Regulations › Rest of world › United Arab Emirates

DIFC DPL

Data Protection Law, DIFC Law No. 5 of 2020

In force privacy

WhenIn effect since 1 July 2020

Who enforces itCommissioner of Data Protection, DIFC

Who it applies toControllers and processors in the Dubai International Financial Centre, and processing of personal data there.

Tell the regulatorNotify the Commissioner as soon as practicable in the circumstances DPO requiredDPO required for DIFC Bodies and for controllers or processors performing high-risk processing… RegistrationControllers and processors must register by filing a notification of processing with the Commi… Transfers abroadTransfer if destination has adequate protection or with appropriate safeguards, or listed dero… Request deadlineRespond within one month, extendable by two months for complex or numerous requests Maximum fineAdministrative fines up to USD 100,000 per standard contravention under Schedule 2

If you already comply with

86%

of DIFC's 21 requirements are already met by European Union (GDPR). Here is what DIFC DPL adds, biggest gaps first.

RegistrationGovernanceBig gap

GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.

DIFC DPL adds2 Controllers and processors must register by filing a notification of processing with the Commissioner, kept up to date, with fees. Art. 14(7)-(8) · source ↗

DPO qualificationsGovernanceGap

GDPR1 DPO chosen for professional qualities, especially expert knowledge of data protection law and practice; no certification required.

DIFC DPL adds2 DPO must know the law, be independent and reside in the UAE unless a group employee in an international role. Arts. 16(7), 17 · source ↗

RetentionGovernanceGap

GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.

DIFC DPL adds2 Keep data no longer than necessary; when the basis ends, delete, anonymize, pseudonymize, encrypt or put it beyond use. Arts. 9(1)(i), 22(1) · source ↗

Already covered by GDPR: Reach abroad, Lawful basis, Consent, Sensitive data, Children, Rights, Request deadline, Marketing, DPO required, DPIA, Records, Tell the regulator, Tell people, Transfers abroad, Localization, Maximum fine, Criminal liability, Private action.

A gap means DIFC DPL is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the map Follow Regulatory Watch

In force
Coming into force
Sector laws

AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL