What does ADGM's data protection regime expect for staff training?

ADGM has its own data protection law because it is a financial free zone with its own civil and commercial legal system. ADGM describes itself as established under federal legislation and Abu Dhabi Law No. 4 of 2013 as a financial free zone, with a legal framework based on English common law. The ADGM Board enacted the DPR 2021 on February 11, 2021 under that Abu Dhabi law.

For readers outside the United Arab Emirates (UAE), the practical point is that the country has several data protection regimes. Most businesses "onshore" deal with the federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, which the UAE Government portal says came into force on January 2, 2022 (see the UAE PDPL page). Dubai's financial free zone has its own statute (see the DIFC Data Protection Law page). ADGM establishments follow the DPR 2021.

Under section 3(1), the DPR 2021 apply to processing "in the context of the activities of an Establishment of a Controller or a Processor in ADGM, regardless of whether the Processing takes place in ADGM or not." A group with an onshore entity and an ADGM entity should therefore map each legal entity to its own regime, and its compliance obligations register should record which training obligation comes from which law. The Regulations also refer throughout to "Applicable Law", which ADGM guidance explains includes Abu Dhabi or federal law having application in ADGM.

Not as a stand-alone duty with set hours or a set frequency, but training is written into several obligations. As at September 2026, no section of the consolidated DPR 2021 says "every controller must train its staff annually". Instead, training appears as a named DPO task, as a required term of Binding Corporate Rules, and, through ADGM guidance, as an expected organizational measure for accountability and security.

The most direct text is section 37(1)(b). It lists among the tasks of the DPO monitoring compliance with the Regulations and with the organization's policies, "including the assignment of responsibilities, awareness-raising and training of Staff involved in Processing operations, and the related audits." Section 37(1)(a) adds the task of informing and advising "the employees who carry out Processing of their obligations".

The Office of Data Protection (ODP) guidance says staff must understand the importance of data protection and that controllers should provide regular training. Part 5 of the ODP guidance on the DPR 2021 lists "Building a culture of security awareness in your organisation e.g. via regular training and awareness-raising campaigns" as an example organizational measure under section 30.

On people acting under the controller's authority, the same guidance says: "This means that you must make sure your staff understand the importance of data protection. You should provide regular training". It lists three topics:

• the responsibilities of the organization as controller or processor under the DPR 2021;
• staff responsibilities for protecting personal data, including not accessing or disclosing it without authority; and
• the risk of people trying to obtain personal data by deception, for example by pretending to be the data subject or claiming an official reason.

The guidance illustrates this with an example of a controller that applies least privilege access and gives staff data protection and data security training when they join, followed by annual refresher training. That is an example, not a rule, but it is a useful baseline when setting refresh cycles. Part 1 adds that smaller organizations can approach accountability by "ensuring that staff are aware of and understand their" data protection responsibilities, and Part 3 says senior management should foster a culture of privacy awareness.

The DPO informs and advises employees and monitors the organization's awareness-raising and training, but the controller or processor remains responsible for compliance. Under section 35(1), a DPO is mandatory where processing is carried out by a public authority, where core activities involve regular and systematic monitoring of data subjects on a large scale, or where core activities involve large scale processing of special categories of personal data.

Section 35(3) requires the DPO to be appointed on the basis of professional qualities and expert knowledge of data protection law and practices. Section 36 requires the DPO to be involved properly and in a timely manner, to have sufficient resources, and to report directly to the highest level of management. ODP guidance on section 37 says informing employees "would also ideally include running training sessions", and that stakeholders should be told through internal training and communications to inform the DPO before starting high risk processing.

Where no DPO is required, the training monitoring task does not disappear: someone still has to evidence the section 22 and section 30 measures. ODP Circular No. 1 of 2025 reminds all ADGM entities to keep their Data Protection Register and the details of their designated Data Protection Contact Person up to date, and warns that failure can lead to enforcement action.

Each training-related duty can be turned into a measurable outcome and a record the DPO or the Commissioner could review. The table below is an illustrative mapping built from the provisions above; it is not an ODP template.

Completion alone shows attendance, not understanding. Section 30(1)(d) calls for regularly testing, assessing, and evaluating the effectiveness of organizational measures, which supports assessing knowledge rather than only tracking clicks (see completion tracking vs competency verification). A training matrix linking roles to modules and a clear audit trail make the DPO's monitoring task practical.

The Commissioner of Data Protection can impose an administrative fine of up to USD 28 million under section 55(1), and the organization's technical and organizational measures are a factor in the amount. Section 55(3)(d) lists "the degree of responsibility of the Controller or Processor taking into account technical and organisational measures implemented by them pursuant to sections 23 and 30" among the factors the Commissioner may consider.

Other listed factors include the intentional or negligent character of the contravention, mitigation, cooperation, and whether the organization notified the Commissioner itself. A documented, assessed training program is therefore both a preventive control and part of the record an organization would rely on if something went wrong. Preparing training records for an audit covers what that record should contain.

Start from the obligations, not from a generic privacy course. The steps below follow the DPR 2021 structure and the ODP guidance; the sequence is a suggested method.

1. Confirm which entities are ADGM establishments and which fall under the federal PDPL or another free zone regime, and record the result in the obligations register.
2. Decide whether a DPO is mandatory under section 35(1), and give the DPO or contact person documented responsibility for monitoring training.
3. Map roles to the processing they do, using the record of processing activities under section 28, and define who has permanent or regular access to personal data.
4. Write measurable outcomes for each obligation in the mapping table, then build role based modules for onboarding and refreshers.
5. Assess understanding with scenarios, not only completion, and feed results into the section 30(1)(d) effectiveness review.
6. Keep dated records of content versions, completions, and assessment results so the DPO can report to the highest level of management.
7. Review content when the Regulations, ODP guidance, or circulars change, and after incidents or DPIA findings.

Mapping training to compliance obligations and structuring onboarding for regulated roles describe steps 3 to 5 in more detail.

Knowledge Foundry models the DPR 2021 provisions, the roles they apply to, and the assessment points for each before any content is written, with each concept linked to its source section. When the Regulations or ODP guidance change, the affected concepts and modules can be identified from that structure, and the assessment records give the DPO evidence for the section 37 monitoring task.