We handle PDPL as part of the deal it sits inside, rather than as a privacy workstream running next to it.
The work usually surfaces inside the underlying commercial transaction: a vendor DPA, a healthcare service agreement, an employment contract, a platform integration. Recent matters include adapting a multinational employment contract for PDPL and MoHRE compliance, with a confirmation memo on cross-border transfer requirements; negotiating a tripartite collaboration agreement between a multinational laboratory group, our client and a UAE health authority, including the full data privacy schedule; and advising on a mobile phlebotomy service agreement with a leading UAE healthcare provider, including the data protection agreement governing home blood sample collection UAE-wide.
We have also advised on cross-border transfers for laboratory testing services (Gene by Gene), UAE-side handling of HIPAA-adjacent data, vendor-side DPA negotiation for WHOOP and Unilabs, and CBUAE data protection queries. By the time a PDPL question reaches us, it is usually already sitting in a signed contract.
“Most of these questions start life as a clause in a commercial agreement.”
For multinationals, the job is reconciling a global GDPR-style programme with what the PDPL actually requires: privacy notices, DPIAs, processor and sub-processor chains, and cross-border transfer mechanisms.