The new UAE Commercial Companies Law

Dec 13, 2016

The new UAE Commercial Companies Law no. 2 of 2015 (the “CCL”) came into force on 1st July 2015 and substitutes the old Commercial Companies Law in its entirety.

All companies are required to amend their existing Articles of Association to reflect and comply with the changes introduced by the new CCL, and any companies failing to do so by 30th June 2016, will be automatically dissolved.

Several implementing regulations and decrees of the new CCL are yet to be enacted to give effect to some of the newly introduced provision such as the establishment of the Registrar which is the body that is entrusted with handling the trade names registrations, among other things.

The absolute exceptions from the application of the old CCL granted to oil companies, electricity and water desalination companies has been abolished and replaced by a different concept. Exceptions to the new CCL are now granted to a) special entities by virtue of a resolution of the Council of Ministers; or b) to entities wholly owned by the Federal Government of Local Government or wholly owned affiliates of such entities; or c) entities in which the Federal Government or the Local Government owns directly or indirectly a 25% stake operating  in the field of oil exploitation, power, electricity and water desalination industries; or d) entities exempted by a special federal law.
The CCL does not affect any of the entities that have been exempted from the application of the old CCL under the auspices of the latter. Those entities continue to enjoy the status afforded to them.


General Changes applicable to all type of companies (Limited Liability Companies, Public Joint Stock Companies and Private Joint Stock Companies.


  1. Holding Companies (New CCL – Art 266)
    – LLCs and JSCs are now permitted to be established as holding companies in order to conduct business activities solely through their relevant subsidiaries.

By recognizing the concept of a “holding company” under the new CCL, the UAE will become more appealing, as a jurisdiction, to large corporate groups when they are considering restructuring or establishing a presence in the UAE.


  1. Foreign Ownership (New CCL – Art. 10)
    New provision explicitly invalidating any transfer of shares which may affect the minimum UAE national shareholding of 51%

Despite much speculation, the new CCL retains the same approach as the old CCL in relation to the foreign ownership restriction, i.e. 51% (UAE National) / 49% (foreign), or 100% GCC nationals.  However, the UAE government is considering relaxing the requirement of such restrictions in certain industry sectors under a new FDI regime (timing of which is unclear at the moment).


  1. Single Shareholder Ownership (New CCL – Art 8)
    Companies including Limited Liability Companies (LLC’s) may be formed by a single shareholder as opposed to the old CCL in which a minimum of requirement of 2 shareholders has been in place.  In this case, the name of the company shall bear the name of the single shareholder.

However having said this, the 51%-49% holding is still in force and hence the current law remains to be observed.  Moreover, this option may only be applicable without prejudice to the local shareholding requirement. 


  1. Companies Registrar (New CCL – Art 33-38)
    The Minister of Economy shall issue a regulation setting out the activities and functions of the Companies Registrar.  In particular, the Companies Registrar shall supervise the trade name register (to avoid double registration), hold company records and enable concerned parties to inspect the relevant company records.


  1. Duties of Managers / Directors (New CCL – Art 22 & 24)
    The duties/liabilities of managers and directors have been reinforced.  The “person” delegated to manage a company must a) preserve the rights of the company, b) exert the efforts of a prudent (sensible) person and c) carry out the all the acts in compliance with the objectives of the company and in line with the powers afforded to him/her by the company.
    The CCL has also addressed the issue of limitation of liability and has stated that any provisions in the AOA permitting a company or any of its affiliates to limit the personal liability of any person from acts carried out in his/her capacity as holding office in the company shall be null and void.


  1. Financial Assistance & Loans to Directors (New CCL – Art 222 & 153)
    The Central Bank now prohibits loans and any financial assistance to Directors of companies as well as to their spouses/children who hold a 20% share profit of the company.


  1. Transfer of Shares (New CCL – Art 10)
    Under the new law, any transfer of shares in violation of the 51% local shareholding will be null and void. However, the CCL does not address the concerns related to the annulment of the share transfer and how the assets of the company will be dealt with, if the sanction is not the annulment of the company, but the annulment of share transfer. The general principles of annulment will apply.

The new FDI law may have an implication on foreign holding. Free zone companies of certain sectors will be allowed to work onshore.


  1. Accounting Records (New CCL – Art 26)
    All companies are required to keep accounting records at their relevant head offices for a minimum period of 5 years.  In addition, all companies shall apply international accounting standards and practices when preparing their relevant accounts in order to give a clear and accurate view of the profit and loss of the relevant companies.
    All audited accounts for each financial year need not be published, but filed with the Ministry of Economy and Department of Economic Development.

The aim is to bring accountability and transparency of a company up to international standards. Consequently, a company should be able to accurately reveal, at any time, the financial position of the company, and enable shareholders to verify that the company’s accounts are properly kept in accordance with the new CCL.
It is helpful that the new law permit companies to retain electronic versions of their documents (provided that such documents will be saved in compliance with a decree to be issued by the Minister of Economy).


  1. Corporate Social Responsibility
    Regulations yet to be discussed and enforced.


  1. In-kind Contributions
    In-kind contributions are evaluated by independent financial advisors (Old law :  a government committee)


  1. Sanctions & Penalties
    Both penalties and sanctions have been tightened.  However, there is a likelihood of more abuse and more risks applicable to Directors / Managers.


  1. Free zone Companies (New CCL – Art. 5)
    In general the new CCL shall not be applicable to free zone companies. However, if the laws of the free zone permit certain free zone companies to operate outside the relevant free zone (i.e. onshore), then the new CCL shall be applicable to such free zone companies.

Allowing certain free zone companies to operate onshore will provide greater business flexibility/mobility and, therefore, it is logical for such free zone companies to be subjected to the new CCL. However, it is unclear how this will work in practice, as the Federal Cabinet is yet to issue a resolution to determine the conditions and requirements to register free zone companies to operate outside of the relevant free zone.


Impact of CCL on Limited Liability Companies

Whilst there are numerous positive aspects of the new CCL in relation to limited liability companies, there are some provisions that require further reflection and careful consideration;


  1. Minimum Capital (New CCL – Art 76)
    Prior to 2006, the old CCL had originally provided for an AED 150,000 minimum capital.  In 2009, the minimum capital had been abolished and replaced with a reference to “adequate capital requirement”  (although in practice, some activities were still subject to a minimum requirement).  With the new CCL, the “adequate” reference remains the same but with the possible issuance of a decree setting minimum capital requirements.
    An express restriction has been imposed on the release of capital deposited by LLC’s under incorporation.  Banks may only release the capital upon the submission of evidence confirming the completion of the registration process of the company.


  1. General Assembly Meetings (New CCL – Art 92-100)
    A General Assembly consisting of all partners should be convened at least once in a year during the four months following the end of the financial year of the company.
    Invitations to shareholders meetings may now be sent by any method/means, and not necessarily by registered courier as per the old CCL, provided that the AOA stipulates the permitted means of notification.
    The pre-notification period for general assembly invitations has been reduced from 21 days to 15 days, unless the shareholders agree on a shorter period.
    The minimum attendance quorum has been increased from requiring the attendance of shareholders holding 50% of the share capital to 75%. If the quorum is not met in the first meeting, another meeting should be called for, after observing a notice period of 14 days, and this second meeting shall be valid if attendance by shareholders holding 50% of the share capital. If the quorum is not met in the first two meetings, a third meeting is called for, after observing a notice period of 30 days, and this third meeting shall be valid with no minimum quorum requirement.
    Minutes of the meetings need to be recorded and entered in a special register to be kept at the head office of the company. Any partner may inspect the minutes in person or by proxy and may also inspect the balance sheet, the profit and loss account and the annual report.


  1. Restrictions on Share Transfer (New CCL – Art. 79)
    This provision will place the shareholders in a better position in the discussions with the notary public when restrictions are commercially agreed between shareholders.
    The AOA of a LLC may contain “restrictions on share transfer” wherein protections may now be included (e.g. lock up, etc.)


  1. Maximum number of directors / managers (New CCL – Art. 83)
    The management of an LLC can be undertaken by one or more directors/managers as determined by the company’s memorandum and articles of association or the general assembly of the company.

Removing the cap on the number of directors/managers appointed to an LLC will allow for greater business flexibility and networking, and enable talented external advisers to sit on the board of directors/manager.


  1. Non-compete by directors/managers (New CCL – Art.86)
    Other than with the consent of the general assembly of the company, a director/manager is not permitted to manage another competing company (including another company with objects similar to the company)

This new non-compete provision is consistent with the new directors/managers duties provision and they should be mindful not to breach this new non-compete provision as, otherwise, they maybe dismissed and required to compensate the company.


  1. Pledges of Shares (New CCL – Art. 79)
    Pledges over the shares of a LLC are permissible provided that the pledge is recorded in a notarized document and registered in the commercial registration of the company.  A question round the enforceability of this pledge remains questionable and the logistical procedures are yet to be regulated by the authorities.

By introducing a new provision for perfecting security by way of share pledge over shares in an LLC, it should improve access to debt financing as shareholders will now be able to grant security over their LLC shares. However, it remains unclear how the new provision will be interpreted as the New CCL is silent in respect of the concepts of “share certificate” or “number/registered shares” attributed to any shareholder in an LLC.


  1. Pre-emption rights in LLCs (New CCL – Art 80)
    If an existing shareholder exercises its pre-emption right but disagrees on the sale price offered by the selling shareholder, said existing shareholder is entitled to require the Department of Economic Development to appoint an independent expert (financial and technical), at its own expense, to evaluate the shares.
    In other words, the existing shareholder may exercise its pre-emptive right without being bound to the sale price determined by the selling shareholder in the sale notice and hence, the selling shareholder will not be freely entitled to sell to another buyer until the evaluation is fully completed. This could have implications, and cause possible delays, on the sale of shares of legal vehicles set up through side agreements with local shareholders.
    The AOA should clearly emphasize on the timings, procedure, etc. on pre-emption rights.
    Shareholders Agreement is very important and should clearly define all grey areas.


What do companies need to do?

  1. Watch out for all anticipated new implemented regulations and seek legal advice before proceeding with any activity or act that has been re-regulated by the CCL.
  2. Review the Articles of Association of the Company and amend the necessary before the expiry of the grace period, until 30th August 2016.


– Backer & McKenzie, Habib Al Mulla
– PWC Legal Middle East

Contact for more information or assistance.

Share This

Kelmer UK Ltd.

Company registered in England, N. 05260622

3rd Floor East, 12 Bridewell Place
London EC4V 6AP - United Kingdom

+44 (0)20 73539200

+44 (0)20 74270120


K&P International Consulting Ltd

Company registered in Ireland, N. 571535

Suite 4.01 Ormond Building,
31-36 Ormond Quay Upper
Arran Quay, Dublin 7, D07 F6DC

+353 (0) 1 5313450

+353 (0) 15313449


Kelmer Middle East LLC

Company registered in Dubai, United Arab Emirates

Rooftop MSM 2 Building, Al Safa 1st,
Sheikh Zayed Road Dubai

+971 4 335 8111

+971 4 335 9119


Kelmer Ltd. (Hong Kong)

Company registered in Hong Kong S.A.R., CR N. 1232016

603 Shun Kwong Commercial Building 8,
Des Voeux Road West - Hong Kong

+852 3187 7477

+852 3421 2262


Kelmer Business Consulting
(Shanghai) CO. LTD.

Company registered in China, Uniform Social Credit Code 9131000058680059XE

Building 8 2nd Floor, 322 Jiaozhou Road,
Jingan District, Shanghai, China - 200040

+86 21 3392 6220

+86 21 6854 2470


Kelmer Singapore PTE. LTD.

16 Stanley Street, Level 3
Singapore 068735

+65 6222 3985

+65 6836 6530


Kelmer Vietnam CO. LTD.


8th Floor, Anh Minh Building, 36 Hoang Cau Str.
Dong Da District, Hanoi, Vietnam

+84 24 2282 7262



In Alliance with WEY and Umberto Bonavita P.A.
Company registered in Miami, FL, USA

1200 Brickell Avenue, Miami, Florida, 33131


FAX u003cbru003e+971 4 335 9119


Kelmer Philippines INC.

IStock Corporation registered in Manila, Philippines.
Company Registration Number CS201820394

4th floor, Office 447/450, Dusit Thani Manila Ayala Center,
Makati City, 1223 Philippines

+63 2 243 6382

+63 928 9745 790



649 004 651

lv.12, 90 Arthur Street North Sydney NSW 2026, Australia

+61 2 8007 3868



Thank you for visiting (the “Website”). Please read these Terms and Conditions carefully and ensure that you understand them. By accessing and using the Website, you indicate that you accept (unconditionally and irrevocably) these Terms and Conditions. If you do not agree to these Terms and Conditions, please refrain from using our Website and exit immediately.

Information about us

The domain is owned by Kelmer UK Ltd., whose registered address is 3rd Floor East, 12 Bridewell Place, London EC4V 6AP - United Kingdom. Kelmer UK Ltd. is registered in England, incorporation number 05260622.
The Website is operated by Kelmer Middle East LLC, whose registered address is Arenco Tower - Office 807, Dubai Media City, P.O. Box 214525, Dubai - U.A.E.

Modification of Terms and Conditions

We may change these terms and conditions at any time without advance notice. Changed terms will become effective once posted on the Website, and will not have any retrospective effect. Your continued use of this Website after any change means you have accepted the changed terms and conditions. You should periodically visit this page to review the current terms and conditions.

Access to the Website

Access to the Website is free of charge.
No part of the Website requires payment of any kind in order to access or use it. It is your responsibility to make any and all arrangements necessary in order to access the Website.
Access to the Website is provided “as is” and on an “as available” basis. We may alter, suspend or discontinue the Website (or any part of it) at any time and without notice. We will not be liable to you in any way if the Website (or any part of it) is unavailable at any time and for any period.

Intellectual Property

All trademarks, copyright, database rights and other intellectual property rights in the content and materials included on the Website, such as text, graphics, logos, button icons, images, audio clips, digital downloads, data compilations (as well as the organization and lay out of the Website), and software are the property of Kelmer UK Ltd., its affiliates or its content suppliers and is protected by international trademark copyright and database laws and treaties around the world. All such rights are reserved.

This Website is for the your personal, non-commercial use and you may access, view and use it in a web browser (including any web browsing capability built into other types of software or app); download any part of it for caching; print, download or save pages for later and/or offline viewing.

You may not modify, copy, distribute, transmit, display, perform, reproduce, publish, license, create derivative works from, transfer, or sell any information, software, products or services obtained from this Website. You also agree not to create and/or publish your own database that features all or any part of this Website without our prior written express consent. Our status (and that of any identified content suppliers or third party links or pointers) as authors of the material on our Website must always be acknowledged.

Link to the Website

You may link to the Website or any page of the Website provided that:
- you do so in a fair and legal manner;
- you do not do so in a manner that suggests any form of association, endorsement or approval on our part where none exists;
- you do not use any logos or trademarks displayed on the Website without express written permission;
- you do not do so in a way that is calculated to damage our reputation or to take unfair advantage of it.

You agree not to link to the Website from any other site the main content of which contains material that:
- is sexually explicit;
- is obscene, deliberately offensive, hateful or otherwise inflammatory;
- promotes violence;
- promotes or assists in any form of unlawful activity;
- discriminates against, or is in any way defamatory of, any person, group or class of persons, race, sex, religion, nationality, disability, sexual orientation, or age;
- is designed or is otherwise likely to threaten, harass, annoy, alarm, inconvenience, upset, or embarrass another person;
- is calculated or is otherwise likely to deceive another person;
- is designed or is otherwise likely to infringe (or to threaten to infringe) another person’s privacy;
- misleadingly impersonates any person or otherwise misrepresents the identity or affiliation of a particular person in a way that is calculated to deceive (obvious parodies are not included in this definition provided that they do not fall within any of the other provisions);
- implies any form of affiliation with us where none exists;
- infringes, or assists in the infringement of, the intellectual property rights (including, but not limited to, copyright, trademarks and database rights) of any other party;
- is made in breach of any legal duty owed to a third party including, but not limited to, contractual duties and duties of confidence.

These content restrictions do not apply to content submitted to sites by other users. You are not, for example, prohibited from posting links on general-purpose social networking sites merely because another user may post such content.  You are, however, prohibited from posting links on websites which focus on or encourage the submission of such content from users.

Links to other website

This Website may contain links and pointers to Internet sites maintained by third parties. We do not operate or control in any respect any information, products or services on such third-party sites. Third party links and pointers are included solely for your convenience, and do not constitute any endorsement by us. You assume sole responsibility for use of third party links and pointers.


The content on the Website does not constitute advice on which you should rely. It is provided for general information purposes only. Professional or specialist advice should always be sought before taking any action relating to business consultancy.

We make no representation, warranty, or guarantee that the Website will meet your requirements, that it will not infringe the rights of third parties, that it will be compatible with all software and hardware, or that it will be secure. We make reasonable efforts to ensure that the content on the Website is complete, accurate, and up-to-date. We do not, however, make any representations, warranties or guarantees (whether express or implied) that the content is complete, accurate, or up-to-date.


To the fullest extent permissible by law, we accept no liability to any user for any loss or damage, whether foreseeable or otherwise, in contract, tort (including negligence), for breach of statutory duty, or otherwise, arising out of or in connection with the use of (or inability to use) the Website or the use of or reliance upon any content included on the Website.

To the fullest extent permissible by law, we exclude all representations, warranties, and guarantees (whether express or implied) that may apply to the Website or any of its content.

The Website is intended for non-commercial use only. If you are a commercial user, we accept no liability for loss of profits, sales, business or revenue; loss of business opportunity, goodwill or reputation; loss of anticipated savings; business interruption; or for any indirect or consequential loss or damage.

We exercise all reasonable skill and care to ensure that the Website is free from viruses and other malware. We accept no liability for any loss or damage resulting from a virus or other malware, a distributed denial of service attack, or other harmful material or event that may adversely affect your hardware, software, data or other material that occurs as a result of your use of the Website (including the downloading of any content from it) or any other site referred to on the Website.

We neither assume nor accept responsibility or liability arising out of any disruption or non-availability of the Website resulting from external causes including, but not limited to, ISP equipment failure, host equipment failure, communications network failure, natural events, acts of war, or legal restrictions and censorship.

Viruses, Malware and Security

We exercise all reasonable skill and care to ensure that the Website is secure and free from viruses and other malware.

You are responsible for protecting your hardware, software, data and other material from viruses, malware, and other internet security risks.
You must not deliberately introduce viruses or other malware, or any other material which is malicious or technologically harmful either to or via the Website.
You must not attempt to gain unauthorised access to any part of the Website, the server on which the Website is stored, or any other server, computer, or database connected to the Website.
You must not attack the Website by means of a denial of service attack, a distributed denial of service attack, or by any other means.

Any and all such breaches will be reported to the relevant law enforcement authorities and we will cooperate fully with those authorities by disclosing your identity to them. Your right to use the Website will cease immediately in the event of such a breach.

Acceptable Using Policy

You may only use the Website in a manner that is lawful. Specifically:
- you must ensure that you comply fully with any and all local, national or international laws and/or regulations;
- you must not use the Website in any way, or for any purpose, that is unlawful or fraudulent;
- you must not use the Website to knowingly send, upload, or in any other way transmit data that contains any form of virus or other malware, or any other code designed to adversely affect computer hardware, software, or data of any kind;
- you must not use the website in any way, or for any purpose, that is intended to harm any person or persons in any way.

We reserve the right to suspend or terminate your access to the Website if you materially breach any provisions of these Terms and Conditions.  Specifically, we may take one or more of the following actions:
- suspend, whether temporarily or permanently, your right to access to the Website;
- issue you with a written warning;
- take legal proceedings against you for reimbursement of any and all relevant costs on an indemnity basis resulting from your breach;
- take further legal action against you as appropriate;
- disclose such information to law enforcement authorities as required or as we deem reasonably necessary;
- any other actions which we deem reasonably appropriate (and lawful).

We hereby exclude any and all liability arising out of any actions (including, but not limited to those set out above) that we may take in response to breaches of these Terms and Conditions.

Privacy and Cookies

Use of the Website is also governed by our privacy policies. These polices are incorporated into these Terms and Conditions (see “Data Protection”).

Contacting us

To contact us, please email us at or using any of the methods provided on the contact page at

Communications from us

If we have your contact details, we may from time to time send you important notices by email. Such notices may relate to matters including, but not limited to, interesting news about our services, content updates, service changes and changes to these Terms and Conditions.

We will never send you marketing emails of any kind without your express consent. If you do give such consent, you may opt out at any time. Any and all marketing emails sent by us include an unsubscribe link. If you opt out of receiving emails from us at any time, the cancellation is automatic and immediate.

For questions or complaints about communications from us (including, but not limited to marketing emails), please contact us at or via

Data Protection

We may use your personal information (name and email) to reply to any communications you send to us; send you important notices and periodical newsletters. We will not pass on your personal information to any third parties.

We will take all reasonable measures to insure your information will remain confidential and protected from unauthorized access. Despite those measures, we do not warrant unauthorized access to that information can never happen.

Law and Jurisdiction

These Terms and Conditions, and the relationship between you and us (whether contractual or otherwise) shall be governed by, and construed in accordance with, English law.

If you are a consumer, any disputes concerning these Terms and Conditions, the relationship between you and us, or any matters arising therefrom or associated therewith (whether contractual or otherwise) shall be subject to the jurisdiction of the courts of England, Wales, Scotland, or Northern Ireland, as determined by your residency.

If you are a business, any disputes concerning these Terms and Conditions, the relationship between you and us, or any matters arising therefrom or associated therewith (whether contractual or otherwise) shall be subject to the exclusive jurisdiction of the courts of England and Wales.

KELMER GROUP’s privacy policy (GDPR version)


Welcome to the KELMER GROUP’s privacy notice.

Kelmer Group respects your privacy and is committed to protecting your personal data. This privacy notice will inform you as to how we look after your personal data when you visit our website (regardless of where you visit it from) and tell you about your privacy rights and how the law protects you.

This privacy notice is provided in a layered format so you can click through to the specific areas set out below. Alternatively you can download a pdf version of the policy here

Please also use the Glossary to understand the meaning of some of the terms used in this privacy notice.



Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.


  • Service providers acting as processors based in the United Kingdom who provide IT and system administration services, including billing.
  • Professional advisers acting as processors or joint controllers including lawyers, bankers, auditors, agents and insurers based in the United Kingdom or abroad.
  • Professional advisers acting as legal representatives of counterparties.
  • HM Revenue & Customs, regulators and other authorities and agencies acting as processors or joint controllers based in the United Kingdom or abroad who require reporting of processing activities in certain circumstances.


You have the right to:

Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms. 

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

Data Processing Terms of Business for Suppliers


In order that you as a service provider and data processor (referred to as “Processor” or “you” or “your”) may provide or continue to provide certain services (the “Services”) to us, the Business and data controller (referred to as “the Business” or “we”, “us” or “our”), you have agreed that these data processing terms (“Terms”) shall apply (notwithstanding any other terms and conditions applicable to the delivery of the Services to the contrary) in order to address the compliance obligations imposed upon the Business and its Clients pursuant to the Data Protection Law. These Terms shall constitute a separate agreement or they may be incorporated by reference in the relevant Services agreement, as the case may be.



SCHEDULE: Security measures

Processor shall put in place the following measures, as applicable.

Minimum technical measures

  • Firewalls which are properly configured and using the latest software;
  • user access control management;
  • unique passwords of sufficient complexity and regular expiry on all devices;
  • secure configuration on all devices;
  • regular software updates, if appropriate, by using patch management software;
  • timely decommissioning and secure wiping (that renders data unrecoverable) of old software and hardware;
  • real-time protection anti-virus, anti-malware and anti-spyware software;
  • https;
  • encryption of all portable devices ensuring appropriate protection of the key;
  • encryption of personal data in transit by using suitable encryption solutions;
  • multi-factor authentication for remote access;
  • WPA-TKIP secured WiFi access;
  • delinquent web filtering and other appropriate internet access restrictions;
  • intrusion detection and prevention systems;
  • appropriate and proportionate monitoring of personnel; and
  • data backup and disaster recovery measures and procedures.

Minimal organisational measures

  • Vet all personnel including staff, contractors, vendors and suppliers (including Subprocessors) on continuous basis;
  • non-disclosure agreements used with all personnel;
  • regular training of all personnel on confidentiality, data processing obligations, identification of Security Breaches and risks;
  • apply principle of least authority, including a restricted or strictly controlled transit of data and material outside of office;
  • physical security on premises including reception or front desk, security passes, clean desk policy, storage of documents in secure cabinets, secure disposal of materials, CCTV, etc.;
  • apply appropriate policies including Information Security Policy, Data Protection Policy, BYOD, Acceptable Use Policy; limited and monitored personal use of work resources, as appropriate.