⁦DIFC DPL⁩

⁦Dubai International Financial Centre (UAE free zone)⁩ الخصوصية

الحالة

⁦In force since 1 July 2020 (compliance grace period ended 1 October 2020); amendments in force 15 July 2025.⁩

على من ينطبق

⁦DIFC-incorporated entities wherever they process data, plus any controller or processor processing personal data in the DIFC, whether or not it is incorporated there.⁩✓المصادر: ⁦government.ae⁩, ⁦twobirds.com⁩

حدود الحجم

⁦No size threshold. Every DIFC entity files a data protection notification at incorporation and whenever its processing changes.⁩✓المصادر: ⁦difc.com⁩, ⁦government.ae⁩, ⁦dlapiperdataprotection.com⁩

الجهة الرقابية

⁦Commissioner of Data Protection (DIFC)⁩✓المصادر: ⁦difc.com⁩, ⁦dlapiperdataprotection.com⁩

الإبلاغ عن الخروقات أو الحوادث

⁦Notify the Commissioner as soon as practicable of any breach that compromises data subjects⁩' ⁦confidentiality, security or privacy (there is no fixed hour deadline). Tell affected individuals as soon as practicable if the breach is high risk. Use the DIFC Personal Data Breach Reporting Form.⁩✓المصادر: ⁦government.ae⁩, ⁦dlapiperdataprotection.com⁩, ⁦difc.com⁩

مهلة الرد على طلبات البيانات الشخصية

⁦One month, extendable by up to two further months for complex or numerous requests (the person must be told within the first month).⁩✓المصادر: ⁦government.ae⁩, ⁦akingump.com⁩

مسؤول حماية البيانات

⁦Required for controllers/processors regularly doing High Risk Processing (e.g., large-scale sensitive data, AI or new tech); the Commissioner can also require one. DPO normally UAE-resident; groups may use one abroad.⁩✓المصادر: ⁦government.ae⁩, ⁦dlapiperdataprotection.com⁩

الممثل المحلي

⁦No separate local representative requirement; covered entities operate in or from the DIFC, and the DPO must normally be UAE-resident.⁩✓المصادر: ⁦government.ae⁩, ⁦dlapiperdataprotection.com⁩

نقل البيانات إلى الخارج

⁦Allowed to DIFC-approved adequate jurisdictions, or with safeguards (SCCs, Commissioner-approved BCRs) or derogations. Since 2025, exporters must document an adequacy assessment of the recipient jurisdiction.⁩✓المصادر: ⁦government.ae⁩, ⁦difc.com⁩, ⁦twobirds.com⁩

ملفات تعريف الارتباط والموافقة

⁦Consent is one of several lawful bases; it must be a clear affirmative act, given separately for each purpose and withdrawable at any time. No standalone cookie rule, but platforms must default to minimal data collection. Individuals can object to direct marketing.⁩✓المصادر: ⁦government.ae⁩, ⁦dlapiperdataprotection.com⁩

أقصى عقوبة

⁦Administrative fines of up to USD 100,000 per listed contravention under Schedule 2 (e.g., up to USD 50,000 for not appointing a required DPO), plus uncapped general fines for serious breaches and court compensation.⁩✓المصادر: ⁦government.ae⁩, ⁦edge.sitecorecloud.io⁩, ⁦dlapiperdataprotection.com⁩, ⁦akingump.com⁩

المعلومات الموسومة بعبارة «قيد التحقق» لا تزال قيد التأكيد ولا تُقدَّم كإجابات.

ما يجب عليك فعله✓

• ⁦File and keep current your DIFC data protection notification with the Commissioner.⁩
• ⁦Assess whether you do High Risk Processing; if so, appoint a DPO and run DPIAs.⁩
• ⁦Report qualifying breaches to the Commissioner, and tell high-risk affected people as soon as practicable.⁩
• ⁦Keep records of processing and honour data subject rights requests.⁩

التغييرات الأخيرة

⁦Amendment Law No. 1 of 2025 (in force 15 July 2025) added a private right of action in the DIFC Courts, clarified extraterritorial reach, and required documented adequacy assessments for transfers.⁩

المصادر

• المصدر الأساسي: ⁦https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection⁩
• المصدر الثاني: ⁦https://www.twobirds.com/en/insights/2025/united-arab-emirates/difc-enacts-amendments-to-data-protection-law⁩
• الجهة الرقابية: ⁦Commissioner of Data Protection (DIFC)⁩

✓ = مؤكَّد من مصدرين مستقلين، أحدهما على الأقل رسمي. كيف نتحقق

معلومات فقط، وليست استشارة قانونية. القوانين تتغير؛ تحقّق مع الجهة الرقابية أو محامٍ مؤهل قبل الاعتماد على هذه الصفحة. هل لاحظت خطأ؟ راسلنا على ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.