Privacy Rights, Classification & Transfer
Privacy, legal and data owners manage DSAR clocks, the data classification matrix, retention holds and the cross-border transfer register under UAE PDPL and entity-specific obligations.
CMP-09
Open DSARs
7
access 3 · correction 2 · deletion 2
Due ≤ 7 days
3
1 clock breach
Identity verification pending
2
clock paused while unverified
Retention holds active
5
2 block deletion requests
Transfers pending approval
2
1 blocked — no mechanism
DSAR queue — statutory clocks (30 calendar days, pausable for verification)
| Request | Type | Data subject | Identity verification | Received | Clock | Days left | Status | Owner |
|---|---|---|---|---|---|---|---|---|
| DSR-2026-041 | Access | Amina Noor customer · PTY-002210 |
Verified — EID match | 2026-06-20 | −3 | Breached — escalated to DPO | MS M. Al Suwaidi | |
| DSR-2026-044 | Correction | Khalid Mansour UBO · Falcon Trading FZ-LLC |
Verified | 2026-07-02 | 13 | Approved — correction applied 16 Jul | MS M. Al Suwaidi | |
| DSR-2026-045 | Deletion | Former tenant ●●●● | Verified | 2026-07-05 | 18 | Partially refused — AML retention hold RH-009 (10y) | AB A. Al Blooshi | |
| DSR-2026-046 | Access | Portal user ●●●● | Pending — clock paused day 4 | 2026-07-08 | paused | Awaiting identity evidence | NS N. Saeed | |
| DSR-2026-047 | Restriction | Lead ●●●● (marketing) | Verified — email loop | 2026-07-10 | 23 | Applied — processing restricted to legal basis | MS M. Al Suwaidi | |
| DSR-2026-048 | Correction | Employee ●●●● HR scope — restricted |
Verified — SSO | 2026-07-12 | 25 | In review — data owner HR | GO HR privacy desk | |
| DSR-2026-049 | Deletion | Withdrawn lead ●●●● | Pending — clock paused day 1 | 2026-07-16 | paused | Awaiting identity evidence | NS N. Saeed |
7 open requests
Correction request DSR-2026-044 — audit-safe execution
party PTY-004412 · Khalid Mansour · field: passport_no
- P●●●●312 (transposed digits — OCR keying error)
+ P●●●●321 (verified against original document DMS-88213)
audit: AUD-77812 · maker N. Saeed · checker M. Al Suwaidi · 16 Jul 2026
legal records: KYC snapshot v3 and signed contract PDF unchanged (retention)
Downstream: screening re-run queued (RS link); goAML packs unaffected — submitted versions stay locked.
Deletion refusal — consequence & approval
Partial refusal of deletion — DSR-2026-045
Dual approval required when an AML hold intersects a privacy right.
Data classification matrix — by data class
Versioned in Compliance Policy Studio · pack PRV-UAE v3.2
| Data class | Classification | Purpose | Lawful basis / consent | Retention | Transfer rule | Masking / export |
|---|---|---|---|---|---|---|
| Identity documents (EID, passport) | Restricted — sensitive PII | KYC / legal onboarding | Legal obligation (AML-CFT) | 10y after relationship end | UAE residency required | Masked by default · export blocked |
| Contact details (phone, email) | Confidential PII | Service & marketing comms | Contract + consent for marketing | 3y after last activity | Approved processors only | Masked for non-owners |
| Financial records (invoices, receipts) | Confidential | Accounting, tax, audit | Legal obligation (VAT/CT) | 7y fiscal retention | UAE + adequacy list | Role-gated · watermark export |
| Screening & case evidence | Restricted — case only | AML investigation | Legal obligation | 10y · tipping-off protected | No cross-border | Case ACL · export dual-approved |
| Payroll & HR files | Restricted PII | Employment administration | Contract + legal obligation | End of service + 2y (gratuity: 7y) | WPS processors only | HR roles · salary masked |
| Portal telemetry / device data | Confidential | Security, fraud prevention | Legitimate interest (assessed LIA-12) | 13 months rolling | Pseudonymized only | Aggregate export only |
| Marketing analytics | Internal | Campaign performance | Consent (granular, revocable) | 2y | Approved processors | Aggregated · no direct identifiers |
Retention holds
| Hold | Scope | Basis | Placed by | Expires | Status |
|---|---|---|---|---|---|
| RH-009 | Former tenant records (PTY-●●●●) | AML-CFT 10y statutory | A. Al Blooshi (MLRO) | 2035-04-30 | Blocks deletion — DSR-2026-045 |
| RH-010 | CASE-2026-014 evidence set | Open investigation | A. Al Blooshi (MLRO) | case closure + 10y | Active |
| RH-011 | Deal DL-2026-0088 documents | Civil litigation (Prime Link) | M. Al Suwaidi (Legal) | court order | Active — legal hold |
| RH-007 | FY2023 payroll files | MOHRE inspection | HR privacy desk | 2026-09-30 | Review 60d before expiry |
| RH-005 | Client-money statements 2024 | Escrow audit | G. Okafor (Auditor) | 2026-12-31 | Active |
Releasing a hold requires the placing role + reason; release events are immutable audit entries.
Cross-border transfer register
| Transfer | Provider / recipient | Destination | Data classes | Mechanism | Status |
|---|---|---|---|---|---|
| XB-014 | E-signature provider (EU DC) | Ireland | Contact + contract metadata | PDPL adequacy + DPA v2.1 | Approved |
| XB-015 | Sanctions data vendor | United Kingdom | Query names (pseudonymized) | SCC 2021 + supplementary measures | Approved |
| XB-016 | AI OCR provider (region: US) | United States | Identity documents | None accepted for Restricted class | Blocked — UAE-residency route enforced |
| XB-017 | Marketing analytics SaaS | Germany | Aggregated campaign metrics | Adequacy + aggregation control | Pending DPO approval |
| XB-018 | Group shared-services (HR) | India | Employee master (subset) | SCC + TIA-2026-03 | Pending — TIA under review |
Provider routing honours residency rules at the AI gateway and document adapters; blocked routes fail closed with code PRV-451 RESIDENCY_DENIED.
Static render mockup — no live data. Source: ERP Modern Development Specification v2.0 · Covers: CMP-09 (privacy rights, classification and data transfer — DSAR clocks, lawful basis, retention holds, cross-border controls).