TRW & Co · Data protection and AI
DIFC Data Protection Law: Key Obligations in 2026
The DIFC data protection law, DIFC Law No. 5 of 2020, governs personal data processed by DIFC entities and in the Centre. It requires lawful bases, records, impact assessments and often a DPO, and since July 2025 individuals can sue directly in the DIFC Courts. This guide covers the core duties, the 2025 amendments and Regulation 10 on AI systems.
Key pointThe 2025 private right of action turns compliance records into litigation evidence: DPIAs, transfer assessments and access-request logs are now what a claimant's lawyer will ask to see first.
At a glance
Instrument and regulator
DIFC Law No. 5 of 2020 and the Data Protection Regulations apply, enforced by the DIFC Commissioner with appeals and private claims before the DIFC Courts.
Private claims since 2025
DIFC Amendment Law No. 1 of 2025 lets individuals sue for breaches in the DIFC Courts, including for non-financial harm such as distress.
Wider territorial reach
The Law covers DIFC-incorporated entities wherever they process data, and processing in the DIFC by others under stable arrangements.
Regulation 10 on AI
Deployers and operators of autonomous systems must give notices, keep a register, ensure human oversight and meet conditions before any high-risk processing.
Onshore is abroad
Transfers from a DIFC entity to mainland UAE affiliates or vendors are international transfers needing an adequacy finding, safeguards or a derogation.
Swipe or scroll →
The short answer: what the DIFC data protection law requires
The DIFC data protection law is DIFC Law No. 5 of 2020, supported by the DIFC Data Protection Regulations and enforced by the DIFC's data protection Commissioner. It applies to entities incorporated in the Dubai International Financial Centre and to processing carried out in the Centre, and it operates in place of the federal Personal Data Protection Law for that processing.
In practice it is the most mature privacy regime in the UAE. Controllers need a lawful basis for each processing purpose, transparent notices, records of processing, security measures and breach response plans. Many must appoint a Data Protection Officer, carry out impact assessments for high-risk processing and keep their registration with the Commissioner current.
Two developments make 2026 a year to revisit compliance. Amendments that took effect in July 2025 added a direct right for individuals to sue in the DIFC Courts and widened the law's reach. And Regulation 10, the DIFC's rule on personal data processed through autonomous and semi-autonomous systems, is moving towards a certification model. This guide, current as of October 2026, explains both and shows how to build a programme that stands up to scrutiny.
The legal framework: law, regulations and the Commissioner
The UAE Government portal lists the DIFC Data Protection Law, DIFC Law No. 5 of 2020, alongside the federal regime. It replaced an earlier DIFC law and was drafted with the EU General Data Protection Regulation and other international standards in mind, which is why multinational groups often find it familiar.
The structure has three layers. The Law sets principles, lawful bases, rights, transfer rules, enforcement and liability. The Data Protection Regulations add procedural detail, including the Commissioner's notification and fee arrangements, the adequacy list and, since 2023, Regulation 10 on autonomous systems. Guidance and template documents issued by the Commissioner's office fill in practice points such as standard contractual clauses and impact assessment methodology.
The Commissioner investigates complaints, issues directions and imposes administrative fines. Appeals and, since 2025, private claims go to the DIFC Courts. Firms regulated by the DFSA also face financial-services expectations on outsourcing, record-keeping and operational resilience that overlap with data protection; our DIFC financial regulation page covers that interface.
Who the DIFC data protection law applies to
The Law applies to controllers and processors incorporated in the DIFC, whether or not the processing takes place in the Centre, and to processing in the DIFC by controllers or processors not incorporated there where it occurs as part of stable arrangements. The 2025 amendments clarified this territorial reach.
The federal PDPL and the DIFC regime are designed not to overlap for the same processing, but groups with onshore affiliates will usually run both. If your group also has an ADGM entity, the ADGM Data Protection Regulations add a third framework.
Core obligations under the DIFC data protection law
The obligations below apply to most DIFC controllers. Processors carry a narrower but still significant set, especially on security, sub-processing and breach notice.
Lawful basis and purpose
Each processing purpose needs a lawful basis, such as consent, contract, legal obligation or legitimate interests. Purposes must be specified at collection and further processing must be compatible with them.
Transparency
Data subjects must receive clear information about the controller, purposes, recipients, transfers, retention and rights. Notices should be layered and kept consistent with what systems actually do.
Accountability records
Controllers keep written records of processing activities and must be able to show compliance. The Commissioner can ask for these records during an inquiry.
DPO and annual assessment
A Data Protection Officer is mandatory for DIFC bodies and for controllers or processors carrying out high-risk processing systematically or regularly. The DPO prepares an annual assessment that, since 2025, is submitted to the Commissioner.
Impact assessments
High-risk processing, including large-scale special category data, new technologies and systematic monitoring, requires a data protection impact assessment before it starts.
Security and breach response
Appropriate technical and organisational measures are required. Personal data breaches that risk individuals' rights must be notified to the Commissioner promptly, and high-risk breaches to affected individuals.
Data subject rights follow the familiar model: access, rectification, erasure, objection, restriction, portability and protection against solely automated decisions with significant effects. Response deadlines are short, so a documented intake process matters. For contract drafting with processors and sub-processors, see our data processing agreements practice.
Marketing, employee data and special categories
Three areas generate a disproportionate share of DIFC complaints and questions. Direct marketing needs a clear lawful basis and an easy opt-out; firms relying on consent should be able to show when and how it was given. Employee data, including monitoring of devices and communications, should be covered by a specific staff notice and a proportionality assessment rather than a generic clause in the employment contract.
Special category data, such as health, biometric or criminal records information, requires an additional condition under the DIFC data protection law and usually a DPIA. Know-your-customer files, background checks and wellness programmes are common examples. Keeping these datasets segregated, with tighter access controls and shorter retention, reduces both breach impact and litigation exposure.
The 2025 amendments: private claims, scope and public authorities
DIFC Amendment Law No. 1 of 2025 took effect in mid-July 2025 and changed the DIFC data protection law in four ways that matter in practice.
- Private right of action. Individuals can now bring claims for breach directly in the DIFC Courts, in addition to complaining to the Commissioner. Compensation can cover non-financial harm such as distress, not only financial loss.
- Territorial scope. The Law expressly reaches processing by DIFC-incorporated entities wherever it takes place, and processing in the DIFC under stable arrangements by entities incorporated elsewhere.
- Requests from public authorities. The provision on sharing data with public authorities was reworked. Controllers and processors must verify that a request is valid and proportionate before disclosing or transferring data, rather than obtaining assurances that the authority will respect data subject rights.
- Higher penalties. Maximum fines for specific failures, including the annual assessment, impact assessments and disclosures to authorities, were increased.
The private right of action is the change with the most commercial impact. Litigation risk now attaches to everyday failures such as an unlawful marketing campaign, a mishandled access request or a careless data-sharing arrangement. Records that show reasoned decisions are the best defence.
Treat your DPIAs, transfer assessments and access-request logs as potential court exhibits. Since July 2025 an individual can sue in the DIFC Courts, and a claimant's lawyer will ask for exactly these documents. Contemporaneous, reasoned records are far more persuasive than policies written after a complaint arrives.
Regulation 10: AI and autonomous systems in the DIFC
Regulation 10 was introduced in late 2023 and deals with personal data processed through autonomous and semi-autonomous systems, which in practice covers most AI and machine-learning deployments. It distinguishes between a deployer, the person under whose authority the system operates or who benefits from its output, treated broadly like a controller, and an operator that runs the system on the deployer's behalf, treated broadly like a processor.
The key obligations are a clear notice at first use describing the system's purposes, outputs and design principles; processing only for human-defined or human-approved purposes; mechanisms that trigger human intervention where processing may be unfair or discriminatory; and a register of use cases and processing activities. High-risk processing through such systems is restricted unless conditions are met, including audit and certification requirements or the appointment of an Autonomous Systems Officer.
Commentators expect the Commissioner to publish general certification requirements during 2026, favouring certification over licensing. AI teams in the DIFC should therefore build Regulation 10 documentation now. Our article on AI regulation in the UAE sets this alongside federal and sector AI rules.
Building a DIFC data protection law programme, step by step
- Confirm scope and registration. List each DIFC entity, confirm which processing it performs as controller or processor, and check that its notification to the Commissioner is complete and current.
- Map processing and lawful bases. Build a record of processing activities with purposes, lawful bases, categories of data, recipients, transfers and retention periods.
- Appoint or assess the DPO. Decide whether a DPO is mandatory; if so, appoint one with adequate independence and resources, and plan the annual assessment.
- Run impact assessments. Complete DPIAs for high-risk processing and Regulation 10 assessments for AI systems before launch, and re-run them on material change.
- Fix contracts and transfers. Update processor terms, intra-group agreements and transfer tools, including for transfers to mainland UAE affiliates.
- Operationalise rights and breaches. Set up a request intake process, response templates, a breach playbook and a log the DPO reviews regularly.
- Train and test. Train front-line teams, test the breach plan with a tabletop exercise and audit a sample of vendors each year.
DIFC, ADGM and the federal PDPL compared
| Issue | DIFC | ADGM | Federal PDPL |
|---|---|---|---|
| Main instrument | DIFC Law No. 5 of 2020 and Data Protection Regulations | ADGM Data Protection Regulations 2021 | Federal Decree-Law No. 45 of 2021 |
| Regulator | DIFC Commissioner | ADGM Office of Data Protection | Federal authority (UAE Data Office functions moved to the new AI and Data Authority in 2026) |
| Implementing detail | Regulations and guidance in force | Guidance and templates in force | Executive Regulations not yet issued |
| Individual court claims | Express private right of action since 2025 | Compensation claims available | Primarily complaint-based |
| AI-specific rules | Regulation 10 on autonomous systems | General principles and guidance | No dedicated PDPL AI rule |
| Transfers | Adequacy list, standard clauses, BCRs | Adequacy, ADGM clauses or addendum, BCRs | Adequacy or Article 23 routes |
For transfers between these regimes, see our guide to cross-border transfers and data localisation in the UAE. The ADGM and DIFC websites host each centre's current legislation.
Illustrative scenario: an asset manager adopting an AI tool
This scenario is illustrative and does not describe any real client. A DFSA-authorised asset manager in the DIFC wants to use an AI tool that summarises client calls and flags suitability concerns. The tool is supplied by a US vendor and hosted in Europe, and the firm's back office in mainland Dubai will review the flags.
Under the DIFC data protection law, the firm is the deployer under Regulation 10 and the controller for the call data; the vendor is the operator and processor. The firm updates its client notice to explain the system's purposes and outputs, confirms that suitability decisions remain with human advisers, and records the tool in its Regulation 10 register.
Because call recordings and suitability notes can reveal financial circumstances and sometimes health information, the DPO concludes that the processing is high risk and runs a DPIA. The firm puts processor terms in place covering security, sub-processors and deletion, uses standard clauses for the transfer to the US vendor, and documents a separate transfer route for the mainland back office, since onshore UAE is not on the DIFC adequacy list. Under the 2025 amendments the DPIA and notice are also the firm's first line of defence if a client later sues.
Common mistakes and risks
Assuming PDPL compliance covers the DIFC entity
Groups sometimes run a federal PDPL programme and assume it covers their DIFC subsidiary. It does not. The DIFC data protection law has its own lawful bases, registration, DPO, DPIA and transfer rules, and its regulator and courts are different. Map the DIFC entity separately, then align policies where the regimes overlap to avoid duplicated effort.
Forgetting that onshore UAE is a transfer destination
Sharing client data with a mainland affiliate, a Dubai call centre or an onshore IT vendor is an international transfer under DIFC rules. Without a lawful route, such as standard contractual clauses or a valid derogation, the flow is non-compliant even though it never leaves the country. Intra-group agreements should address this expressly.
Letting the Commissioner notification lapse
DIFC controllers must keep their notification with the Commissioner accurate and renewed. A lapsed or outdated notification is an easy finding for the regulator and undermines credibility in any wider inquiry. Assign ownership to the DPO or compliance team and diarise renewals alongside licence renewals.
Deploying AI without Regulation 10 paperwork
Teams often adopt AI tools through procurement or a free trial without a notice update, a register entry or a risk assessment. Under Regulation 10 that leaves the firm unable to show human-defined purposes or oversight. Route every AI tool that touches personal data through a short intake form owned by the DPO.
Handling authority requests informally
The 2025 amendments require firms to verify that a request from a public authority is valid and proportionate before disclosing data. Ad hoc responses by relationship managers create risk. Centralise requests, record the verification steps and limit disclosure to what the request properly covers.
What to do next
For most DIFC firms, the priority list for the coming year is short: refresh the record of processing, confirm the DPO position and annual assessment, update notices and processor terms, register AI use cases under Regulation 10, and test the breach plan. Groups should also watch the new federal Artificial Intelligence and Data Authority, announced by the UAE Cabinet in June 2026, for PDPL developments affecting onshore affiliates.
TRW & Co advises on DIFC data protection law programmes, AI governance and data transfers, coordinating with our privacy-by-design and AI governance teams. Where a dispute reaches the DIFC Courts, we work alongside registered practitioners. Contact us at info@trw.co or +971 58 942 1012.
Frequently asked questions
01Does the federal PDPL apply to companies in the DIFC?
For processing governed by the DIFC regime, no. The DIFC has its own data protection law, DIFC Law No. 5 of 2020, with its own regulator, and the federal PDPL is not designed to apply on top of it for the same processing. Groups with both DIFC and mainland entities will usually need to comply with both regimes, each for its own entity, and to document transfers between them, because the DIFC treats onshore UAE as a separate jurisdiction.
02When must a DIFC company appoint a Data Protection Officer?
A DPO is mandatory for DIFC bodies and for controllers or processors that carry out high-risk processing on a systematic or regular basis. Other firms may appoint one voluntarily, which many regulated firms do. The DPO must have adequate independence, expertise and resources, and prepares an annual assessment of the firm's processing which, following the 2025 amendments, is submitted to the Commissioner. Firms that decide not to appoint a DPO should document why.
03Can individuals sue for data protection breaches in the DIFC?
Yes. Since DIFC Amendment Law No. 1 of 2025 took effect in July 2025, data subjects can bring claims for contraventions directly in the DIFC Courts, rather than only complaining to the Commissioner. Compensation can cover financial loss and non-financial harm such as distress. This raises the importance of contemporaneous records, including impact assessments, notices, transfer assessments and logs of how access and erasure requests were handled.
04What is DIFC Regulation 10?
Regulation 10 of the DIFC Data Protection Regulations governs personal data processed through autonomous and semi-autonomous systems, such as AI tools. It requires notices at first use explaining the system's purposes and outputs, processing only for human-defined or human-approved purposes, mechanisms for human intervention where outcomes may be unfair, and a register of use cases. High-risk processing is restricted unless conditions such as certification or appointing an Autonomous Systems Officer are met.
05How do DIFC firms transfer personal data outside the DIFC?
Transfers are permitted to jurisdictions on the DIFC adequacy list, or elsewhere with appropriate safeguards such as the DIFC standard contractual clauses or binding corporate rules, or under limited derogations. Mainland UAE is not treated as part of the DIFC, so sending data to an onshore affiliate or vendor also needs a lawful route. Firms should keep a short transfer assessment for each significant flow and review it when vendors or hosting arrangements change.
06Do DIFC firms have to report data breaches?
Yes. Controllers must notify the Commissioner promptly of a personal data breach that compromises data subjects' confidentiality, security or privacy, and must notify affected individuals where the breach is likely to result in a high risk to them. Processors must tell their controller without undue delay. A tested breach playbook, with clear roles and template notices, is the most practical way to meet these timelines.
Sources and official materials
- Data protection laws — UAE Government portal — Lists DIFC Law No. 5 of 2020 alongside the federal PDPL
- Dubai International Financial Centre — DIFC legislation, Data Protection Regulations and Commissioner guidance
- DIFC Courts — Forum for appeals and private data protection claims
- Abu Dhabi Global Market — ADGM Data Protection Regulations 2021 for comparison
- Artificial Intelligence and Data Authority — UAE Cabinet — June 2026 federal consolidation of data and AI functions
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
