Comparison of Data Protection Laws in UAE and UK

This research proposal aims to compare the data protection laws in the United Arab Emirates (UAE) and the United Kingdom (UK) to determine their effectiveness in addressing the security of personal data.

Research Proposal 1
RESEARCH PROPOSAL
by
Student
Name
Course
Professor
Institution
Date

Research Proposal 2
Research Proposal
Table of Contents
Proposed Title..................................................................................................................................3
Introduction/Overview.....................................................................................................................3
The Rationale of the Study...........................................................................................................4
Aim of the Study..........................................................................................................................5
Objectives of the Study................................................................................................................5
Literature Review............................................................................................................................5
SWOT Analysis of Data Protection Laws in UAE......................................................................8
Methodology..................................................................................................................................10
Research Design.........................................................................................................................10
Data Sources..............................................................................................................................11
Data Analysis.............................................................................................................................11
Ethical Considerations...............................................................................................................12
Assumed Outcomes and Implication of the Study........................................................................12
Time Frame....................................................................................................................................13

Research Proposal 3
List of References..........................................................................................................................14
Proposed Title
Comparison of data protection law in United Arab Emirates (UAE) and United Kingdom
(UK)
Introduction/Overview
The advancement in technology and economic along with social globalization have led to
novel challenges in safeguarding data. The security of data that contain personal information by
institutions and organizations, which gather and process data, has become a grave concern
because of the increasing rate of constant mixed attack. With Advanced Persistent Threat (APT),
a well-resourced systematic attack carried out by hostile state and cyber criminals targeting state
secrets; company intelligence plus arbitrary thievery of sensitive information (De Hert &
Papakonstantinou, 2012, pp. 130). The latest breaches in multiple person’s health, as well as
financial data, it has become relatively crucial for organizations that gather and utilize personal
information to maintain an all-inclusive and tough security framework to secure against these
exceptional attacks. According to a report by the Symantec Internet Security Threat Report
(ISTR), information violations amplified by 24 percent in the year 2014, plus a substantial
measure of these violations led to the loss of a considerable quantity of data. Thus, the report
acknowledged that 2014 became a year with extensive zero-day attacks, prevalent vulnerability,

Research Proposal 4
ransomware in addition to proliferation of a considerable number of wicked codes than formerly
reported (Baker, 2017, pp. 138).
The United Arab Emirates (UAE) was instrumental in designing data protection laws that
have been criticized at the federal level as they contain no specific provisions that express the
type of management or deepness of data security policies to be implemented not in favour of
unlawful exposure of individual information. The UAE has been criticized for its inefficiency in
development data protection laws to protect personal data from any kind of attack as cybercrime
has increased in the recent past in the region target institutions that collect and store personal
information like the financial institutions. On the contrary, the United Kingdom (UK) have
implemented data protection laws that ensure that personal data is protected and specifies the
type of security practices against unauthorized exposure to unauthorized persons. These laws in
the UK have cybercrime decline in recent years that point out the effective use of the data
protection laws that have been seen to be strengthened through reviewing them regularly (Busch,
2019, pp. 310).
The Rationale of the Study
The study is important in examining the data protection laws and determines their
effective in UAE and UK. The increasing challenge of safeguarding personal data has increased
the awareness in diverse countries around the world towards creating data protection laws that
will ensure that the cybercrimes are minimized. These laws will ensure that the growing trend of
cybercrimes is tackled and that adequate measures are put in place to safeguard data and provide

Research Proposal 5
security measures to deal with these challenges. UAE and United Kingdom have advanced very
dissimilar legal customs: the United Arab Emirates being Shari ‘a law plus the United Kingdom
a common law (Spencer & Patel, 2019, pp. 35).
Aim of the Study
The purpose of the study is to compare the United Arab Emirates and the United
Kingdom data protection laws to determine their effectiveness in addressing the security of
personal data.
Objectives of the Study
1. To investigate the effectiveness of data protection laws in the UAE in addressing security
of personal data for the people.
2. To explore the efficiency of data protection laws in the UK in their efforts to manage
personal data.
3. To determine the country that has developed effective data protection laws and the need
to strengthen these laws to determine the growing concern of increasing cybercrimes in
the cyber world (Bu-Pasha, 2017, pp. 215).
Literature Review
The protection of personal data along with the privacy considerations are more vital than
before due to technological and globalization advancement. Through there are no definite laws or
authorities, which particularly handle privacy and data protection in UAE, there are laws that are
pertinent. The primary UAE laws that are pertinent to privacy and data protection include UAE

Research Proposal 6
constitution, the Civil Code, the Penal Code, cyber crime law, the Electronic Transactions and
Commercial Law and GDPR. The UAE federal data protection laws have no specific provisions
defining the type or control or depth of information security measures established against
unauthorized exposure of personal information (In Gijrath et al., 2018, pp. 65). Instead, Articles
2 plus 3 of the Cyber Crime law are anchored on breaches connected to accessing unlawfully
and/or lacking authorization; data linked to insightful private and financial data, like credit care
or bank account. Sarabdeen, Rodrigues and Balasubramanian (2014) argue that the UAE data
protection laws, commonly, are not exceedingly developed as those of the UK that have become
effective in addressing cybercrimes and ensuring that personal data is protected. According to
Greenleaf (2017), United Arab Emirates has no comprehensive or definite confidentiality plus
data protection law and it is ranked the least with a percent score of 0.0 per cent in the “Data
Protection Index Maturity Rank” highlighted in a report released by EMC Global Data
Protection Index 2014. Accordingly, data protection along with the issues concerning privacy is
not managed in UAE through a distinctive decree; however, it is administered via some penal
code stipulations. The United Arab Emirates (UAE) Penal Code offers some fundamental laws
that apply to the regulation, as well as protection of data in addition to sensitive data (Greenleaf,
2017, pp. 26).
The primary data protection regulations in the Dubai International Financial Centre
(DIFC) are DIFC Law Number 1 of 2007 and DIFC Data Protection Regulations. The main data
protection laws under the Abu Dhabi Global Market (ADGM) include the Data Protection
Regulations 2018 and Data Protection Regulations 2015. The only law that addresses directly
data protection in the United Arab Emirates is the Dubai Law Number 26 of 2015 that regulate

Research Proposal 7
Data Dissemination and Exchange in the Emirate of Dubai. Young (2014) asserts that the most
recent advancement concerning the ratification of laws that apply to such distinct fields of data
or confidentiality concerns comprise the ratification of United Arab Emirates Federal Law 3 of
2013 that establishes National Electronic Security Authority (NESA); the Cabinet Resolution 21
of 2013 on IT Security Regulations at the federal government parastatals; the United Arab
Emirates Federal Law 5 of 2011 Combating Cyber Crime; as well as UAW Federal 6 2010 that
relates to Credit Information. The most applicable privacy law in UAE is Article 379 of the UAE
Penal Code (Young, 2014, pp. 101). The law prohibits an individual who by reason of their
profession, skill and situation are entrusted with “secret” from using or disclosing that “secret”
with no consent of the individual whom the secret pertains (Parsons & Oja, 2013, pp. 345).
There exist other provisions that are appropriate to data protection, for instance, the United Arab
Emirates Civil Code plus the United Arab Emirates Labour Law. Nevertheless, in line with
UAE, the only precise data protection decree that governs the processing of individual data is the
DIFC that is applicable to persons and companies running in the DIFC (Graef, 2016, pp. 82).
In the UK, there are laws that have been created to safeguard the privacy of personal data
by providing stipulations that guide the disclosure of information and handling of financial
information by different organizations and institutions (Maurushat, 2011, pp. 432). The Data
Protection Act 1998 has been instrumental law in data protection against exposure because it
provides measures that are designed to discourage individuals from accessing private
information without permission. Petersen (2018) says that the Data Protection Act 1998 was
modified by the Freedom of Information Act 200 to award a right of access to all personal
information (manual or computerized) stored by public authorities, subject to exceptions

Research Proposal 8
(Petersen, 2018, pp. 12). Additionally, the Data Protection Act 2018 (DPA 2018) ensures that the
data protection laws fir for the digital era because of the growing quantity of information is being
processed. Thus, the act encourages individuals to take charge of their personal data and support
United Kingdom organizations through this transformation. The act offers an all-inclusive and
contemporary framework for data guard in the United Kingdom, with well-built sanctions for
mismanagement (Fazlioglu, 2019, pp. 272).
The UK’s third generation of data protection law recently received the Royal Assent
where it primary provisions came into effect on May, 25, 2018. The novel act is designed to
modernise data protection laws in the country to make sure that they are effective in the future.
DAP 2018 is effective in handling with processing that does not fall in European Union (EU)
jurisdiction. The act further transposes the European Union Data Protection Directive 2016/680)
in the domestic UK law in which the Law Enforcement Directive complements the General Data
Protection Regulation (GDPR). Also, part 3 of the DAP establishes the needs for processing of
personal information for criminal’ law enforcement goals.
SWOT Analysis of Data Protection Laws in UAE
Strengths Weaknesses
The country has established strong
institutions that oversee the
implementation of data protection laws.
The government has put in place
The data protection laws in UAE do not
clearly provide provisions on cyber
crimes regarding terms of
imprisonment and fines imposed to

Research Proposal 9
measures to ensure that the data
protection laws are well guarded to
promote the interests of the citizens.
The cybercrime laws have recognized
the need to strengthen the data
protection laws to ensure the private
data is not attacked.
persons violating data protection laws.
Data protection laws in the UAE have
not been effective in preventing
criminals from accessing personal data.
The UAE federal data protection laws
have no specific provisions defining the
type or control or depth of information
security measures established against
unauthorized exposure of personal
information (Gosh, 2010, pp. 18)
Opportunities Threats
The UAE enjoys great economic
position amongst other nations in the
Middle East region that needs her to
take stronger, as well as quicker steps
to use all accessible prospects to
enhance its present Cyber Law status to
increase the intensity of security in a
productive environment replete with e-
businesses.
The primary threat for data protection
laws is the increasing cases of
cybercrime in the UAE that undermines
the efforts towards data protection laws.
The information revolution age makes
it even easier for hackers to share
hacking particulars plus methods. This
generates a more accomplished breed
of Cyber Criminals that continuously
introduce novel types of crimes that

Research Proposal 10
There is growing awareness for the
need to put in place strong measures by
the government to promote the
implementation of data protection laws.
leave governments behind in coping
with technology data protection laws
Methodology
The study will use document analysis to collect the needed data to examine the
effectiveness of data protection laws in the UAE and the UK. The study will be designed in a
way to investigate the present landscape of the UAE and the UK in regard to data protection
laws. This research will endeavour to sufficiently examine the level of data protection laws in
these nations in the light of the recent cases of growing cyber crimes due to economic reforms
along withy the rapid technological developments in the ICT segment (Purtova, 2018, pp. 40).
Research Design
The document analysis will be used to search sources that have vast data on the data
protection laws in the United Aran Emirates plus the United Kingdom. Document analysis will
be an appropriate design method to collect the data that is needed to attain the objectives of the
study. The method is an important instrument utilized expansively in qualitative study and
researchers to analyze practically anything that will support the research questions (Seidel &
Urquhart, 2013, pp. 237). In addition, contrasted to other techniques like interviews,
observations, plus questionnaires, the method of document analysis is crucial in the reality that it
analyses printed documents plus this evades researcher manipulation that other methods have on

Research Proposal 11
data. Additionally, documents are resources that will be simply revisited whilst confirming
information. In addition, document analysis is effective in that the comparative analysis will be
costly with other methods, but with document analysis the cost will decrease significantly.
Data Sources
Further to carrying out searches all through proper USQ library databases in addition to
government data accessible online, resources held at or reachable via the university will be used
together with materials used as part of teaching in the MSc in Information technology
Specialization in Cyber Security. Requests will be made to access documents from different
government institutions and organizations in the UAE and the UK. The federal laws plus statutes
are usually published by authorized state sources. Online sources will be important sources in
collecting the data needed to answer the research questions of the study. This information will be
valuable in collecting data regarding data protection laws in the United Kingdom and UAE. The
qualitative procedures that will be used in this study will start with primary sources that will be
collected with their pertinent segments and entered into the Endnote. Thus, this will be done not
only as a reference executive to better advance the writing of the concluding report, but as well a
vital step in the study workflow to prepare the resource for porting to NVIVO™ (Hoecke, 2011,
pp. 24).
Data Analysis
The analysis of the data collected from the different sources will be analyzed in order to
interpret the results of the study. This study will provide a methodological contribution via
workflow along with the analysis schema will be utilized as the basis for comparison in
NVIVO™. Once the data is gathered in addition to be prepared in NVIVO™, the procedure of

Research Proposal 12
coding will be performed. Coding will entail the process of selecting a primary group,
methodically relating it to other categories, confirming the associations, as well as filling in the
groups, which need further modification plus development. It should be remembered that the
study will be non-linear and of a hermeneutic design, which will inform the examination along
with process all through the coding process comprising literature review and the analysis
(Bazeley, 2013, pp. 328).
Ethical Considerations
The ethical issue in the study is requesting the person from libraries in UAE and UK to
access the documents. This is important because this will evade the legal issues that may arise
when permission is not sought from the relevant authorities with the documents needed in the
study. Permission should be also sought from government authorities since they store records
that have information on data protection laws important for the study (Seidel & Urquhart, 2013,
pp. 240).
Assumed Outcomes and Implication of the Study
The study will be important in informing the development of data protection laws to help
promote the privacy of private data. This will help legislators and other stakeholders to craft data
protection laws that will go along way in preventing exposure of personal data to third parties
and unauthorized individuals from accessing the data. The results of the study will offer much
understanding on the areas of the data protection laws that need to be amended to ensure that
they are effective in tackling cyber crimes that entail attack on personal data (Kirkpatrick, 2018,
pp. 19). This understanding will be crucial to institutions and organizations in developing

Research Proposal 13
measures that will ensure that the privacy of the people in the UK and UAE. These institutions
and organizations will benefit from the findings of the research since this will enable them to
allocate sufficient resources to promote the implementation of data protection laws towards
helping them deal with the current trend of increasing exposure of personal data to unauthorized
individuals. More so, the findings will enable UAE government to examine the loopholes in its
data protection laws and develop effective laws that are all-inclusive to tackle the current
challenge of cyber crime (Babu & Sista, 2017, pp. 207).
Time Frame
The study will be undertaken for a period of 3 years since the comparison of the two
nations needs time that will ensure sufficient collection plus analysis of data needed to develop
the results of the study. The period of 3 years is enough to allow between the collection of data
and analysis in the UK and UAE concerning data protection laws.
Time Activity
June-December 2019 Collecting databases
January-June 2020 Comparing data from different libraries and
sorting the relevant data.
July (2020)-June (2021) Analysing data
July (2021)-December (2022) Compiling data and presentation

Research Proposal 14
List of References
Babu, R.R. & Sista, S. (2017). “European data protection laws: Learnings and implications
forIndian business”. Journal of Data Protection & Privacy, 1(2), 206-221.
Baker, L. (2017). “The impact of the General Data Protection Regulation on the banking sector:
Data subjects’ rights, conflicts of laws and Brexit”. Journal of Data Protection & Privacy, 1(2),
137-145.
Bazeley, J.K. (2013). Qualitative data analysis with NVIVO,(2nd edition)SAGE Publications
Ltd, pp.328.
Bu-Pasha, S. (2017). “Cross-border issues under EU data protection law with regards to personal
data protection”. Information & Communication Technology Law, 26(3), 213-228.
Busch, C. (2019). “Implementing Personalized Law: Personalized Disclosures in Consumer Law
and Data Privacy Law”. University of Chicago Law Review, 86(2), 309–331.
De Hert, P. & Papakonstantinou, V. (2012). “The proposed data protection Regulation replacing
Directive 95/46/EC: A sound system for the protection of individuals”. Computer Law &
Security Review, 28(2), 130-142.
Fazlioglu, M. (2019). “Beyond the “Nature” of Data: Obstacles to Protecting Sensitive
Information in the European Union and the United States”. Fordham Urban Law Journal, 46(2),
271–306.
Ghosh, S. (2010). Cybercrimes: A Multidisciplinary Analysis. New York: Springer.

Research Proposal 15
Graef, I. (2016). EU Competition Law, data protection and online platforms: Data as essential
facility. Alphen aan den Rijn, the Netherlands: Wolters Kluwer.
Greenleaf, G. (2017). “ASEAN’s Two Speed Data Privacy Laws: Some Race Ahead”. Privacy
Laws & Business International Report, 147(2), 25-28.
Hoecke, M.V. (2011). Methodologies of Legal Research: Which Kind of Method for What Kind
of Discipline. Hart Publishing.
In Gijrath, S., In Hof, S. ., In Lodder, A. R., In Zwenne, G. J., In Hacon, R. J., In Gielen, C., & In
Dreier, T. (2018). Concise European data protection, e-commerce and IT law. Alphen aan den
Rijn, The Netherlands] : Kluwer Law International.
Kirkpatrick, K. (2018). “Borders in the Cloud: New data protection laws raise questions about
whether certain jurisdictions are trying to thwart the ability of foreign governments to obtain data
on their citizens”. Communications of the ACM, 61(9), 19–21.
Maurushat, A. (2011). “Australia's Accession to the Cybercrime Convention: Is the Convention
Still Relevant in Combating Cybercrime in the Era of Botnets and Obfuscation Crime Tools?”.
University of New South Wales Law Journal. 33(2), 431-473.
Parsons, J.J. & Oja, D. (2013). New Perspectives on Computer Concepts 2013: Comprehensive.
Cengage Course Technology, pp. 345.
Petersen, K. (2018). “GDPR: What (and Why) You Need to Know About EU Data Protection
Law”. Utah Bar Journal, 31(4), 12–16.

Research Proposal 16
Purtova, N. (2018). “The law of everything. Broad concept of personal data and future of EU
data protection law”. Law, Innovation & Technology, 10(1), 40–81.
Sarabdeen, J., Rodrigues, G., & Balasubramanian, S. (2014). “E-Government users’ privacy and
security concerns and availability of laws in Dubai”. International Review of Law, Computers &
Technology, 28(3), 261–276.
Seidel, S. & Urquhart, C. (2013). “On emergence and forcing in information systems grounded
theory studies: the case of Strauss and Corbin”. J Inform Technol. 28(2), 237–260.
Spencer, A., & Patel, S. (2019). “Applying the Data Protection Act 2018 and General Data
Protection Regulation principles in healthcare settings”. Nursing Management - UK, 26(1), 34–
40.
Young, B.J. (2014). A Comparative Study of the Legal Frameworks and Protection of Digital
Content in the United Arab Emirates and Australia in Relation to the Practice of Blocking Digital
Content on the Basis of Location (Geo-Blocking) and its Associated Circumvention
Technologies. Int J Journalism Mass Communication. 1(1): 101-132.