019 (the Health Data Law) on the use of Information and Communications Technology (ICT) in health fields, which is supplemented by Implementing Regulations. The Health Data Law, which took effect in May 2019, impacts businesses in the UAE that use ICT to process health information, such as healthcare service providers, life sciences companies, cloud service providers, healthcare IT systems suppliers, and medical insurance providers. For more information on the Health Data Law, see this Latham Client Alert.

Other key federal laws include Data Protection Law No. 45 of 2021, under which health data is considered sensitive personal data and is subject to additional controls; Law No. 8 of 2019 on Medical Products, Profession of Pharmacy and Pharmaceutical Institutions; as well as other emirate and free zone laws and policies.

KSA

Regulatory bodies in KSA are collaborating to address digital healthcare trends. In addition to the regulatory framework that governs healthcare and life sciences in KSA, a new Personal Data Protection Law (PDPL) was amended and adopted in April 2023, under which health data is considered sensitive personal data and subject to additional controls. For more information on the PDPL, see this Latham blog post.

Other relevant laws include the Law of Practicing Health Professionals (Royal Decree No. M/59) and its Implementing Regulations, the Law of Private Health Institutions (Royal Decree No. M/40) and its Implementing Regulations, and Ministry of Health (MOH) Legal Regulations for Telehealth Services.

In addition, the MOH has published several policies in respect of the Saudi Health Information Exchange initiative, which is aimed at the use of health information and covers topics such as identity management, authentication, patient consent and access, breach notification, and secondary use.

Outlook

The Middle East market is transforming itself into a global player in the life sciences industry; however, it may still face legal, commercial, and operational challenges, for example, the development of the intellectual property regime, mature regulatory frameworks, and need for continued investment including in tertiary education for scientific endeavour. Opportunities include the region’s commitment to R&D, coupled with infrastructure projects, which provides a robust environment to foster innovation.

With the support of government initiatives, the growing academic and research ecosystem, and significant investments in infrastructure, the region is poised for continued growth in biotechnology, pharmaceuticals, and digital health, including through the use of emerging technologies such as artificial intelligence. Latham & Watkins will continue to monitor developments in this area.

The PDPL has broad extraterritorial scope and substantial penalties for non-compliance, with full enforcement expected to start in September.

By Brian A. Meenagh and Lucy Tucker

The Personal Data Protection Law (PDPL) is the first comprehensive data protection law in Saudi Arabia. The Saudi Data and Artificial Intelligence Authority (SDAIA) is expected to start full enforcement of the PDPL from 14 September 2024, after the current compliance transition period ends. SDAIA emphasised that it expects entities to take measures to achieve compliance with the PDPL by the September deadline.  

Scope

The PDPL has a very wide scope and applies to all entities operating in Saudi Arabia, as well as entities outside Saudi Arabia who process the personal data of individuals in Saudi Arabia (without a requirement to be targeting or monitoring the individuals). All in-scope entities will need to carry out a compliance programme before 14 September 2024.

Penalties

Non-compliance with the PDPL may result in fines of up to $1.3 million (which can be doubled for repeat offences), possible imprisonment for certain disclosures of sensitive personal data, warnings, confiscation of funds obtained as a result of the violation, and compensation claims from individuals. Non-compliance may also result in reputational damage and contractual claims.

Transfers of Personal Data Outside of the Kingdom

The PDPL contains detailed requirements for transferring personal data outside the Kingdom, which apply in addition to sector-specific data localisation requirements. The compliance steps required to transfer personal data outside of the Kingdom vary depending on the recipient jurisdiction and the nature of the personal data transferred. We are awaiting SDAIA’s issuance of a list of “adequate” jurisdictions for personal data transfers, as well as further details on alternative transfer mechanisms, such as standard contractual clauses, which may be relied on for transfers to non-adequate jurisdictions.

High-Priority Compliance Steps

The steps an entity must take to become compliant with the PDPL will depend on their existing global data protection compliance programme, and whether this programme can be extended to personal data in scope of the PDPL. For example, the PDPL uses the same concepts and principles as the EU General Data Protection Regulation (GDPR), with areas of divergence. If an entity already has a GDPR compliance programme in place, this programme could be extended to apply to data in scope of the PDPL, with amends and additions specific to Saudi Arabia.

Below is a non-exhaustive list of initial high-priority steps that entities should take, based on the status of their existing data protection compliance programme.

Limited Data Protection Compliance Programme

Entities with a limited data protection compliance programme will need to take more significant compliance steps, which may require substantial resources and more time to implement. Initial high-priority steps include:

1. Identifying suitable individuals or teams to assist with and be responsible for data protection
2. Understanding and documenting personal data processing activities, in a Record of Processing Activities, which also includes understanding the organisation’s role as a controller or processor
3. Mapping international transfers of personal data outside the Kingdom, in preparation for implementing a valid transfer mechanism, once SDAIA issues further details
4. Drafting privacy notices for relevant individuals (e.g., website visitors, customers, employees)
5. Implementing processes to recognise, action, and respond to data subject rights requests, such as the ability to search for, retrieve, update, and delete personal data
6. Identifying high risk processing activities and carrying out impact assessments, and assessing whether a Data Protection Officer is required
7. Implementing processes to detect, handle, and respond to personal data breaches, including notifying SDAIA and individuals
8. Reviewing direct marketing activities and the legal basis relied on, to ensure appropriate consents are obtained
9. Reviewing and updating agreements with data processors to ensure they include mandatory contractual requirements (and international transfer provisions, when applicable)

Mature GDPR Compliance Programme  

Entities with a GDPR programme may be able leverage existing materials and processes for compliance with the PDPL, however, these materials and processes will need to be reviewed and updated to account for areas of divergence between the GDPR and PDPL. Initial high-priority steps include:

1. Assessing the personal data that is in scope of the PDPL
2. Undertaking a gap analysis of the GDPR vs. PDPL requirements
3. Extending the GDPR programme to personal data in scope of the PDPL (subject to the gap analysis conducted), for example, extending the Record of Processing Activities to also cover in-scope PDPL data and the data subject rights processes to also include individuals in Saudi Arabia
4. Mapping international transfers of personal data outside the Kingdom, in preparation for implementing a valid transfer mechanism, once SDAIA issues further details
5. Reviewing the legal basis for processing and for disclosures of personal data, to account for divergences with the GDPR
6. Reviewing processing carried out as a joint controller, to ensure that all compliance requirements are fulfilled independently, given there is no joint controller concept under the PDPL
7. Reviewing and updating agreements with data processors (and intra-group agreements) to ensure these include mandatory contractual requirements (and international transfer provisions, when applicable), given divergences with the GDPR
8. Reviewing thresholds for conducting a Data Protection Impact Assessment (DPIA), given that DPIAs are required for all processing of sensitive personal data under the PDPL, and reviewing requirements for providing DPIAs to data processors
9. Reviewing and updating data breach response procedures, given the lower breach notification threshold under the PDPL (“potentially causes harm”)

For more information on the PDPL, and in particular international data transfer requirements, see Latham’s previous article.

Recognizing new realities in decentralization, the regulations aim to provide market players with governance flexibility within distributed ledger technology foundations.

By Stuart Davis, Brian Meenagh, Andrew Moyle, and Ksenia Koroleva

On October 2, 2023, the Board of Directors of Abu Dhabi Global Market (ADGM), a financial free zone in the United Arab Emirates (UAE), enacted the Distributed Ledger Technology Foundations Regulations 2023 (Regulations). The Regulations were published on November 1, 2023.

Latham & Watkins has advised ADGM in drafting the Regulations. The Regulations were developed following extensive benchmarking across a number of peer jurisdictions and incorporate stakeholder feedback from ADGM’s April 2023 consultation paper. The adoption of the Regulations is part of the strategy to promote ADGM as a global center for digital assets.

The Regulations recognize the suitability of common law foundation structures for projects related to digital assets, and aim to allow maximum flexibility for the sector with respect to governance.

What are DLT Foundations?

While ADGM had an existing regime for common law foundations prior to the Regulations (under the Foundation Regulations 2017), that regime was primarily intended and used for asset management projects.

The Regulations lay down key rules regarding a new type of foundation, based on distributed ledger technology (DLT). DLT foundations are defined in Section 3 as foundations established for the use, deployment, development, facilitation, or support of DLT or the issuance of tokens (as defined below).

Under Section 7, DLT foundations have legal personality and thus have their own assets distinct from those of their founders or beneficiaries (each, as defined below) and, accordingly, can sue and be sued.

Do the FSRA rules still apply?

The Regulations are not intended to replace or disapply the regime imposed with respect to digital assets by the ADGM’s Financial Services Regulatory Authority (FSRA).

For example, the Regulations:

• refer to terms defined by the FSRA (such as tokens); and
• state in Section 4 that founders must ensure that FSRA permissions are obtained if required, but that the DLT foundation itself is not allowed to conduct any activities for which the permissions are required.

How are DLT foundations to be governed?

DLT foundations:

• pursuant to Sections 11, 24, and 29, must have:
  • founders (persons establishing DLT foundations, who may, until they resign or step down, participate in managing certain activities of DLT foundations); and
  • a DLT foundation council (with a minimum of two councillors managing DLT foundations on a day-to-day basis)
• may, but do not need to, have other governing bodies, including:
  • beneficiaries, i.e., persons with rights to the assets of DLT foundations (regulated by Section 39); and
  • tokenholders, i.e., persons holding rights to tokens issued by DLT foundations (regulated by Section 40).

Are beneficiaries, tokenholders, and beneficial owners the same?

Tokenholders may or may not be beneficiaries; for example, tokenholders may not have rights to the assets of DLT foundations (and thus not be beneficiaries) but have governance rights with respect to project management.

The Regulations are accompanied by amendments to the Beneficial Ownership and Control Regulations 2023, which define persons who may be treated as beneficial owners of the DLT foundation. This concept is different from the concept of beneficiaries and means persons “controlling” the DLT foundation. This concept is important for compliance purposes because beneficial owners may be liable for the DLT foundation’s violations in certain cases (as described below).

How Is DLT governance to be documented?

The Regulations require each DLT foundation to have a charter, which, pursuant to Section 24, must include key provisions regarding DLT governance, including:

• governance and the governing bodies of the DLT foundation, rules on their appointment, and rules on removal and quorum for decision-making;
• rules for token issuance, including types and purposes of tokens and rights attached thereto; and
• provisions relating to the DLT foundation’s assets, white papers, and DLT frameworks, including frequency of audits and security audits.

If the DLT foundation issues tokens, its charter must regulate the rights and categories of relevant tokenholders, including whether the tokens are voting or non-voting and the scope of matters decided upon by the voting (delegated matters).

Delegated matters reserved for tokenholders must be distinguished from reserved matters falling within the competence of the DLT foundation council. As part of the reserved matters, Section 27 requires the councillors to make sure that the DLT foundation complies with applicable laws. In particular, councillors must exercise their veto rights on decisions of tokenholders which:

• violate applicable laws, public order, morality, or the charter;
• contradict the principles in the white paper; or
• could lead to a detrimental result caused by an attack on the DLT framework.

In certain circumstances set forth by the Regulations, councillors and other persons exercising control over DLT foundations, including beneficial owners (Relevant Persons) may be:

• held accountable for breaches by DLT foundations; and
• liable for any loss in value of the DLT foundation assets resulting from the breach.

How can a DLT foundation be registered?

Section 4 requires founders to submit a number of documents to the ADGM Registration Authority (Registrar), including:

• the charter;
• a declaration of compliance with laws;
• a statement of initial beneficial ownership; and
• if developed, a hyperlink to the white paper setting forth details of the project and DLT framework outlining details of the DLT used.

The Registrar may, pursuant to Section 7, also require founders to submit legal opinions and security audit reports with respect to the DLT charter, white paper, and DLT framework.

Under Section 19, DLT foundations must have minimum assets of US$50,000 payable in fiat currency.

An already established foundation can become a DLT foundation under the Regulations (including Sections 107-111).

What are the ongoing obligations of DLT foundations?

DLT foundations are required to:

• disclose certain information, including names of founders and councillors;
• keep adequate and fair accounting records;
• appoint auditors to review annual accounts; and
• conduct periodic security audits on data protection and security systems.

Councillors may be liable for breach of these requirements. The amount of fines depends on the type of breach and is set forth in different sections of the Regulations.

Section 120 also allows striking off DLT foundations for default.

Next steps

The Regulations mark a significant step in promoting ADGM as a global center for digital assets and provide a new option for corporate structures of digital assets projects.

They also present the world’s first purpose-built legislative framework for establishing and operating DLT foundations.

Latham & Watkins will continue to monitor developments on virtual assets in the Middle East, including the forthcoming additional rules and regulations.

The amended PDPL diverges from international privacy laws in several areas, including personal data transfers, penalties, and breach notification.

By Brian A. Meenagh and Lucy Tucker

An amended version of the Kingdom of Saudi Arabia’s Personal Data Protection Law (PDPL) was published in the Official Gazette of the Kingdom of Saudi Arabia on April 7, 2023. The amended PDPL contains the same wide extra-territorial scope as the original PDPL. It applies to any processing of personal data that takes place in the Kingdom, and applies to the processing of personal data of individuals located in the Kingdom by organizations outside of the Kingdom.

The amended PDPL contains concepts and requirements similar to those in international privacy laws, such as the GDPR, including concepts, such as personal data, controllers and processors, data processing principles, certain data subject rights, and the requirement to maintain a record of processing activities. However, the PDPL diverges from international privacy laws in several important areas, notably in relation to transfers of personal data outside of the Kingdom and penalties for non-compliance.

To learn more about the amendments, sector-specific requirements, and next steps, read the full article here.

The Dubai International Financial Centre urges companies to protect personal data when using artificial intelligence.

By Brian A. Meenagh, Ksenia Koroleva, and Lucy Tucker 

On 18 April 2023, the Dubai International Financial Centre (DIFC), a financial free zone with its own data protection laws, published a consultation paper (the Consultation Paper) regarding amendments to DIFC Data Protection Regulations (the Regulations) for a 30-day public consultation.

The Consultation Paper acknowledges that AI systems are important and useful but carry risks to personal data processing. The DIFC’s proposed approach urges all companies using AI systems to adopt and reinforce technical and organisational means to protect personal data when using AI.

The proposed amendments  (the Draft Amendments) also cover other areas, most notably the use of data in digital and communications services (DCS) which consist of electronic communications (e.g., SMS, MMS, email, in-app messaging) generally enabled through behavioural advertising (e.g., direct marketing, and the use of cookies for personalisation and analytics).

The Consultation Paper aims to collect industry feedback on the Draft Amendments to ensure that the regulatory approach is reasonable and permits flexibility in the rapidly developing area of AI.

Key Requirements Under the Draft Amendments

The Draft Amendments outline the obligations that would apply when personal data is processed for use in or to enable the learning process of “digital enablement technologies”, including AI systems and other autonomous and automated systems (AI Systems). When using AI Systems, all persons involved in data processing — e.g., controllers, joint controllers, processors, and sub-processors — shall ensure compliance with the general requirements under the Regulations (including having a legal basis for processing).

The Draft Amendments propose changes to the standard definitions of controllers (including joint controllers) and processors (including sub-processors) for the purpose of regulating personal data processing by an AI System. The new definitions focus on who receives the benefit of the processing.

• Regardless of whether a person determines the purposes and means of processing, such person is a controller if:
  • the AI System is operated for the benefit of such person; or
  • such person uses or otherwise receives the benefit of any output generated by the AI System in connection with such processing.

• Regardless of whether a person  directs processing, such person is a processor if:
  • the AI System is operated by such person;
  • the AI System is operated for the benefit of another; and
  • such person does not use or otherwise receive the benefit of any output generated by the AI System in connection with such processing.

Therefore, the key criterion for determining whether a person is a controller or a processor is based on whether such person gets the benefit of AI-generated output. Therefore, if a business allowing use of AI Systems benefits from the output, such business would be treated as a controller of the relevant personal data regardless of the level of its involvement in determining how the AI Systems function. For example, if a business allows AI Systems to schedule appointments, but is not directly involved in determining how such AI Systems process data provided by data subjects for such scheduling (e.g., means of processing), such business could still be treated as a controller of personal data provided to the AI System and bear higher responsibility for the processing. Careful choice of AI Systems is therefore important.

Controllers and processors would be subject to the following requirements if their application or website service employs AI Systems to process personal data.

Notice Regarding AI Systems: Controllers and processors would need to provide a clear and explicit notice regarding the AI Systems used, which shall:

• Alert data subjects of the use of the AI Systems and explain that the AI Systems use technology and processes that are not human-initiated or directed;

• Describe the impact of the use of the AI Systems on data subjects’ rights;

• Specify the purposes of processing, output produced by the AI Systems, and the manner in which it is produced;

• Outline the principles based on which the AI Systems are designed and developed, including any safeguards used; and

• Describe any codes and certifications with which the AI Systems are compliant.

Keeping Records and Providing Requested Information: Controllers and processors would also need to ensure that they can provide the DIFC Commissioner of Data Protection (the Commissioner) and affected third parties with the following information upon request:

• Evidence of the AI Systems’ compliance with audit and certification requirements to be established by the Commissioner;

• Evidence of any algorithms instructing the AI Systems to seek human intervention, including a risk and impact assessment of:
  • access by the AI Systems or law enforcement authorities to information; and
  • avoidance of bias;

• Register showing personal data processed within AI Systems, processing activities, and use cases of the AI Systems; and

• Any other information demonstrating compliance with the Regulations.

Requirements on the Design of AI Systems

Companies would need to design AI Systems in accordance with the following principles:

• Fairness (treatment of individuals must be equal and fair)

• Ethics (algorithmic decisions and associated data lineage must be unbiased)

• Transparency (processing must be explainable to data subjects in non-technical terms)

• Security (personal data must be kept confidential and data breaches must be avoided)

• Accountability (internal mechanisms must ensure responsibility and accountability for outcomes, including internal governance, periodic audits, etc.).

Digital and Communications Services

The Draft Amendments also propose detailed rules on processing of personal data in DCSs. Controllers would need to comply with several conditions including the following:

• Notifying data subjects that personal data may be used for enabling DCSs during personal data collection, providing data subjects with an opportunity to refuse/opt out of receiving DCS, and applying privacy-focused default settings;

• When relying on consent for processing personal data in the context of DCSs, ensuring that consent is provided by way of a clear affirmative act that shows an unambiguous indication of freely given consent (e.g., via unticked pop-up windows):
  • Any method of obtaining consent should be accompanied by links to privacy policies, notices, or other information clarifying the processing and its purposes;
  • Pre-ticked selection boxes, silence, or inactivity are not acceptable forms of consent for the purposes of DCSs; and
  • Data subjects must be provided with an opportunity to refuse or opt out of receiving DCSs.

• Abiding by default privacy preferences which shall neither promote nor discourage any particular setting selection, explain consequences of specific choices, and allow to easily alter choices.

Next Steps

The Regulations only apply to the processing of personal data by controllers and processors incorporated in DIFC, and to any personal data processing which takes place in the DIFC (regardless of the place of incorporation).

However, the Draft Amendments represent a significant step in the regulation of AI in the UAE, Middle East, and arguably globally. The proposed amendments are in draft form and subject to further review,  but DIFC has become one of the first regulators in the Middle East to propose a detailed set of rules regarding processing of personal data when using AI.

Latham & Watkins will continue to monitor developments related to regulation of AI in the Middle East, including the forthcoming additional rules and regulations.

The Middle East’s rapidly advancing space sector has seen a slew of landmark achievements in the last few years.

By Alexander Hendry

In 2014, the UAE established the UAE Space Agency to oversee and grow its space sector, and it has since successfully completed numerous projects. In July 2020, it became the fifth country in the world to launch a probe to Mars, and in December 2022, the UAE-built Rashid Rover was launched on a path to the moon. Emirati astronaut Hazza Al Mansouri was the first person from the UAE in space, and Emirati astronaut Sultan Al Neyadi will soon embark on a six-month mission to the International Space Station. The Mohammed bin Rashid Space Centre has launched four satellites, and UAE-based satellite company Yahsat currently manages a fleet of five satellites and provides services in more than 150 countries. In 2022, the UAE established an US$817 million fund to support its space sector, including the development of a constellation of advanced radar imaging satellites.

Saudi Arabia is also focused on growing its space industry. In 2020, the Kingdom announced that it will invest US$2.1 billion into its space program. In 2022, it renamed the Communications and Information Technology Commission (CITC) as the Communications, Space and Technology Commission (CST) and established the Supreme Space Council, headed by the Crown Prince and Prime Minister. The CST and the Supreme Space Council work with the Saudi Space Commission, established in 2018, to oversee and regulate the Kingdom’s space sector. Saudi Arabia has also established initiatives like the CST’s space entrepreneurship alliance and the Saudi Space Accelerator Program to foster collaboration between private and public entities and promote innovation. During the second quarter of 2023, Saudi Arabia will send two astronauts, including its first female astronaut, to the International Space Station, in collaboration with Axiom Space. Arabsat, a satellite company founded and jointly owned by a coalition of Arab states, is headquartered in Riyadh, and operates a fleet of seven satellites, providing services across the Middle East and North Africa.

Other Middle East nations are also pursuing space-related ambitions. Kuwait launched its first satellite in January 2023, with plans already underway to design and launch a second one. Oman has announced plans to build a spaceport, its first foray into the space and satellite sector. Israel has a long-established space program, and is one of only seven countries in the world that independently builds and launches its own satellites.

As the industry develops, so does the legal landscape of international treaties and national laws and regulations. Middle East countries have a long-standing history of engaging with international space treaties. Most are party to the multilateral Outer Space Treaty 1967, which forms the basis of international space law. Many have also signed or ratified other major space agreements and treaties, including the Rescue Agreement of 1968, the Space Liability Convention of 1972, the Registration Convention of 1975, and the Moon Treaty of 1979. In addition, the UAE and Saudi Arabia have joined NASA’s Artemis Accords, a legal framework that establishes principles to facilitate the peaceful and safe exploration of space.

National regimes have been evolving as well. The UAE has issued a Space Law to stimulate investment in the space sector; implement safety, security, and environmental measures relating to space activities; and support the UAE’s commitment to international conventions and treaties related to outer space. Egypt has passed a law establishing the Egyptian Space Agency to develop and transfer space technologies into Egypt and to build and launch satellites from Egypt. Saudi Arabia is reviewing a draft space law to support the development of its space sector, accelerate scientific research in space, and encourage investment in space projects. And Bahrain’s National Space Science Agency is in the process of drafting a national space law.

The Middle East’s space sector will likely continue to experience accelerating growth, driven by increasing focus and funding from regional governments, continuing international cooperation, and the rapidly expanding private sector. The space industry is now global, and the Middle East looks set to be a major participant.

This post was prepared with the assistance of Clarence Cheong.

The new regime specifies licensing and reporting requirements for a range of activities related to virtual assets in the Emirate of Dubai.

By Brian A. Meenagh, Matthew Rodwell, and Ksenia Koroleva

On February 7, 2023, the Dubai Virtual Assets Regulation Authority (VARA) adopted the Virtual Assets and Related Activities Regulations 2023 (the Regulations) together with four compulsory and seven activity-specific rulebooks.

VARA adopted these Regulations further to Dubai Law No. 4 of March 11, 2022 on the Regulation of Virtual Assets in the Emirate of Dubai (the Law) (for more information, see Latham’s blog post).

The Law granted VARA powers to regulate activities relating to virtual assets in the Emirate of Dubai (excluding the Dubai International Financial Center (DIFC); DIFC has its own regime regulating virtual assets — see Latham’s blog post).

The Law laid down key definitions (such as the definitions of virtual assets (VAs) and distributed ledger technology (DLT)), and provided a broad list of activities requiring a license. The Law entitled VARA to adopt regulations for all relevant activities and VAs.

In Which Territory Do the Regulations Apply?

The territorial scope encompasses all VAs and VA Activities (defined below) in Dubai, including all special development zones and free zones other than the DIFC. Part III of the Regulations generally prohibits any entity operating or promoting any VA Activity by way of business in Dubai unless VARA has authorised or licensed the VA Activity, there is an exemption covering a specific VA Activity or the entity holds Exempt Entity status (see below).

VARA retains sole and absolute discretion to determine whether an entity carries out a VA Activity by way of business in Dubai (whose assessment takes into account, inter alia, relevant operations’ regularity, scale, and continuity). Even in circumstances in which VARA deems a VASP to not be carrying out VA Activities by way of business in Dubai (which may be the case with an offshore provider of VA Activities), any marketing by such offshore providers of VA Activities to residents of Dubai would nevertheless need to comply with VARA’s Marketing Regulations. The Regulations require such offshore providers to obtain VARA’s approval prior to marketing and to demonstrate that they hold all licenses to provide the relevant VA Activity in their home jurisdiction.

Which VA Activities Require VARA Licenses?

VARA specified the following activities as licensable (the VA Activities) under the Regulations:

• Advisory services: offering, providing, or agreeing to provide personal recommendations to clients, upon their request or on the relevant entity’s initiative, in respect of actions or transactions with VAs;
• Broker-dealer services: arranging orders for sale and purchase of VAs between entities, soliciting or accepting orders for Vas and accepting fiat currency or VAs for such orders, facilitating the matching of transactions in VAs between buyers and sellers, entering into VA transactions as dealers, making a market in VAs using client assets, and providing issuance-related services to clients issuing VAs;
• Custody services: VAs’ safekeeping for or on behalf of another entity acting on instructions of such other entity;
• Exchange services: conducting exchange, trade, or conversion between VAs or VAs and fiat currency, matching relevant orders between buyers and sellers, and maintaining an order book;
• Lending and borrowing services: carrying out a contract under which a party (parties) shall transfer a VA or lend it to another party (parties) and such other party shall commit to return the VA;
• Payment and remittances services: receiving VAs for transmission/transfer from one party to another party or another wallet, address, or location; and
• VA management and investment services: acting on behalf of a party as agent, fiduciary, or otherwise taking responsibility for management, administration, or disposal of a party’s VAs.

The Regulations determine the amount of license application fees (up to AED100,000), license extension fees (50% of the application fee), and annual supervision fees (up to AED200,000) depending on the type of VA Activities for which licenses are issued. Fees apply to each licensed VA Activity, and VARA may impose further fees at its discretion.

VARA acknowledges that licensees (Virtual Asset Service Providers, or VASPs) may conduct VA Activities in a jurisdiction outside of Dubai subject to applicable rules in such jurisdiction.

What Discretion Does VARA Have When Issuing Licenses?

VARA holds considerable discretion when issuing licenses and can, inter alia, limit the license by time or determine the scope of specific licensed VA Activities (including by reducing or broadening the scope set forth in a VASP’s licensing application).

Furthermore, VARA holds absolute discretion to vary licenses after their issuance (including in terms of scope) and may revoke or suspend the license, in full or in part, on a number of grounds, including material violations of applicable law or insolvency.

What Are Exempt Entities and Which VA Activities Are Exempt?

The Regulations contain certain exemptions from the licensing requirement:

• UAE government entities and their public, non-profit, not-for-profit and charitable organizations are Exempt Entities and do not need to obtain licenses (such entities shall notify VARA of their activities and obtain non-objection confirmations); and
• certain specific VA Activities are exempt, such as provision, by way of advisory services, of legal, accounting, and other professional advice wholly incidental to professional practice subject to certain conditions (including the exempted person being duly licensed in Dubai).

Who Else Needs to Register With VARA?

The Regulations further mandate registration with VARA of entities investing own portfolios in VAs for an amount over US$250 million during any rolling 30-day-period. They allow certain other market participants to register, such as entities investing own portfolios in VAs below US$250 million and providers of technology services to or utilizing DLT.

Which Offenses Can VARA Take Enforcement Action Against?

VASPs may receive punishment for a number of market offenses affecting a VA’s price (Market Offenses), including:

• Insider dealing by using inside information (not publicly available information which would affect reasonable investor decision to acquire VAs or not) to carry out, cancel, amend, recommend, counsel, procure, or facilitate a transaction with VAs, or by recommending or attempting such behavior;
• Unlawful disclosure by engaging or attempting disclosure of inside information to third parties outside of normal exercise of duties; and
• Market manipulation by entering into transactions or placing orders giving false or misleading signals regarding supply, demand, or price of specific VAs, securing abnormal or artificial effect on pricing, transmitting false or misleading information, or input, including through media, regarding supply, demand, or price of specific VAs, benchmarks, and other fraudulent activities, including with the use of fictitious devices.

VARA may classify other behavior as a Market Offense and set out accepted practices which should not qualify as Market Offenses.

To prevent Market Offenses, VASPs need to comply with requirements on reporting, record keeping, and adequate and effective internal arrangements and procedures limiting access to insider information. The Regulations also require VASPs to submit detailed reports to the United Arab Emirates Financial Intelligence Unit (FIU) and VARA regarding any reasonable suspicious in terms of conduct of Market Offenses.

How Do the Regulations Interplay With the UAE Central Bank Rules Regarding Virtual Assets?

VARA confirms that certain types of VAs may fall under the Central Bank of the United Arab Emirates’ jurisdiction (the CBUAE), in particular activities relating to Central Bank Digital Currencies (CBDC), and that VASPs will need to comply with any applicable CBUAE regulations on VAs as well as UAE federal anti-money laundering rules and regulations (the Federal AML Rules).

What Fines and Penalties May VARA Impose?

VARA may impose various penalties on any entity violating the Regulations, including on violations of any Federal AML Rules and the Law.

Enforcement actions require consideration of several factors, including the violation’s nature, seriousness, and impact, and can include:

• written reprimands;
• enforcement notices requiring rectification of violations;
• suspension, revocation, or amendment of scope of licenses issued;
• requests to suspend or cease specific activities;
• fines and civil penalties;
• additional supervision; and
• any other enforcement actions VARA determines.

The Regulations specify fines for certain Rulebook violations such as disgorgement of gained profits or avoided losses, up to AED20 million for individuals, up to AED50 million or 15% of annual revenue of VASPs, or 300% of gained profits or avoided losses.

The Regulations prohibit entities to issue anonymity-enhanced cryptocurrencies in Dubai and allow VARA to prohibit any other VA or type of VA in Dubai.

Next Steps

The new regime represents a significant step in the regulation of VA Activities in the region (and arguably globally).

Latham & Watkins will continue to monitor developments related to virtual assets in the Middle East, including the forthcoming additional rules and regulations.

The regime introduces rules on various crypto tokens, including cryptocurrencies and stablecoins, in the Dubai International Financial Centre.

By Brian A. Meenagh, Matthew Rodwell, and Ksenia Koroleva

On November 1, 2022, the Dubai Financial Services Authority (DFSA) crypto token regulatory regime came into effect.

The rules expand upon the DFSA framework for regulating investment tokens established in 2021 (the 2021 Rules). The Dubai International Financial Centre (DIFC) regime defines a token as a cryptographically secured digital representation of value, rights, or obligations which may be issued, transferred, and stored electronically, using distributed ledger technology (DLT) or other similar technology. The 2021 Rules only regulated investment tokens, which comprised security tokens and derivative tokens (in essence, tokenized equivalents of conventional securities and derivatives, respectively) (the Investment Tokens). Pursuant to the 2021 Rules, persons carrying out certain activities with Investment Tokens (e.g., issuing, offering, holding, promoting, dealing, advising, brokering) need to obtain approval from the DFSA and comply with certain obligations.

On March 8, 2022, the DFSA published its Consultation Paper 143 (the Consultation Paper), setting forth regulatory proposals for other types of tokens, in particular cryptocurrencies, payment tokens, and hybrid utility tokens (e.g., which provide additional rights to token-holders, such as discounts).

The Consultation Paper invited the market to provide comments on the anticipated regime by May 6, 2022 and, on October 18, 2022, issued a feedback statement regarding the comments received (the Statement). The Statement did not anticipate major amendments to the proposals outlined in the Consultation Paper.

Key Definitions in the DFSA Regime

A Crypto Token is a token if it: (a) is used, or is intended to be used, as a medium of exchange or for payment of investment purposes; or (b) confers a right or interest in another token that meets the requirements in clause (a) above.

The regime defines a Fiat Crypto Token (e.g., stablecoin) as a type of a Crypto Token in which price and volatility are determined, in whole or in part, by reference to a fiat currency or a combination of fiat currencies.

A token is not a Crypto Token (and falls outside of the scope of the new regime) if it is (i) an Investment Token (or any other type of investment) or (ii) an Excluded Token. The former type of token is regulated by the 2021 Rules.

Excluded Tokens

• Non-Fungible Tokens (NFTs) are tokens which are unique and not fungible. They relate to identified assets and prove ownership or provenance of such assets. In the DFSA’s view, no financial services are provided via NFTs and therefore these tokens should be outside of the scope of the new rules.
• Utility Tokens are tokens which can be used by the holder only to pay for, receive a discount on, or access a product or service provided by the issuer or an entity from its group. The DFSA suggested that it will continue monitoring developments around these tokens to determine whether they should be regulated.
• CBDC refers to digital currency issued by any government, government agency, central bank, or other monetary authority. The DFSA considered those tokens to be similar to fiat currencies.

Excluded Tokens generally fall outside the scope of the new regime. However, the DFSA noted that some issuers and service providers of NFTs or Utility Tokens must be registered as Designated Non-Financial Businesses and Professions (DNFBP) in order to comply with the anti-money laundering rules, and submit suspicious transaction reports to the UAE authorities.

Prohibited Tokens

• Algorithmic Tokens are Crypto Tokens using an algorithm of increase or decrease in the supply of Crypto Tokens to stabilize the price or reduce its volatility.
• Privacy Tokens are Crypto Tokens which are intended to allow the holder to hide, anonymize, obscure, or prevent the tracing of:
  • cryptographic keys;
  • underlying transactions;
  • transaction value;
  • parties’ identity;
  • holders; or
  • beneficial owners.

Prohibited Tokens cannot be used in the DIFC. The DFSA banned them due to a lack of transparency in respect of the algorithms employed by and transactions conducted with the use of such tokens.

Regulated Activities Within the Regime

Persons need authorization from the DFSA to engage in dealing (as principal or agent), arrangement, management, advising, trading, clearing, providing custody services, and conducting certain other activities in respect of Crypto Tokens (the Authorized Persons). Some activities are expressly prohibited:

• An Authorized Person is not allowed to carry on any activity related to a Utility Token or an NFT (to separate activities with respect to regulated and non-regulated tokens).
• Use of Crypto Tokens by money service providers is generally not allowed, except when these tokens are Fiat Crypto Tokens used only for the purpose of money transmission or executing a payment transaction, and provided that these tokens are in the name of the money service provider (not its client).
• Crowdfunding operators are not allowed to operate platforms facilitating investments in Crypto Tokens. It is also prohibited to organize trading facilities related to Crypto Tokens.

Authorized Persons need to comply with a number of requirements, depending on the exact scope of their activities. These requirements may include obligations in respect of reporting, disclosures, ensuring information security, or setting forth certain mandatory conditions in client agreements.

Recognition of Crypto Tokens

Regulated activities cannot take place in the DIFC with Crypto Tokens, unless the DFSA recognizes the tokens (Recognized Crypto Tokens).

Token recognition by the DFSA is based on a number of criteria (which the DFSA assesses cumulatively), including regulatory status in other jurisdictions, adequacy of transparency and technology used, mitigation of risks and size, as well as liquidity and volatility of the market.

The DFSA determined the initial list of Recognized Crypto Tokens, namely recognized Bitcoin (BTC), Ethereum (ETH), and Litecoin (LTC). An Authorized Person, an applicant for the relevant DFSA approval, or an issuer or developer of the Crypto Token may file an application with the DFSA for recognition of specific Crypto Tokens.

The DFSA may revoke the Recognized Crypto Token status if the relevant Crypto Token becomes unsuitable for use in the DIFC. Authorized Persons need to notify the DFSA of significant events or developments which reasonably suggest that the Crypto Token no longer meets the criteria.

Summary

The new regime represents a step forward by the DFSA in regulating tokens in the DIFC-free zone. It aims to establish the DIFC as a hub for virtual asset service providers (VASPs), similar to the Abu Dhabi Global Market (ADGM) (which, since its introduction in 2018, has operated its own regulatory framework for virtual assets) and the recently established Dubai Virtual Asset Regulatory Authority (DVARA), which regulates the activities of VASPs in the Emirate of Dubai outside of the geographic area of the DIFC.

The regulatory approach taken is generally in line with that of the ADGM and the approach taken at the federal UAE and Emirati levels. (Read this Latham blog post for more information.)

Questions remain around what other steps the DFSA will take in regulating the crypto industry and how the DIFC regime will interplay with rules enacted outside of the DIFC at an individual Emirati and federal level. The DFSA announcements set expectations for further consultation on Crypto Tokens, which will focus, inter alia, on decentralized finance (DeFi).

Latham & Watkins will continue to monitor developments related to virtual assets in the Middle East, including the forthcoming additional rules and regulations.