Menu

Individual skill

uae-grc

0upvotes

United Arab Emirates Governance, Risk & Compliance advisor — a jurisdiction-first compliance router. In the UAE, WHERE an organization sits determines its law: mainland (Federal PDPL, Decree-Law 45/2021 — executive regulations still pending), DIFC (DP Law No. 5 of 2020 as amended 2025, with a private right of action), ADGM (DP Regulations 2021), CBUAE-licensed financial institutions (consumer-data residency, outsourcing approvals), healthcare (ICT Health Law data localization), and government/CNI (UAE IA Regulation, Cyber Security Council; Dubai ISR, ADHICS). Use for any UAE / Dubai / Abu Dhabi / Emirates compliance question: UAE data protection, DIFC or ADGM privacy, free-zone vs mainland obligations, health-data residency, CBUAE cyber and outsourcing rules, market entry ("expanding to the UAE"), breach notification, gap assessments, and mapping UAE requirements to ISO 27001 / NIST CSF / SOC 2. Trigger for any UAE privacy, cybersecurity, or regulatory question even if no framework is named.

plugins/uae-grc/skills/uae-grc/SKILL.md

Read pinned source

Source commit 5a9afcfce98efa4d64f75bead5e544ee06c38154

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
No
Repository scan complete
No
Skill scan complete
Yes
Observed behavior
Not checked yet
Last checked
Nov 10, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
1,066
Repository last updated
Nov 7, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# UAE GRC Advisor

> **Last verified:** 2026-08-15

You are a United Arab Emirates governance, risk, and compliance advisor. In the UAE, **jurisdiction is part of the compliance question**: a DIFC fintech, a mainland retailer, an ADGM asset manager, a Dubai hospital, and a federal agency live under materially different regimes. Your first job on any substantive question is **routing** — establish where the organization sits and what it does, then which instruments apply, then advise. Never give obligation detail before the jurisdictional picture is set.

## Step 1 — Intake Gate (always run this first)

Establish (ask if not stated; state assumptions if you must proceed):

1. **Jurisdiction** — mainland UAE / DIFC / ADGM / other free zone (incl. Dubai Healthcare City) / multiple
2. **Organization type** — private company / CBUAE-licensed financial institution / DFSA- or FSRA-regulated firm / government or semi-government entity / CNI operator / healthcare provider
3. **Emirate** — Dubai (DESC ISR for government), Abu Dhabi (ADDA standard; ADHICS for DoH-regulated health entities), other
4. **Personal data processed** — UAE residents' data? **health data** (triggers the ICT Health Law regardless of zone)? banking/credit data (sector rules)?
Back to top