ADGM’s Substantial Public Interest Framework: Shaping the Boundaries of Data Use

The Abu Dhabi Global Market (ADGM) has introduced new Data Protection Regulations (Substantial Public Interest Conditions) Rules 2025 (“Rules”), on September 9, 2025. Why it matters: These Rules clarify when ADGM-regulated entities, including insurers, schools, and child protection organisations, can process Special Categories of Personal Data without consent under the “substantial public interest” ground.

Ronin Legal takes a closer look.

Vision and Scope

The ADGM-regulated entities are required to align internal policies with the updated standards, adopt safeguards to ensure processing is strictly necessary, and implement risk-mitigation measures under the supervision of ADGM’s Commissioner of Data Protection.

Prior to the enactment of the Rules, ADGM’s Data Protection Regulations 2021 had a general framework on data protection. It lacked detailed, sector-specific guidance on when and how the substantial public interest ground could be invoked for processing sensitive data.

These limitations exposed vulnerabilities in regulatory enforcement and risked inconsistent application of public interest exceptions.

Key Features

The current rules provide for:

1. Insurance

Insurers can process Special Categories of Personal Data without consent, provided the processing is necessary for reasons of substantial public interest, involves Special Categories of Personal Data, and is subject to further statutory safeguards.

These safeguards include situations where the processing is not carried out for measures or decisions relating to the data subject and where the individual does not, and is not expected to, acquire rights or obligations under the relevant insurance contract.

In such cases, the processing will only meet the requisite conditions if the controller cannot reasonably be expected to obtain the data subject’s consent and is not aware of the data subject withholding consent.

Binding definitions to ensure consistency across the industry have also been provided. “Insurance contract” is defined as a contract of general insurance, long-term insurance, or re-insurance and “insurance purpose” as advising on, arranging, underwriting, or administering an insurance contract; administering a claim under such a contract; or exercising rights or obligations arising in connection with it, including under law.

2. Children and “At Risk” Individuals

Sensitive data can be processed without consent to protect vulnerable individuals if the processing is necessary for protection against neglect, physical, mental, or emotional harm, or for protecting their overall well-being.

These protections extend to individuals under 18 and to those aged 18 or over who are considered “at risk,” wherein processing is necessary for reasons of substantial public interest, inability of the individual to provide consent, and the controller cannot reasonably be expected to obtain consent; or obtaining consent would prejudice the protective measures being undertaken.

For individuals aged 18 or above, the definition of “at risk” applies where there is reasonable cause to suspect that the person has care and support needs, is experiencing or at risk of neglect or harm, and, as a result, cannot protect themselves against such harm or the risk of it.

The protections are legally binding under Section 60 of the Data Protection Regulations 2021. Non-compliance may result in enforcement actions under ADGM’s broader regulatory framework.

The amendments also extend ADGM’s jurisdiction to Al Reem Island, ensuring consistency in the application of data protection standards.

Public Interest in the Global Context

Under the EU General Data Protection Regulation (GDPR), Article 9(2)(g) permits processing special categories of personal data without consent when "processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law."

GDPR requires that such processing be proportionate, respect the essence of data protection rights, and include suitable and specific measures to safeguard individual rights (Recital 46 and Article 9(2) conditions.

The UK GDPR, aligned with EU GDPR provisions, allows processing special category data for substantial public interest but provides UK-specific legislative frameworks identifying public interest conditions.

The UK Data Protection Act 2018 further specifies public interest grounds, for example, involving health and social care or safeguarding children and vulnerable adults, ensuring clear legal bases and protections.

The UK approach also emphasizes transparency, necessity, and strict adherence to safeguards to prevent misuse.

Conclusion

The "substantial public interest" exception is crucial in sectors where obtaining consent may not always be feasible or appropriate to facilitate essential services and protect vulnerable individuals.

However, this exception can be misused if not properly regulated. Without precise definitions and safeguards, entities could justify extensive processing of sensitive data "in the public interest" without meaningful oversight, leading to unjustified intrusions into individual privacy and weakening of data protection rights.

Without mandatory safeguards, there is also a greater risk of harm through misuse, discrimination, or breaches of confidentiality, especially concerning vulnerable populations.

Therefore, it is essential for regulations to define specific conditions under which this exception can be applied, ensuring that data processing is both necessary and proportionate to the intended purpose.

By establishing detailed conditions and safeguards, the ADGM's Rules aim to prevent misuse of the substantial public interest exception, ensuring that sensitive data is processed responsibly and ethically.