Most PDPL exposure is created not by the privacy notice but by the contract that nobody read against the privacy notice.
Our PDPL work tends to surface inside the underlying commercial transaction — a vendor DPA, a healthcare service agreement, an employment contract, a platform integration. Recent matters include adapting a multinational employment contract for UAE PDPL and MoHRE compliance with a confirmation memo on cross-border transfer requirements; negotiating a tripartite collaboration agreement among a multinational laboratory group, the firm's client, and a UAE health authority including a full data-privacy schedule; and advising on a mobile phlebotomy service agreement with a leading UAE healthcare provider including the Data Protection Agreement governing UAE-wide home blood-sample collection.
We have also advised on cross-border data flows for laboratory testing services (Gene by Gene), UAE-side handling of HIPAA-adjacent data, vendor-side DPA negotiation (WHOOP / Unilabs), and CBUAE data-protection queries.
“PDPL exposure is created not by the privacy notice but by the contract no one read against the privacy notice.”
For multinationals operating in the UAE, our work reconciles the global GDPR-style programme with PDPL realities — adapting privacy notices, DPIAs, processor and sub-processor chains, and cross-border transfer mechanisms so that the global template lands cleanly without over- or under-shooting.