Home › Compare laws side by side › DIFC DPL vs EU GDPR
DIFC DPL vs EU GDPR
DIFC Data Protection Law, DIFC Law No. 5 of 2020 (as amended by DIFC Amendment Law No. 1 of 2025) (Dubai International Financial Centre (UAE free zone)) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.
| Topic | DIFC DPL Dubai International Financial Centre (UAE free zone) 12/14 facts confirmed by two sources | EU GDPR European Union (EEA) ✓ Confirmed by two sources |
|---|---|---|
| Status | In force since 1 July 2020 (compliance grace period ended 1 October 2020); amendments in force 15 July 2025. | In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓ |
| Who it applies to | DIFC-incorporated entities wherever they process data, plus any controller or processor processing personal data in the DIFC, whether or not it is incorporated there.✓ | Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓ |
| Size thresholds | No size threshold. Every DIFC entity files a data protection notification at incorporation and whenever its processing changes.✓ | None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓ |
| Regulator | Commissioner of Data Protection (DIFC)✓ | National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓ |
| Breach or incident reporting | Notify the Commissioner as soon as practicable of any breach that compromises data subjects' confidentiality, security or privacy (there is no fixed hour deadline). Tell affected individuals as soon as practicable if the breach is high risk. Use the DIFC Personal Data Breach Reporting Form.✓ | Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓ |
| Deadline to answer personal data requests | One month, extendable by up to two further months for complex or numerous requests (the person must be told within the first month).✓ | 1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓ |
| Data protection officer | Required for controllers/processors regularly doing High Risk Processing (e.g., large-scale sensitive data, AI or new tech); the Commissioner can also require one. DPO normally UAE-resident; groups may use one abroad.✓ | DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓ |
| Local representative | No separate local representative requirement; covered entities operate in or from the DIFC, and the DPO must normally be UAE-resident.✓ | Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓ |
| Sending data abroad | Allowed to DIFC-approved adequate jurisdictions, or with safeguards (SCCs, Commissioner-approved BCRs) or derogations. Since 2025, exporters must document an adequacy assessment of the recipient jurisdiction.✓ | Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓ |
| Cookies and consent | Consent is one of several lawful bases; it must be a clear affirmative act, given separately for each purpose and withdrawable at any time. No standalone cookie rule, but platforms must default to minimal data collection. Individuals can object to direct marketing.✓ | Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓ |
| Maximum penalty | Administrative fines of up to USD 100,000 per listed contravention under Schedule 2 (e.g., up to USD 50,000 for not appointing a required DPO), plus uncapped general fines for serious breaches and court compensation.✓ | Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓ |
= confirmed by two independent sources, at least one official.
Facts marked “Being verified” are still being confirmed and are not given as answers.
Who each law applies to
- DIFC DPL
- DIFC-incorporated entities wherever they process data, plus any controller or processor processing personal data in the DIFC, whether or not it is incorporated there.
- EU GDPR
- Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.
What you must do under DIFC DPL
- File and keep current your DIFC data protection notification with the Commissioner.
- Assess whether you do High Risk Processing; if so, appoint a DPO and run DPIAs.
- Report qualifying breaches to the Commissioner, and tell high-risk affected people as soon as practicable.
- Keep records of processing and honour data subject rights requests.
What you must do under EU GDPR
- Identify a lawful basis for every processing purpose and record it.
- Publish a clear privacy notice covering purposes, recipients, retention and rights.
- Keep a record of processing activities and sign Art 28 contracts with processors.
- Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
- Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
- Answer access, erasure and other rights requests within one month.
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@