⁦DIFC DPL⁩

⁦Dubai International Financial Centre (UAE free zone)⁩ پرائیویسی

حیثیت

⁦In force since 1 July 2020 (compliance grace period ended 1 October 2020); amendments in force 15 July 2025.⁩

یہ کن پر لاگو ہوتا ہے

⁦DIFC-incorporated entities wherever they process data, plus any controller or processor processing personal data in the DIFC, whether or not it is incorporated there.⁩✓ذرائع: ⁦government.ae⁩, ⁦twobirds.com⁩

سائز کی حدیں

⁦No size threshold. Every DIFC entity files a data protection notification at incorporation and whenever its processing changes.⁩✓ذرائع: ⁦difc.com⁩, ⁦government.ae⁩, ⁦dlapiperdataprotection.com⁩

ریگولیٹر

⁦Commissioner of Data Protection (DIFC)⁩✓ذرائع: ⁦difc.com⁩, ⁦dlapiperdataprotection.com⁩

خلاف ورزی یا واقعے کی رپورٹنگ

⁦Notify the Commissioner as soon as practicable of any breach that compromises data subjects⁩' ⁦confidentiality, security or privacy (there is no fixed hour deadline). Tell affected individuals as soon as practicable if the breach is high risk. Use the DIFC Personal Data Breach Reporting Form.⁩✓ذرائع: ⁦government.ae⁩, ⁦dlapiperdataprotection.com⁩, ⁦difc.com⁩

ذاتی ڈیٹا کی درخواستوں کے جواب کی آخری تاریخ

⁦One month, extendable by up to two further months for complex or numerous requests (the person must be told within the first month).⁩✓ذرائع: ⁦government.ae⁩, ⁦akingump.com⁩

ڈیٹا پروٹیکشن آفیسر

⁦Required for controllers/processors regularly doing High Risk Processing (e.g., large-scale sensitive data, AI or new tech); the Commissioner can also require one. DPO normally UAE-resident; groups may use one abroad.⁩✓ذرائع: ⁦government.ae⁩, ⁦dlapiperdataprotection.com⁩

مقامی نمائندہ

⁦No separate local representative requirement; covered entities operate in or from the DIFC, and the DPO must normally be UAE-resident.⁩✓ذرائع: ⁦government.ae⁩, ⁦dlapiperdataprotection.com⁩

ڈیٹا بیرونِ ملک بھیجنا

⁦Allowed to DIFC-approved adequate jurisdictions, or with safeguards (SCCs, Commissioner-approved BCRs) or derogations. Since 2025, exporters must document an adequacy assessment of the recipient jurisdiction.⁩✓ذرائع: ⁦government.ae⁩, ⁦difc.com⁩, ⁦twobirds.com⁩

کوکیز اور رضامندی

⁦Consent is one of several lawful bases; it must be a clear affirmative act, given separately for each purpose and withdrawable at any time. No standalone cookie rule, but platforms must default to minimal data collection. Individuals can object to direct marketing.⁩✓ذرائع: ⁦government.ae⁩, ⁦dlapiperdataprotection.com⁩

زیادہ سے زیادہ سزا

⁦Administrative fines of up to USD 100,000 per listed contravention under Schedule 2 (e.g., up to USD 50,000 for not appointing a required DPO), plus uncapped general fines for serious breaches and court compensation.⁩✓ذرائع: ⁦government.ae⁩, ⁦edge.sitecorecloud.io⁩, ⁦dlapiperdataprotection.com⁩, ⁦akingump.com⁩

جن حقائق پر “تصدیق جاری ہے” لکھا ہے ان کی ابھی تصدیق ہو رہی ہے اور انہیں جواب کے طور پر نہیں دیا جاتا۔

آپ کو کیا کرنا ہوگا✓

• ⁦File and keep current your DIFC data protection notification with the Commissioner.⁩
• ⁦Assess whether you do High Risk Processing; if so, appoint a DPO and run DPIAs.⁩
• ⁦Report qualifying breaches to the Commissioner, and tell high-risk affected people as soon as practicable.⁩
• ⁦Keep records of processing and honour data subject rights requests.⁩

حالیہ تبدیلیاں

⁦Amendment Law No. 1 of 2025 (in force 15 July 2025) added a private right of action in the DIFC Courts, clarified extraterritorial reach, and required documented adequacy assessments for transfers.⁩

ذرائع

• بنیادی ذریعہ: ⁦https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection⁩
• دوسرا ذریعہ: ⁦https://www.twobirds.com/en/insights/2025/united-arab-emirates/difc-enacts-amendments-to-data-protection-law⁩
• ریگولیٹر: ⁦Commissioner of Data Protection (DIFC)⁩

✓ = دو آزاد ذرائع سے تصدیق شدہ، جن میں کم از کم ایک سرکاری ہے۔ ہم تصدیق کیسے کرتے ہیں

صرف معلومات، قانونی مشورہ نہیں۔ قوانین بدلتے رہتے ہیں؛ اس صفحے پر انحصار کرنے سے پہلے ریگولیٹر یا کسی مستند وکیل سے تصدیق کریں۔ کوئی غلطی نظر آئی؟ ای میل کریں ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.