DIFC DPL

Dubai International Financial Centre (UAE free zone) Privacy

Status

In force since 1 July 2020 (compliance grace period ended 1 October 2020); amendments in force 15 July 2025.

Who it applies to

DIFC-incorporated entities wherever they process data, plus any controller or processor processing personal data in the DIFC, whether or not it is incorporated there.✓Sources: government.ae, twobirds.com

Size thresholds

No size threshold. Every DIFC entity files a data protection notification at incorporation and whenever its processing changes.✓Sources: difc.com, government.ae, dlapiperdataprotection.com

Regulator

Commissioner of Data Protection (DIFC)✓Sources: difc.com, dlapiperdataprotection.com

Breach or incident reporting

Notify the Commissioner as soon as practicable of any breach that compromises data subjects' confidentiality, security or privacy (there is no fixed hour deadline). Tell affected individuals as soon as practicable if the breach is high risk. Use the DIFC Personal Data Breach Reporting Form.✓Sources: government.ae, dlapiperdataprotection.com, difc.com

Deadline to answer personal data requests

One month, extendable by up to two further months for complex or numerous requests (the person must be told within the first month).✓Sources: government.ae, akingump.com

Data protection officer

Required for controllers/processors regularly doing High Risk Processing (e.g., large-scale sensitive data, AI or new tech); the Commissioner can also require one. DPO normally UAE-resident; groups may use one abroad.✓Sources: government.ae, dlapiperdataprotection.com

Local representative

No separate local representative requirement; covered entities operate in or from the DIFC, and the DPO must normally be UAE-resident.✓Sources: government.ae, dlapiperdataprotection.com

Sending data abroad

Allowed to DIFC-approved adequate jurisdictions, or with safeguards (SCCs, Commissioner-approved BCRs) or derogations. Since 2025, exporters must document an adequacy assessment of the recipient jurisdiction.✓Sources: government.ae, difc.com, twobirds.com

Cookies and consent

Consent is one of several lawful bases; it must be a clear affirmative act, given separately for each purpose and withdrawable at any time. No standalone cookie rule, but platforms must default to minimal data collection. Individuals can object to direct marketing.✓Sources: government.ae, dlapiperdataprotection.com

Maximum penalty

Administrative fines of up to USD 100,000 per listed contravention under Schedule 2 (e.g., up to USD 50,000 for not appointing a required DPO), plus uncapped general fines for serious breaches and court compensation.✓Sources: government.ae, edge.sitecorecloud.io, dlapiperdataprotection.com, akingump.com

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

• File and keep current your DIFC data protection notification with the Commissioner.
• Assess whether you do High Risk Processing; if so, appoint a DPO and run DPIAs.
• Report qualifying breaches to the Commissioner, and tell high-risk affected people as soon as practicable.
• Keep records of processing and honour data subject rights requests.

Recent changes

Amendment Law No. 1 of 2025 (in force 15 July 2025) added a private right of action in the DIFC Courts, clarified extraterritorial reach, and required documented adequacy assessments for transfers.

Sources

• Primary source: https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection
• Second source: https://www.twobirds.com/en/insights/2025/united-arab-emirates/difc-enacts-amendments-to-data-protection-law
• Regulator: Commissioner of Data Protection (DIFC)

✓ = confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.