This Data Protection Policy outlines the commitment of Air Traffic World Aviation Training Services (ATWATS), an aviation training company based in Dubai, UAE, to protect personal data. This policy ensures compliance with the UAE Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data (PDPL) and the UK General Data Protection Regulation (UK GDPR), particularly considering the requirements for Continuous Professional Development (CPD) certification and international data transfers.
1. Scope and Applicability
This policy applies to all personal data processed by ATWATS, including data relating to:
- Trainees, students, and applicants.
- Employees, contractors, and job applicants.
- Suppliers, vendors, and business contacts.
- Any individual whose personal data ATWATS processes in its operations.
The processing includes collecting, recording, storing, using, disclosing, transferring, or deleting personal data in both manual and electronic formats.
2. Key Data Protection Principles
| Principle | Description |
|---|---|
| Lawfulness, Fairness, and Transparency | Personal data is processed lawfully, fairly, and transparently, with a clear legal basis. |
| Purpose Limitation | Data is collected for specified, explicit, and legitimate purposes. |
| Data Minimisation | Data collected is adequate, relevant, and limited to what is necessary. |
| Accuracy | Personal data is accurate and kept up to date. |
| Storage Limitation | Personal data is kept no longer than necessary. |
| Integrity and Confidentiality | Appropriate security via technical and organisational measures. |
| Accountability | ATWATS, as Data Controller, is responsible for and demonstrates compliance. |
3. Lawful Basis for Processing
- Consent: Clear, unambiguous, and informed consent for specific purposes.
- Contractual Necessity: Performance of a contract such as course enrolment.
- Legal Obligation: Compliance with GCAA or international aviation regulations.
- Legitimate Interests: Where not overridden by data subject rights.
4. Individual Rights (Data Subject Rights)
- Right to Information
- Right of Access (SAR)
- Right to Rectification
- Right to Erasure (Right to be Forgotten)
- Right to Restrict or Stop Processing
- Right to Data Portability
- Right to Object
- Rights related to Automated Decision Making and Profiling
All formal requests to exercise these rights must be submitted in writing to ATWATS.
5. Cross-Border Data Transfer Requirements
Transfers from the UAE: Permitted only where the recipient country ensures an adequate level of protection or a specified exception applies, with appropriate safeguards.
Transfers to the UK/EEA: Subject to the above requirements.
Transfers from the UK/EEA: Compliant mechanisms such as adequacy decisions, Standard Contractual Clauses (SCCs), or the UK International Data Transfer Agreement (IDTA).
6. Security and Technical/Organisational Measures
- Confidentiality: Access strictly controlled and limited to authorised staff.
- Encryption and Pseudonymisation: Sensitive data is secured using encryption.
- Access Control: Strong passwords, MFA, and role-based access controls are mandatory.
- Physical Security: Hard copy records secured in locked, access-controlled premises.
- Business Continuity: Regular backups and a Disaster Recovery Plan.
7. Data Breach Management and Notification
- The DPO is notified immediately.
- Breaches are investigated promptly and contained.
- Regulatory authorities are notified within 72 hours where required.
- Affected data subjects are notified where there is high risk to rights and freedoms.
8. Data Protection Officer (DPO)
ATWATS has appointed a Data Protection Officer to oversee compliance.
Email: cco@atw-aviation.com
- Monitoring compliance and advising management and employees.
- Acting as a contact point for supervisory authorities and data subjects.
- Maintaining the Record of Processing.
9. Training and Awareness
All ATWATS personnel who process personal data receive mandatory data protection training as part of their CPD requirements, refreshed annually.
10. Policy Review
This policy is reviewed and updated at least annually, or more frequently if significant legal or operational changes occur.