TRW & Co · Data, Privacy & Cyber
DIFC Data Protection
DIFC data protection is governed by DIFC Law No. 5 of 2020 and its Regulations, supervised by the DIFC Commissioner of Data Protection. Amendments in force since 15 July 2025 widened who is caught and let individuals sue directly in the DIFC Courts, while Regulation 10 sets rules for personal data processed by AI systems.
Key pointSince 15 July 2025, any company processing personal data in the DIFC under a contract, even a one-off one, can fall within DIFC data protection, and affected individuals can sue directly in the DIFC Courts, so vendors and processors now carry real litigation risk.
At a glance
DIFC Law No. 5
The DIFC Data Protection Law came into force on 1 July 2020 and is supervised by the DIFC Commissioner of Data Protection, separately from the federal regime.
2025 amendments in force
Amendments effective 15 July 2025 clarified the stable arrangement scope test, created a direct right to sue in the DIFC Courts and raised several fines.
Higher accountability fines
Failing to carry out a required impact assessment, or breaching the public authority data-sharing rules, now attracts a fine of USD 50,000.
AI rules in Regulation 10
Regulation 10 governs personal data processed by autonomous systems, with notice and oversight duties; a 2026 consultation proposed further refinements and certification recognition.
Regional mutual adequacy
Since January 2026, the DIFC, ADGM and the Qatar Financial Centre recognise each other as adequate, easing transfers between the three centres.
Swipe or scroll →
What DIFC data protection covers
DIFC data protection is the regime governing personal data processed by businesses in, or dealing with, the Dubai International Financial Centre. Its foundation is DIFC Law No. 5 of 2020, which came into force on 1 July 2020, together with the Data Protection Regulations issued under it, and it is supervised by the DIFC Commissioner of Data Protection.
It matters to banks, insurers, asset managers, law and accounting firms, fintechs, family offices, retailers and restaurants in the centre, and to their suppliers. Since amendments in force from 15 July 2025, it also matters more to businesses outside the DIFC whose arrangements involve processing personal data inside it.
The regime has three features that set it apart in the UAE: an extraterritorial scope built around "stable arrangements", a private right of action in the DIFC Courts, and detailed rules for personal data processed by AI and other autonomous systems. Each affects how contracts, products and incident plans should be designed.
The legal framework for DIFC data protection
The Law, the Regulations and the Commissioner
The 2020 Law sets out principles, lawful bases, rights, accountability, breach notification, transfers and enforcement. The Data Protection Regulations add detail, including Regulation 10 on personal data processed through autonomous and semi-autonomous systems. The Commissioner issues guidance, receives notifications and breach reports, and can investigate and impose fines. Laws, regulations and guidance are published by the DIFC Authority.
The 2025 amendments
Amendments enacted on 8 July 2025 took effect on 15 July 2025. The scope provision in Article 6 was clarified: controllers and processors incorporated in the DIFC remain fully in scope, and those incorporated elsewhere are in scope where they process personal data in the DIFC as part of a stable arrangement. The words "other than on an occasional basis" were removed, so a one-off contract can be enough.
A proposed GDPR-style "targeting" test, covering anyone offering goods or services to or monitoring individuals in the DIFC, was not adopted. The amendments did, however, allow individuals to bring claims directly in the DIFC Courts, including for distress, without first going through the Commissioner. Processors now face direct liability for their own failings.
Fines were also revised. A new fine applies for failing to submit the data protection officer's annual assessment under Article 19, the fine for failing to carry out an impact assessment before high-risk processing under Article 20 rose to USD 50,000, and the fine for breaching the public authority data-sharing rules in Article 28 also rose to USD 50,000.
Relationship with other regimes
The federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, excludes free zones with their own data protection laws, so DIFC processing is governed by the DIFC regime. The UAE Government portal summarises how the regimes fit together. Many groups run DIFC, ADGM and onshore entities side by side; compare our pages on ADGM data protection and federal personal data protection. Firms regulated by the Dubai Financial Services Authority also have conduct, outsourcing and systems duties under the DIFC financial regulation framework.
| Feature | Position | What to do |
|---|---|---|
| Scope | DIFC-incorporated entities, plus others processing in the DIFC under a stable arrangement, even a one-off contract | Map vendors and counterparties that handle data in the DIFC |
| Private right of action | Individuals can sue directly in the DIFC Courts, including for distress | Treat complaints as potential litigation; preserve records |
| Processor liability | Processors are directly liable for their own failings | Review processor terms, indemnities and insurance |
| Public authority requests | Article 28 controls, with higher fines | Adopt a written request-handling procedure |
| Accountability fines | Article 19 annual assessment and Article 20 impact assessment fines | Diary DPO assessments; run impact assessments before launch |
| AI and autonomous systems | Regulation 10 notice, governance and certification duties | Inventory AI tools; assess whether an autonomous systems officer is needed |
Who is caught: the stable arrangement test in practice
For businesses outside the DIFC, the key question is whether they process personal data in the DIFC as part of a stable arrangement. DIFC guidance treats a stable arrangement as any legally binding or recognised agreement or relationship, and processing in the DIFC includes cases where the means or personnel used are located there.
A 2024 DIFC Courts decision involving the ride-hailing platform Careem and its use of pick-up and drop-off points in the DIFC illustrated how far this test can reach. The practical examples are broad: an onshore vendor collecting customer data at a DIFC location under a contract, a payroll provider processing data for DIFC employees, or an events company running a DIFC venue.
Transfers out of the DIFC made as part of such processing are also caught, wherever the recipient sits. That means an overseas group company receiving data collected in the DIFC must look at the DIFC rules on transfers and onward processing, not only its home law.
After July 2025, a single contract involving processing in the DIFC can bring a foreign or onshore company within DIFC data protection, and individuals no longer need the Commissioner's help to sue.
Core obligations under the DIFC regime
Principles, lawful bases and notices
Processing must be lawful, fair and transparent, limited to specified purposes, minimised, accurate, retained no longer than necessary and secure. Each activity needs a lawful basis, and special category data needs an additional condition. Privacy notices must explain purposes, recipients, transfers and rights.
Accountability, DPO and impact assessments
Controllers must keep records of processing and apply data protection by design and default. A data protection officer is required in specified cases, including for controllers and processors carrying out high-risk processing on a systematic or regular basis, and the officer must prepare an annual assessment for the Commissioner. Impact assessments are required before high-risk processing begins, and the 2025 fine increase shows the Commissioner treats them as a priority.
Rights requests
Individuals can ask for access to their data, rectification, erasure, restriction and portability, object to certain processing including direct marketing, and challenge some automated decisions. Requests must be answered within the statutory period, and a refusal or partial response should be reasoned and recorded. In the DIFC, employees in dispute often use access requests to obtain documents before litigation, so HR, IT and legal teams need a shared process for searching mailboxes and systems, reviewing third-party data and applying exemptions consistently.
Breach notification
A controller must notify the Commissioner as soon as practicable where a breach compromises a data subject's confidentiality, security or privacy, and inform affected individuals where the breach is likely to create a high risk to them. See data breach response in the UAE for a multi-regime playbook.
Requests from public authorities
Article 28 sets out the steps before disclosing personal data to a public authority, including assessing the request's validity and proportionality, limiting the data shared and, where practicable, obtaining written assurances that the authority will respect data subjects' rights. Firms receiving requests from regulators or police inside or outside the UAE need a documented procedure.
AI and autonomous systems: Regulation 10
Regulation 10 applies where personal data is processed through autonomous or semi-autonomous systems, including AI tools embedded in apps and websites. It requires clear notices to users about the system's purpose, the principles or frameworks it was built on and the safeguards in place, and it expects systems to be ethical, fair, transparent, secure and accountable. Where systems are used for high-risk processing, an autonomous systems officer with suitable expertise may be needed.
In 2026 the DIFC consulted on refinements, with the consultation closing on 18 July 2026. The proposals add "safety" as a design concept, broaden "principles" to "policy frameworks", address AI with a physical interface, refine the autonomous systems officer role and introduce a new Regulation 11 allowing the Commissioner to recognise accreditation and certification frameworks. Firms should track whether and when these are adopted, and connect them to their AI governance programme.
Transfers out of the DIFC
Transfers outside the DIFC need a lawful route. The DIFC recognises certain jurisdictions as adequate, and since January 2026 the DIFC, ADGM and the Qatar Financial Centre have recognised each other's regimes as adequate, as announced by the Qatar Financial Centre. Other destinations need appropriate safeguards, such as Commissioner-approved standard clauses or binding corporate rules, or a specific derogation such as informed consent or necessity for a contract.
Transfers to onshore UAE entities and to Saudi Arabia, India, Bangladesh or Singapore are transfers outside the DIFC. Sector rules can add restrictions, for example health data localisation or Central Bank data residency requirements for licensed institutions. Our page on cross-border data transfers in the UAE compares the regimes.
Because the private right of action now sits in the DIFC Courts, a data subject access request from a former employee or customer may be the first step in a claim. Respond fully and on time, preserve the search records, and take advice before refusing or redacting heavily.
Building a DIFC data protection programme, step by step
- Confirm scope. List DIFC entities and every outside party processing data in the DIFC under a contract or relationship, including group companies and vendors.
- Notify and register. Make and renew the required notifications to the Commissioner and keep records of processing current.
- Appoint and empower the DPO. Decide whether a DPO is required, appoint one with real authority, and diary the annual assessment.
- Assess high-risk processing. Run impact assessments before launching new products, monitoring, AI tools or large-scale special category processing.
- Fix contracts and transfers. Update processor and sub-processor terms for direct processor liability, and document transfer mechanisms for every flow.
- Prepare for incidents, requests and claims. Adopt breach, rights request and public authority request procedures, with litigation-aware record keeping.
- Review AI deployments. Inventory systems that process personal data, prepare Regulation 10 notices and assign oversight responsibility.
Documents and evidence to hold
- Commissioner notifications and records of processing activities.
- Privacy notices for clients, employees, website and app users, and Regulation 10 notices for AI systems.
- DPO appointment, annual assessments and impact assessments.
- Processor and joint controller agreements, and transfer mechanism records.
- Breach register, incident reports and notifications.
- Logs of rights requests and public authority requests, with decisions and assurances obtained.
- Security policies, retention schedules and training records.
- Vendor due diligence files showing where each provider hosts and supports DIFC data, and how sub-processor changes are approved.
Risks and common mistakes
Assuming an onshore vendor is outside the DIFC regime
After the 2025 amendments, an onshore or foreign company processing personal data in the DIFC under a contract can be within scope, even for a one-off engagement. Vendors that collect data at DIFC premises or process DIFC employees' data often assume only the federal law applies. Controllers should check vendor scope during procurement and ensure contracts reflect DIFC requirements, while vendors should map which contracts bring them within the DIFC regime and adjust notices, security and transfer arrangements for that data.
Underestimating litigation exposure
Individuals can now sue in the DIFC Courts without waiting for the Commissioner, and claims can include distress. A breach, an unlawful disclosure or a mishandled access request can therefore lead to direct claims, sometimes from several individuals at once. The DIFC Courts apply common-law procedures, including disclosure, so internal emails about the incident may be seen. Keep incident documentation factual, involve counsel early, and consider whether insurance covers data protection claims and defence costs.
Leaving processor contracts on old templates
Processor contracts drafted before July 2025 often allocate all regulatory risk to the controller and give processors broad limitation clauses. With direct processor liability, both sides need to revisit liability caps, indemnities, cooperation duties and insurance. Controllers should still check that mandatory processor terms are present, including instructions, confidentiality, security, sub-processing approval, assistance with rights and breaches, deletion or return of data, and audit rights. Our page on data-processing agreements covers the clauses.
Responding to a foreign authority without a procedure
Requests from regulators, tax authorities or police, particularly from outside the UAE, can arrive at short notice. Article 28 requires the firm to assess validity and proportionality, minimise what is shared and, where practicable, obtain written assurances. Handing over a full dataset on request, without a record of that assessment, risks a fine that rose to USD 50,000 in 2025 and complaints from affected individuals. A short written procedure with named decision-makers prevents this.
Deploying AI tools without Regulation 10 notices
Chatbots, document review tools and analytics platforms often process personal data through autonomous or semi-autonomous systems. Firms frequently switch them on without the user notices, impact assessments or oversight that Regulation 10 requires. The 2026 consultation shows the DIFC is refining rather than relaxing these duties. Inventory AI use, assess which tools process personal data, prepare notices, and assign responsibility for oversight even where an autonomous systems officer is not required.
Cross-border angle: groups in the UK, Bangladesh, India and the GCC
DIFC firms are often branches or subsidiaries of groups in London, Riyadh, Mumbai, Dhaka or Singapore. Group data hubs, shared service centres and global CRM systems mean data collected in the DIFC routinely travels abroad.
UK and EU groups will recognise much of the DIFC framework, but should check that their transfer tools and processor terms satisfy DIFC requirements and that DIFC-specific features, such as the private right of action and Regulation 10, are covered. Saudi Arabia's data protection law imposes its own transfer controls, so a DIFC-Riyadh data flow is regulated in both directions. Indian and Bangladeshi service centres should be engaged under contracts that set out security, sub-processing and audit rights in detail, because the local law at the receiving end may offer less protection.
Disputes about data with a DIFC element may be heard in the DIFC Courts; our page on DIFC Courts proceedings explains how they work.
How TRW & Co helps with DIFC data protection
We advise on compliance design, contracts, AI deployments, incidents and claims. Where representation before the DIFC Courts or other courts is required, we work alongside locally licensed advocates and registered practitioners.
Scope and gap review
We test which entities, vendors and contracts fall within the DIFC regime after the 2025 amendments and benchmark practice against the Law and Regulations.
Contracts and transfers
We update processor, joint controller and intra-group agreements for direct processor liability and document transfer mechanisms.
AI and Regulation 10
We prepare AI inventories, user notices and impact assessments, and advise on the autonomous systems officer role.
Incidents and claims
We coordinate breach response, Commissioner notifications and the defence of data subject claims in the DIFC Courts.
Authority requests
We design Article 28 procedures and advise on specific requests from UAE and foreign authorities.
Group programmes
We align DIFC compliance with group policies in the UK, Bangladesh, India and Singapore through TRW & Co's network.
Further reading: the DIFC Data Protection Law explained, the federal PDPL and all our practices.
Checklist for decision-makers
- Which entities and vendors fall within DIFC data protection, including through one-off contracts?
- Are Commissioner notifications, records of processing and the DPO's annual assessment up to date?
- Are impact assessments done before every high-risk launch?
- Do processor contracts reflect direct processor liability and mandatory terms?
- Is there a mechanism for every transfer, including to onshore UAE and group companies abroad?
- Is there a written procedure for public authority requests under Article 28?
- Are AI tools inventoried, with Regulation 10 notices and oversight assigned?
- Are breach and access request processes ready for possible DIFC Courts claims?
To discuss your position, contact TRW & Co at info@trw.co or +971 58 942 1012.
Frequently asked questions
01Does DIFC data protection apply to companies outside the DIFC?
It can. Since the 2025 amendments, the DIFC Data Protection Law applies to controllers and processors incorporated elsewhere if they process personal data in the DIFC as part of a stable arrangement, which can include a single contract. Processing in the DIFC covers cases where the means or personnel used are located there. A proposed broader targeting test was not adopted. Onshore vendors and foreign group companies should check whether their DIFC dealings bring them within scope.
02Can individuals sue us in the DIFC Courts?
Yes. Since 15 July 2025, individuals whose rights are infringed can bring claims directly in the DIFC Courts against controllers and processors, including for distress, without first making a complaint to the Commissioner. That makes breaches, unlawful disclosures and mishandled access requests potential litigation risks as well as regulatory ones. Keep good records, respond to complaints carefully and check whether your insurance covers data protection claims and defence costs.
03Do we need a data protection officer in the DIFC?
A data protection officer is required in specified cases, including where controllers or processors carry out high-risk processing on a systematic or regular basis, and for certain DIFC bodies. Where a DPO is appointed, the officer must prepare an annual assessment for the Commissioner, and failing to submit it now attracts a fine. Firms that are not required to appoint a DPO still need someone responsible for compliance, impact assessments, breach response and requests.
04How quickly must a DIFC breach be reported?
A controller must notify the DIFC Commissioner of Data Protection as soon as practicable in the circumstances where a breach compromises a data subject’s confidentiality, security or privacy. Affected individuals must be informed where the breach is likely to result in a high risk to them. Processors must notify their controllers without undue delay. Because individuals can now sue in the DIFC Courts, document the response carefully and take advice before external statements.
05Can we transfer DIFC data to our onshore Dubai office or abroad?
Yes, with a lawful transfer mechanism. Since January 2026, transfers between the DIFC, ADGM and the Qatar Financial Centre benefit from mutual adequacy. Transfers to onshore UAE, Saudi Arabia, India, Bangladesh or other destinations need adequacy for that jurisdiction, appropriate safeguards such as Commissioner-approved standard clauses or binding corporate rules, or a specific derogation. Check sector rules too, as health and some financial data face localisation requirements.
06What does Regulation 10 require for AI tools?
Where personal data is processed through autonomous or semi-autonomous systems, Regulation 10 requires clear notices to users explaining the system’s purpose, the frameworks it was built on and the safeguards in place, and expects systems to be ethical, fair, transparent, secure and accountable. High-risk uses may require an autonomous systems officer. A 2026 consultation proposed refinements, including safety as a design concept and recognition of external certification frameworks, so check the current text before launch.
07Can TRW & Co appear for us before the DIFC Courts?
We advise on compliance strategy, contracts, AI deployments, incidents and claims, and we coordinate responses to the Commissioner. We do not claim rights of audience before the DIFC Courts. Where representation is required, we work alongside locally licensed advocates and registered practitioners so that the client has one coordinated team. Contact us at info@trw.co or +971 58 942 1012 to discuss a review, a breach or a claim.
Sources and official materials
- Dubai International Financial Centre — DIFC Data Protection Law, Regulations and Commissioner guidance
- DIFC Courts — Forum for data protection claims
- QFC, ADGM and DIFC reciprocal adequacy recognition — Mutual adequacy announcement, 2026
- UAE Government portal: Data protection laws — Federal and free zone data protection overview
- Federal Decree-Law No. 45 of 2021 on Personal Data Protection — Federal law and its free zone exclusion
- Dubai Financial Services Authority — Conduct and outsourcing rules for DIFC firms
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
