The DIFC Data Protection Law, DIFC Law No. 5 of 2020, has applied to companies in the Dubai International Financial Centre since 1 July 2020, with enforcement from 1 October 2020. Administrative fines are reported at up to USD 100,000 per contravention, and failing to renew a processing notification is the most common fine. This guide covers what DIFC entities must do.
Who the DIFC law covers
The DIFC Data Protection Law applies to controllers and processors in the Dubai International Financial Centre. It is a GDPR-style regime, separate from the UAE federal PDPL, which does not apply inside the DIFC. The regulator is the DIFC Commissioner of Data Protection.
The law came into force on 1 July 2020 under Article 4, with a grace period that ended on 1 October 2020. Amended Data Protection Regulations, including Regulation 10 on autonomous and semi-autonomous systems, took effect on 1 September 2023.
Registration and notification
Under Article 14(7), controllers and processors register with the Commissioner by filing a notification of processing operations and must keep it current. Failure to renew this notification is reported as the most common reason for fines in the DIFC, so put the renewal date in your compliance calendar. Article 15 requires a written record of processing activities covering purposes, data categories, recipients, transfers and retention. Article 20 requires a data protection impact assessment before high-risk processing, and Articles 16 to 18 require a DPO in defined cases.
Lawful bases and notices
Unlike onshore UAE, the DIFC law includes legitimate interests among its lawful bases. Article 29 requires notices to state the lawful basis for each purpose, and Articles 29 and 30 set what a notice must contain, including the controller's identity, purposes, recipients, retention and rights. Where consent is used, Articles 12(5) and 32 let individuals withdraw it at any time. Article 11 adds conditions for special categories of personal data such as health, biometric, genetic, religious or criminal data.
Data subject rights by article
The DIFC law gives a full set of rights. The table maps each to its article so your request process can cite the right provision. Templates for replies should quote the article, the deadline where one applies and the route to complain, so that staff handling requests give consistent answers.
| Right | DIFC Law article | Note |
|---|---|---|
| Access and copy | Article 33(1) | Free, within one month |
| Correction and erasure | Article 33(2) | Correct inaccurate data, erase where grounds apply |
| Objection | Article 34 | Object to certain processing |
| Restriction | Article 35 | Restrict processing in defined cases |
| Portability | Article 37 | Structured, machine-readable format |
| Automated decisions | Article 38 | Object and request human review |
| Withdraw consent | Articles 12(5) and 32 | At any time |
Breach notification under Article 41
A controller must notify the Commissioner as soon as practicable in the circumstances after a breach that compromises the confidentiality, security or privacy of personal data (Article 41(1)). Processors must notify controllers without undue delay (Article 41(2)), and Article 41(4) lists the content a notice must contain. Affected data subjects must be told in certain cases.
The DIFC uses a flexible standard rather than a fixed hour count. By comparison, the ADGM regulations in Abu Dhabi set a 72-hour deadline. Groups with entities in both free zones often adopt 72 hours internally so one playbook works for both.
Regulation 10: AI and autonomous systems
Regulation 10 applies where AI or other autonomous systems process personal data. A clear notice must be given on first use describing the system's purposes, principles, safeguards and any relevant certifications. High-risk commercial use also needs an autonomous systems officer and must follow any certification requirements set by the Commissioner. Firms deploying chatbots, scoring models or AI agents in the DIFC should review their notices against this regulation.
Transfers, processors and fines
Articles 26 and 27 allow transfers out of the DIFC based on an adequacy decision, appropriate safeguards such as standard contractual clauses, or specific derogations. Article 24 requires a written agreement with processors and prior authorisation for sub-processors. Article 22 requires data to be deleted, anonymised or archived when the basis for holding it ends.
Schedule 2 lists administrative fines, reported at up to USD 100,000 per contravention. General fines for serious contraventions are currently uncapped, and data subjects can claim compensation in the DIFC Courts. XDQ xAgents (https://xagents.xdqlabs.com) can review a DIFC privacy notice for missing Article 29 items and Regulation 10 wording. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Frequently asked questions
Does the DIFC follow the UAE PDPL?
No. The DIFC has its own law, DIFC Law No. 5 of 2020, enforced by the DIFC Commissioner of Data Protection. The federal PDPL excludes the DIFC and ADGM free zones, so DIFC entities follow the DIFC law and its regulations.
How quickly must a DIFC company report a data breach?
As soon as practicable in the circumstances, under Article 41(1). Processors must tell the controller without undue delay under Article 41(2). Affected data subjects must also be informed in certain cases, and Article 41(4) lists what the notice must include.
What is the most common DIFC data protection fine?
Failure to renew the notification of processing operations filed with the Commissioner under Article 14(7) is reported as the most common fine. Schedule 2 fines are reported at up to USD 100,000 per contravention, and fines for serious contraventions are uncapped.
Does the DIFC regulate AI use of personal data?
Yes. Regulation 10, effective 1 September 2023, requires a clear notice on first use of AI or autonomous systems processing personal data, and an autonomous systems officer for high-risk commercial use. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Sources
- DIFC Data Protection Law No. 5 of 2020 (official text, government.ae), UAE Government Portal (government.ae), 2020
- CMS: DIFC Data Protection Law, CMS
- Baker McKenzie: DIFC regulators, enforcement priorities and penalties, Baker McKenzie
- Clyde & Co: DIFC enacts regulation for autonomous and semi-autonomous systems, Clyde & Co, 2023
- Bird & Bird: UAE Federal Decree-Law on Personal Data Protection compared with GDPR, Bird & Bird, 2021
- Taylor Wessing: New ADGM data protection law, key changes, Taylor Wessing, 2021
